Legal · Privacy · GDPR & CCPA

Privacy Policy

Effective date: 2026-07-27

This policy explains what personal data SpendPilot collects through this website, how we use it, the third parties that process it, and the rights you have under GDPR (EU/UK) and CCPA/CPRA (California). We keep the language plain because we want you to actually read it.

1. Data we collect

When you submit the early-access form on this site, we collect:

Email address — required. Used to contact you about onboarding.
Company name — optional. Helps us route your inquiry to the right team.
Agent fleet size — optional. One of small (1–10 agents), medium (10–50 agents), or large (50+ agents).
Tracking description — optional. Free-text context you type into the form.

In addition, every visit to this site generates standard server logs (your IP address, browser user agent, request path, and timestamp) and stores a first-party visitor identifier in your browser. See Cookies and tracking below.

2. Purposes

We use the data above to:

Respond to your early-access request and schedule onboarding.
Send you product update emails related to SpendPilot. You can opt out at any time.
Aggregate conversion analytics (e.g. how many visitors request early access) to improve the site.

We do not sell your submitted information, and we do not share it with third parties for their own marketing purposes.

3. Third-party processors

We share the data above with the following subprocessors so we can run SpendPilot. Each operates under its own data-processing agreement.

Stripe

Payments & webhooks

Stripe powers SpendPilot’s checkout and delivers subscription webhook events to our server. On signup, Stripe receives your email address and any payment metadata you enter (card details never reach our database). Privacy: https://stripe.com/privacy.

Supabase

Planned aggregate cache

We do not currently send data to Supabase. Supabase is listed here in advance because we plan to forward anonymised aggregate counters (no email addresses, no free-text fields) for operational monitoring. Privacy: https://supabase.com/privacy.

Render

Hosting

Render hosts the SpendPilot web service. Render receives standard HTTP request logs (IP, user agent, request path, response status) for every request served. Privacy: https://render.com/privacy.

Neon

Primary database

Neon hosts the Postgres database where your early-access submission is stored. The row includes email, company, agent_fleet_size, and tracking_description exactly as you submitted them. Privacy: https://neon.tech/privacy-policy.

4. Cookies and tracking

We use only first-party analytics on this site:

/js/track.js — a small first-party script that POSTs a page-view event to /api/track/page-view with the page path and referrer. No third-party domains are contacted.
Polsia pixel — a 1×1 image beacon that records an anonymised visit count for hosting accounting. It stores a randomly-generated visitor id in your browser’s localStorage under the key polsia_vid. The id is not tied to your email or any submitted form field.

We do not set advertising cookies, retargeting pixels, or any cross-site tracking identifiers.

5. GDPR (EU/UK) rights

If you are in the European Economic Area, the United Kingdom, or a comparable jurisdiction, you have the following rights under the General Data Protection Regulation:

Right of access (Art. 15) — request a copy of the personal data we hold about you.
Right to rectification (Art. 16) — ask us to correct inaccurate data.
Right to erasure / “right to be forgotten” (Art. 17) — ask us to delete your data.
Right to restriction of processing (Art. 18) — ask us to pause processing while we address a dispute.
Right to data portability (Art. 20) — receive the data you submitted in a structured, machine-readable JSON export.
Right to object (Art. 21) — object to processing based on legitimate interest.
Right to withdraw consent (Art. 7(3)) — where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, email privacy@spendpilot.app. We respond within 30 days. You also have the right to lodge a complaint with your local data-protection authority.

6. CCPA / CPRA (California) rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

Right to know — request the categories and specific pieces of personal information we have collected about you.
Right to delete — ask us to delete personal information we have collected from you, subject to the usual exceptions.
Right to opt out of sale or sharing — SpendPilot does not sell or share your personal information, so there is nothing to opt out of.
Right to limit use of sensitive personal information — we do not collect sensitive personal information (no government identifiers, no precise geolocation, no biometrics, no health data, no financial account credentials).
Right to non-discrimination — we will not deny service, charge a different price, or provide a different level of quality because you exercise any of these rights.

To exercise these rights, email privacy@spendpilot.app. We respond within 45 days.

7. Data retention

We retain your early-access submission in the early_access_signups Postgres table until the earlier of: (a) you request deletion under the rights above, or (b) the launch trial concludes and the row is archived. Aggregated, non-identifying analytics counts may be retained indefinitely.

8. Children's data

SpendPilot is not directed at children under 16, and we do not knowingly collect personal information from anyone under 16. If you believe a child has submitted data through this form, email privacy@spendpilot.app and we will delete it.

9. Changes to this policy

We will post material changes on this page and announce them via a banner on the homepage. The last-updated date below reflects the most recent revision.

Last updated: 2026-07-27

10. Contact

For any privacy question, data request, or complaint, email privacy@spendpilot.app. We read every message and respond within the timeframes stated above.