Privacy policy

Who we are

Pylot is an internal operations tool that connects meetings, action items and goals. It is operated by TAMM Ventures LLC, at 1098 Ann Arbor Rd W Suite 586 Plymouth, MI 48170, USA. In this policy, “Pylot”, “we” and “us” mean that company, and “you” means a person using the service.

Pylot is sold to organizations, and you almost certainly reach it through one — your employer, or whoever invited you. Your organization decides who may join it, what Pylot records on its behalf, and whether meetings are recorded at all. Where your organization has its own agreement with us, that agreement governs how we handle data on their instruction, and this policy describes the practices underneath it. If you want data removed and your organization administers your account, ask them first — and write to us at privacy@pylotapp.com either way.

You can reach us about anything in this document at privacy@pylotapp.com.

Information we collect

Account and identity

When you sign in we store your name, email address, the Google account identifier we know you by, and the profile picture URL Google gives us. You may upload a picture of your own, which replaces it, or ask for no picture at all, which we record as a decision so that signing in again does not undo it. We also store the role you hold in your organization, the timezone and clock format you prefer, and your notification preferences.

If you sign in with a password rather than with Google, we store a hash of that password — never the password itself — along with any two-factor authentication or passkey credentials you set up.

Information from your Google Account

This is described in full under Google user data below, because Google's requirements for it are stricter than the rest of this policy. In summary: we read your primary Google Calendar so that Pylot knows about your meetings, and we store an access token and a refresh token so we can keep doing so without asking you to sign in every hour.

Meetings and the people in them

For each meeting Pylot knows about, we store its title, its start and end time, the calendar event identifier, and — where the event has one — the video call link, which we find in the event's conferencing details, its location field or its description. We store the link itself and not the description or location it came from. We also store the attendees: each person's display name and email address as the calendar or the call reported it.

Some of those people will not be Pylot users. An external attendee's name and email address are stored because they were on a meeting a customer of ours attended. They are visible only inside that organization, under the same rules as everything else, and we do not email them, market to them, or build a profile of them.

An organization may also list the outside firms it works with, and people at them. An owner or admin of the organization can add a partner firm and, for each person there, a name and an email address. The address is used for one thing: to recognise that person when they speak in a recorded meeting, so that work they said they would do can be suggested as theirs. Work can then be assigned to the firm or to the person inside the organization, and each firm has a page inside the organization listing the work assigned to it. That page is a list of the organization's own work, not a profile of the person: it holds nothing about them beyond the name and address the organization entered. We never email, message, invite or sign in anybody listed this way, and nothing in Pylot links to them. Archiving a firm or a person stops them being offered for new work but keeps the name and address, so past work still reads correctly — archiving does not erase them.

Recordings and transcripts

Pylot can send a notetaker bot to a video call, which records the call and produces a transcript labelled by speaker. This is off unless two separate decisions have been taken: your organization must have turned recording on at all, and the individual meeting must be consented. Both are checked when the bot is scheduled and again immediately before it is sent, so withdrawing consent while the job is queued still stops it. Every consent decision is recorded — which policy applied, who decided, and when.

The bot appears in the participant list under a name that says what it is, so everyone on the call can see it is there. What we store afterwards is the transcript text, the diarized transcript with speaker labels and timestamps, and an identifier for the recording. We also keep a copy of the recording itself — the meeting's video, or its audio where no video was produced — in private storage of our own, held with Amazon Web Services. A copy is made only while your organization has recording turned on.

When you play a recording back, Pylot first checks that you are allowed to see the meeting, and then gives your browser a link to that copy which expires three hours after it is issued. Like any link, it works for whoever holds it until then, so it is not something to forward. Until the copy has been made, the link comes from our recording provider instead, minted at that moment rather than kept. Our recording provider keeps its own copy for seven days after the meeting and then deletes it, so a recording we could not copy in that time can no longer be played; its transcript is kept.

What you create in Pylot

Meeting agendas and project documents, articles in the knowledge base, action items, goals and check-ins, comments and replies, tags, teams and projects, custom fields your organization defines, and the free-text notes your organization writes about itself to help summaries read correctly. We keep a version history of documents — up to fifty versions each — so an overwrite can be undone.

We also keep an activity record of significant actions: who created, renamed, restored or changed the status of something, and when. Activity records store the fact, never the content — a check-in note, the body of a document and the words of a comment are not copied into them.

Contacts at the companies you work with

If your organization uses Pylot's CRM, its members keep a list of the companies it works with and the people there: a name, and optionally an email address, phone number, job title and location. Members enter these themselves, or bring them in from a spreadsheet through an AI client they connect. A contact's email address is used only to recognise that person on your organization's meetings and the commitments made in them, so they appear on the right company's page.

Pylot never contacts the people on that list: nothing is ever sent to a contact, and a contact has no account. If somebody asks to have their details removed, your organization can ask us and we erase the contact by hand.

