Privacy Policy

1. Introduction

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit pitstopai.co or use the Pitstop AI booking and operations platform at app.pitstopai.co. We are committed to protecting your privacy and complying with applicable data protection laws, including the General Data Protection Regulation (GDPR).

2. Information We Collect

2.1 Information you provide (product)

• Business information: Business name, email, phone number, address, timezone, business hours, and settings
• Customer information: Name, phone number, email address, and notes
• Booking information: Service bookings, appointment times, preferences, and related notes
• Communication data: Messages exchanged via WhatsApp, including conversations and customer interactions

2.2 Automatically collected information

• IP addresses and device information
• Usage data and interaction patterns
• Consent records with timestamps

3. How We Use Your Information

We use the information we collect to:

• Provide and maintain our booking and customer management services
• Process bookings, manage appointments, and send reminders
• Facilitate communication between businesses and customers via WhatsApp
• Respond to inquiries and provide customer support
• Improve our services and develop new features
• Comply with legal obligations and enforce our terms of service
• Send marketing communications only with your explicit consent, which you can withdraw at any time

4. AI-Powered Features

Our platform uses artificial intelligence (AI) to assist with customer communications and booking management. When you interact with our AI assistant:

• You will be notified that you are interacting with an AI assistant at the start of each conversation
• Real business team members can monitor conversations and respond directly when needed
• Your conversations are stored securely and used to improve AI responses and service quality
• You have the right to request human assistance at any time during your interaction

5. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds:

• Contract performance: To fulfill our obligations in providing booking and communication services
• Legitimate interests: To improve our services, prevent fraud, and ensure security
• Consent: For marketing communications, analytics cookies, and certain AI-powered features (you can withdraw consent at any time)
• Legal obligations: To comply with applicable laws and regulations

6. Data Sharing and Third Parties

We share information with the following service providers who help us operate the website and platform:

• Supabase: Database hosting and authentication (product)
• Meta (WhatsApp Business API): WhatsApp communications (product)
• AI/LLM providers (for example Google Gemini or OpenAI): AI assistant features, processed under their privacy policies (product)
• Google Analytics: Visit statistics, only after you allow analytics cookies
• Vercel: Hosting. Optional Analytics and Speed Insights load only after you allow analytics cookies on the marketing site

All third-party service providers are required to maintain appropriate security measures and are prohibited from using your information for any purpose other than providing services to us. We do not sell, rent, or trade your personal information to third parties for marketing purposes.

7. Your Rights (GDPR)

Under the GDPR, you have the following rights regarding your personal data:

• Right to access: Request a copy of personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data
• Right to restrict processing: Request limitation of how we use your data
• Right to data portability: Request your data in a machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Withdraw consent for processing that requires it

To exercise these rights, contact us using the information in the Contact section below. We will respond within one month.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (TLS 1.3) and at rest
• Regular security assessments and updates
• Access controls and authentication mechanisms
• Regular backups and disaster recovery procedures

9. Data Retention

We retain product data for the following periods:

• Conversation messages: 2 years
• Bookings: 5 years
• Customer records: until deletion is requested by the business
• Consent records: until consent is withdrawn or data is deleted
• Logs: 30 days

We may retain certain data longer if required by law or necessary for legitimate business purposes.

10. International Data Transfers

Your data may be processed and stored in countries outside the European Economic Area (EEA). When we transfer data outside the EEA, we use appropriate safeguards such as Standard Contractual Clauses or adequacy decisions by the European Commission.

11. Cookies and Tracking

You can manage cookie preferences from the cookie banner, the Cookie preferences link in the footer, or the preference center. Analytics tools such as Google Analytics (and Vercel Analytics / Speed Insights on the marketing site) load only after you allow analytics cookies.

Website (pitstopai.co)

The public marketing and documentation site stores your cookie choice in localStorage. It does not set authentication or session cookies. There are no advertising pixels unless you allow marketing cookies and we enable a campaign tag in the future.

Product (app.pitstopai.co)

The application uses necessary cookies and storage for authentication, security, and session management. Functional storage (theme, language, branch) is used only if you allow functional cookies.

Types of cookies we use

Necessary cookies

Required for the site or app to work. On the product this includes authentication tokens, session management, and security. These cannot be disabled.

Functional cookies

Optional personalization such as theme, language, and selected branch in the product. The marketing site does not currently use functional cookies. These stay off until you allow them.

Analytics cookies

Help us understand how visitors use the website and product by collecting anonymous usage information. Google Analytics and Vercel performance analytics load only when this category is on.

Marketing cookies

Reserved for campaign measurement. Off unless you choose them. We do not run third-party ad networks today.

12. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us immediately.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us:

• Email: pitstopai.help@gmail.com
• Data Protection Officer: Mustafa Asif

You also have the right to lodge a complaint with your local data protection authority if you believe we have not adequately addressed your concerns.

Related Information

For information about how we make the product accessible, see our Accessibility Statement.