This Privacy Policy explains how QueenPilot, Inc. ("QueenPilot", "we", "us") collects, uses, shares and protects personal information when you use the QueenPilot website, web and mobile apps, booking pages, AI features and related services (the "Service").
In short: we use personal information to run the Service, keep it secure and support you. We do not sell personal information. Salons and other businesses using QueenPilot control the data of their own clients, and we process it for them.
1. Our two roles
As a controller. We decide how personal information is used for our own website, for the accounts of businesses and their team members, for Clients' own QueenPilot accounts, and for billing, security and support.
As a processor (service provider). When a salon, studio or professional ("Business Customer") stores information about its clients, bookings, messages and staff in QueenPilot, the business is the controller of that data and we process it on its behalf and under its instructions. If you are a client of such a business and have a question about your data, you can contact the business directly or write to us and we will pass your request on.
2. Information we collect
Information you give us
- Account details: name, email address, phone number, password, profile photo, language and time zone.
- Business details: business name, locations and addresses, services, prices, working hours, team members, photos and descriptions.
- Booking details: services booked, dates and times, the professional, notes, preferences, visit status and history.
- Client records that Business Customers keep, such as contact details, visit history, spending, notes and preferences.
- Messages between Clients and businesses, including messages received and sent through connected channels (such as WhatsApp, Instagram, Messenger and Yelp) and replies written by the AI receptionist.
- Payment and billing details: plan, invoices, payment status and the last four digits and type of a card. Full card numbers are handled by our payment processor, Stripe, and never stored by us.
- Reviews and ratings that Clients leave after visits.
- Support requests and anything you send us through our contact form or email.
Information collected automatically
- Device and usage data: IP address, browser and device type, operating system, pages and screens viewed, actions taken, and dates and times of use.
- Approximate location from your IP address, used to show prices in your currency, choose a default language and suggest nearby businesses. Precise location is used only if you allow it on your device.
- Cookies and similar technologies (see section 9).
Information from others
- From Business Customers, when they add you as a client or team member.
- From services you connect, such as Google sign-in or a messaging account, within the permissions you grant.
3. How we use information
- To provide the Service: accounts, booking, calendars, reminders, messaging, checkout and reports.
- To run AI features you or a business turn on (see section 4).
- To send service messages: booking confirmations, reminders, changes, receipts, security alerts and account notices.
- To bill subscriptions and add-ons and keep financial records.
- To provide support and answer your requests.
- To keep the Service secure, prevent fraud and abuse, and fix problems.
- To understand how the Service is used and improve it.
- To send news and offers about QueenPilot where the law allows or you agreed; you can opt out at any time.
- To comply with the law and enforce our Terms of Service.
Legal bases (EEA, UK and similar laws): performance of a contract, our legitimate interests (running, securing and improving the Service, which we balance against your rights), your consent (for example optional marketing or precise location), and legal obligations.
4. AI features
Some features send information to AI model providers so they can produce a result:
- The AI receptionist processes Client messages together with the business's services, prices, free times and rules to write replies and make bookings for that business.
- The AI assistant processes a business user's questions together with the business data needed to answer them.
- The AI marketing autopilot processes a business's photos, services and descriptions to create social media content.
We use AI providers under terms that do not permit them to use this data to train their general models, and we send only what a task needs. We do not use AI to make decisions that have legal or similarly significant effects on you.
5. How we share information
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share it only as follows:
- With the business you book with: your name, contact details, booking details and notes you write, so it can provide the service.
- With service providers who work for us under contract and only on our instructions: cloud hosting and storage, content delivery and security (such as Cloudflare), email and SMS delivery, AI model providers, payment processing (Stripe), analytics and maps (Google), and customer support tools.
- With channels you connect: messages sent through WhatsApp, Instagram, Messenger or Yelp pass through those platforms under their own privacy policies.
- For legal reasons: when the law, a court order or a valid government request requires it, or to protect the rights, safety and security of our users, the public or QueenPilot.
- In a business transfer: if QueenPilot is part of a merger, acquisition or sale of assets, under the same protections as this Policy.
- With your consent or at your direction.
6. International transfers
QueenPilot is a US company and our providers operate in several countries, so your information may be processed in the United States and other countries whose laws may differ from yours. Where the law requires, we protect such transfers with appropriate safeguards, such as the European Commission's Standard Contractual Clauses.
7. How long we keep information
We keep personal information while your account is active and as long as needed to provide the Service. After an account is closed, we delete or anonymize its data within 90 days, except what we must keep longer for legal, tax, accounting, security or dispute purposes. Business Customers decide how long they keep their clients' records and can delete them at any time.
8. Security
We use encryption in transit, access controls, role-based permissions, monitoring and regular backups to protect information. No system is perfectly secure, so we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and the authorities as the law requires.
9. Cookies
We use cookies and similar technologies that are necessary to sign you in, remember your language and keep the Service secure, and analytics cookies to understand how our website is used. You can control cookies in your browser settings; blocking necessary cookies may stop parts of the Service from working.
10. Your rights and choices
Depending on where you live, you may have the right to:
- access the personal information we hold about you and get a copy of it;
- correct inaccurate information;
- delete your information;
- receive your information in a portable format;
- object to or restrict certain processing, and withdraw consent at any time;
- opt out of marketing messages;
- not be discriminated against for using these rights (including under California law);
- complain to your local data protection authority.
To use these rights, write to [email protected]. We may need to confirm your identity and will answer within the time the law requires (usually 30 days, 45 days for US state privacy laws). An authorized agent may make a request for you with your written permission. If your information is held by a business as its client, we will help that business answer your request.
11. Marketing messages
You can stop marketing emails with the unsubscribe link in each email, in your account settings or by writing to us. We will still send service messages, such as booking confirmations and security alerts.
12. Children
The Service is not directed to children under 13, and business accounts are for adults. We do not knowingly collect personal information from children under 13 (or under 16 where local law sets that age) without a parent's consent. If you believe a child has given us personal information, contact us and we will delete it.
13. Changes to this Policy
We may update this Policy. If a change is material, we will tell you by email or in the Service before it takes effect. The date at the top shows when it was last updated.