Systems your organization connects

If your organization connects its own Fulfil account to the CRM, Pylot reads from that account with an API key one of your organization's owners enters. Pylot only reads: it never changes anything in Fulfil, and we recommend a key from a Fulfil user with a read-only role. The key is stored encrypted and is never shown again once it is saved.

Pylot copies only the Fulfil customers in the categories your organization names, such as its dealers, so retail buyers are never copied. For those customers it keeps a name, a customer code, and a one-way fingerprint of each email address, used to suggest which company a customer is — never the address itself. For a company a member has linked to one of those customers, Pylot keeps its orders' dates and references, its total spend in each currency, and whether an invoice is past due, with that invoice's reference and due date. It never keeps a balance owed.

If your organization connects its Gorgias account, Pylot reads support tickets from it with an API key and the email of the Gorgias user it belongs to, both entered by an owner and stored encrypted. Gorgias API keys cannot be limited to reading, so a key carries its user's full rights; Pylot only ever reads with it and never changes anything in Gorgias. It keeps a reference only to a ticket whose requester is one of your organization's contacts, or writes from one of its companies' domains: the ticket's subject, status and channel, when the customer last wrote, the requester's address used to match it, and a link back to Gorgias. Pylot never keeps the conversation itself — no message body is copied.

Fulfil and Gorgias are not our sub-processors: each is a system your organization chose, under its own agreement with that provider. An owner can disconnect either at any time under Settings, CRM, which deletes its key; disconnecting Gorgias also removes every ticket reference read from it.

Files you upload

Attachments, images placed in documents and agendas, profile pictures and organization logos. For each we store the file itself, its size, the file type we determined by inspecting the file's own contents, the name you gave it, and who uploaded it.

Technical information

Signing in creates a session, and the session record holds your IP address and browser user-agent string. Our servers keep ordinary application and error logs. Where an external service fails, we record the reason on the affected row so you can read it on the screen rather than having to ask us.

If you join the waitlist

The form on our homepage asks for one thing, your email address, and we use it only to tell you when Pylot opens to you. We keep it as a contact with Resend, our email provider, and nowhere else; it is not linked to an account, because you do not have one yet. Write to us and we will remove it.

What we do not collect

• No analytics or tracking of any kind. Pylot runs no Google Analytics, no product-analytics service, no session recording, no error-reporting service and no advertising or social media pixels. There is nothing in the application that reports your behaviour to a third party.
• No advertising identifiers, and no data bought from or sold to data brokers.
• No location data beyond what an IP address implies.
• No special category data is asked for — though a meeting is a conversation, and a conversation can contain anything. See your rights.

How and why we use it

We use the information above to run the service and for nothing else. Where the General Data Protection Regulation or the UK GDPR applies, the legal basis for each use is:

We do not use your content to train machine learning models, our own or anyone else's, and our agreements with our AI provider are on terms that say the same. We do not use your content for advertising. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Google user data

Pylot uses Google Sign-In and the Google Calendar API. This section says exactly what we ask for, why, and what we do with it.

The scopes we request, and why

We request calendar.readonly rather than full calendar access because Pylot never creates, edits or deletes anything on your Google Calendar. We also request offline access, which is what lets a scheduled calendar sync run while you are not at your desk. In practice we read your primary calendar only, within a window around the present day.

Google files embedded in a document

A document in Pylot can show a Google Doc, Sheet or Slides file inside it. That file is displayed by Google, in the reader's own browser, using the reader's own Google account and the file's own sharing settings — somebody the file is not shared with sees Google's refusal, not its contents. Pylot does not request access to your Google Drive, and does not read, store or copy the contents of an embedded file. From the link that was pasted, we store only which kind of Google file it is and the file's identifier — not the file's name, and nothing in it.

What we do with it

• What we store from your calendar: the event title, its start and end times, its identifier, whether it belongs to a recurring series, the attendees' names and email addresses, and the video call link. Nothing else from the event is kept.
• Who can see it: people in your organization, under the visibility rules described below. By default a meeting is visible to the people who were on it. You choose separately whether to share your calendar more widely than that.
• Your tokens: your Google access and refresh tokens are encrypted in our database, are excluded from anything the application serializes, are never written to a log or an error message, and are never sent to your browser.
• Retention: tokens are kept while your account is connected. You can revoke Pylot's access at any time from your Google Account's security settings, which stops all further reads immediately. Meetings already synced remain in your organization's records until deleted.
• Transfer: Google user data is not sold, not shared with anyone for advertising, and not passed to any third party other than the infrastructure providers listed below that are needed to run the service.

Limited Use

Pylot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, we do not transfer Google user data to third parties except as necessary to provide or improve the features you are using, to comply with applicable law, or as part of a merger or acquisition; we do not use Google user data for advertising; we do not allow humans to read it except with your explicit permission, where necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymized; and we do not use Google user data to develop, improve or train generalized AI or machine learning models.

Automated processing and AI features

Where a meeting has been recorded, Pylot sends the transcript to Anthropic's Claude API to write a summary and propose action items. What is sent is the meeting's title and date, the list of participants' names and email addresses, the transcript text, and any notes your organization has written about itself. Nothing else.

