Privacy Policy
Updated:
This policy explains how WEBPilot ("we") handles personal data on webpilot.top and in the WEBPilot dashboard. We wrote it to be read, not just accepted. If something is unclear, contact us.
Early access. WEBPilot does not collect data from the visitors of our customers' websites yet. Before that feature is launched, this policy will be updated to describe exactly what the tracking script collects. Account holders will be informed by e-mail.
1. Data we collect today
Account data. When you create an account: your name, e-mail address, password, company or project name, country, preferred language and time zone. The password is stored only as a one-way hash (PBKDF2-SHA256 with a unique salt); nobody at WEBPilot can read it.
Data you add to the dashboard. Websites you register (name, domain, main language, time zone) and the entries of your strategy timeline (date, category, title, description, cost and notes).
Contact form. Name, e-mail address, subject, message, the language of the page and the IP address of the sender. The IP address is kept to prevent abuse.
Security records. For each login attempt we store the e-mail typed, the IP address, the date and whether it succeeded. For each session we store the IP address and the browser identification (user agent) at the moment of login.
Server logs. The server records the requested path, the response status and the response time. Query strings are not written to the logs.
2. What we don't do
- We don't use third-party analytics, advertising pixels or social media trackers on webpilot.top.
- We don't sell or rent personal data.
- We don't use the content of your strategy timeline for any purpose other than showing it to you and to the people in your company account.
3. Cookies and local storage
We only use what is needed for the site to work:
| Name | Type | Purpose | Duration |
|---|---|---|---|
wp_session |
Cookie | Keeps you logged in | Until you log out, at most 14 days |
wp_csrf |
Cookie | Protects forms against cross-site request forgery | Browser session |
wp_flash |
Cookie | Shows a one-time confirmation message | 60 seconds |
wp-theme |
Local storage | Remembers light, dark or system theme | Until you clear it |
These items are strictly necessary or store a preference you chose, so they don't require a consent banner. None of them is used for advertising or profiling.
4. Why we use the data (legal bases)
- To provide the service you signed up for: account, websites and timeline (performance of a contract).
- To keep the service secure: login records, rate limiting and abuse prevention (legitimate interest).
- To answer your messages sent through the contact form (legitimate interest, or pre-contractual steps).
- To send service e-mails such as e-mail confirmation and password reset (performance of a contract).
- To comply with legal obligations when applicable.
5. Who processes the data with us
Data is stored on servers operated by our hosting provider. Service e-mails are sent through an e-mail delivery provider. These companies act on our instructions and may not use the data for their own purposes. We may disclose data to authorities when required by law.
Depending on where you live, your data may be processed in another country. When that happens we rely on the safeguards required by applicable law.
6. How long we keep it
- Account data and dashboard content: while your account is active. When you ask us to delete the account, it is removed within 30 days, except where the law requires us to keep something longer.
- Login attempts: 30 days.
- Sessions: until logout or expiry, at most 14 days.
- Password reset links: valid for one hour; e-mail confirmation links for 48 hours.
- Contact messages: for as long as needed to handle the request and any follow-up.
7. Your rights
Under the GDPR, the Brazilian LGPD and similar laws, you can ask to access, correct, export or delete your personal data, object to certain uses or withdraw consent you gave. To make a request, use the contact form and choose "Privacy and personal data" as the subject. We may ask you to confirm your identity before acting on the request.
You can also file a complaint with your data protection authority, such as the ANPD in Brazil or the supervisory authority of your country in the European Union.
8. Security
Connections use HTTPS. Passwords are hashed, session tokens are stored only as hashes, forms are protected against forgery and login attempts are rate limited. Each company's data is separated from other companies' data in every database query. No system is perfectly secure, so if you notice anything suspicious, please tell us.
9. Children
WEBPilot is a tool for businesses and professionals and is not intended for people under 18.
10. Changes to this policy
When we change this policy, the date at the top is updated. Important changes will also be communicated by e-mail to account holders before they take effect.