A proposed action item is nobody's work until a person confirms it. Extraction is automatic; assignment is not. An item the model proposes is not counted anywhere, is not shown as assigned to anyone, and generates no notification, however confident the extraction was. Only a person reviewing and confirming it makes it real, and editing a proposal does not confirm it. There is no decision in Pylot that produces a legal or similarly significant effect on you without a person taking it.

Your content is not used to train Anthropic's models. Our request logs record token counts and whether the call succeeded — never the prompt, the transcript or the key.

Who we share it with

Inside your organization

Pylot is multi-tenant: every record belongs to exactly one organization, and that boundary is enforced in the database layer rather than by each screen remembering to ask. One organization cannot read or write another's data.

Within your organization, visibility is narrower again. Content is private, visible to a team, or visible to the whole organization, and every list, count and progress percentage is calculated for the person reading it — so a number never gives away the existence of something you cannot open. Meetings follow attendance: by default, the people who were on a call can read it, plus anyone you have chosen to share your calendar with. Notifications and the daily digest apply the same rules, so an email never carries a row the recipient could not have opened for themselves.

AI clients you connect

If your organization allows it, you may connect an AI client of your own choosing — such as Claude, ChatGPT, Claude Code or Codex — to Pylot. An AI client you connect receives Pylot data on your behalf, under your authorization, and sees only what you could see on a screen. When you connect one you choose whether it may only read or may also make changes, and anything it changes is recorded as your change. Your organization's owners and admins can switch this off for everyone, which refuses every connected client at once.

The provider of that client is not our sub-processor: you choose it, and what it does with what it receives is governed by your agreement with that provider. Pylot holds the access and refresh tokens that let a client reach your data, never the reverse. You can see and disconnect your clients under Settings, Connected apps, and an owner or admin can disconnect anyone's. Disconnecting a client, removing you from your organization or closing your account revokes its tokens straight away. Disconnecting does not recall anything a client has already received.

Slack, if your organization connects it

An owner of your organization may connect your organization's own Slack workspace to Pylot. Pylot then holds a bot token for that workspace, stored encrypted, and uses it only to look up the people in the workspace, to match them to your organization's members by email address, to send each member who chooses it their Pylot notifications as direct messages, and to show the forms behind the /pylot command. Pylot never reads your Slack conversations.

Each member decides, notification by notification, whether it arrives by email, in Slack, or both; nothing goes to Slack unless you chose it and your account is linked. A Slack message carries the same facts as the email it replaces — a title, who did something, a short quoted comment where the email quotes one, and a link back to Pylot; a meeting reminder also carries the meeting's start time and, when it has one, the meeting's own call link — and is subject to the same rules about who may see what. Slack is not our sub-processor: it is a system your organization chose, and what Slack keeps is governed by your organization's agreement with Slack. Disconnecting Slack, or removing Pylot from the workspace, stops every message and revokes the token, and disconnecting deletes every member's link. It does not recall messages already sent.

A member whose Slack account is linked can also act in Pylot from Slack: add an action item, list their own open ones, check in a goal, or post a project update. Pylot receives only what that member typed or chose in Slack, and, when they turn a message into an action item, that one message's text and a link to it, which become the item's title and description. Anything done this way is done as that member, under exactly the rules that apply to them in Pylot, and Pylot's replies are shown only to them.

Sub-processors

We use the following service providers. Each receives only what it needs, and none of them may use your data for their own purposes.

We will update this list before adding a sub-processor. We may also disclose information where the law requires it, to enforce our terms, to protect the rights and safety of people using the service, or to a buyer as part of a merger or acquisition — in which case this policy continues to apply until it is replaced by one you are told about.

How long we keep it

• Your account and your content are kept for as long as your organization uses Pylot. We keep them, rather than expiring them on a schedule, because the product's purpose is that last quarter's decisions are still findable.
• Document history is capped at fifty versions per document; older versions are removed as newer ones are written.
• Recordings. Our copy of a recording is kept with your organization's account, like the transcript, and is not deleted on a schedule. Recall.ai holds the recording for seven days after the meeting, which is long enough for us to copy it, and then deletes it. Recordings made before we set that limit are deleted from Recall.ai once our own copy exists.
• Sessions expire through ordinary inactivity. Logs are rotated.
• When you ask us to delete something, we delete it. Some records are removed immediately and some are marked deleted and removed in the ordinary course of maintenance; in either case they stop being reachable from the application. Backups are overwritten on their own cycle. Where we are required to keep something — to comply with the law, or to resolve a dispute — we keep only that. Recordings are the exception. Deleting a meeting, or closing your account, does not remove the stored copy of a recording; once the meeting is deleted, Pylot will not issue a new link to it.
• When you close your Pylot account, your name and email address come off the meetings you were on: on attendee lists, on commitments and on the speaker labels of transcripts you appear as “Former member”. A transcript speaker label is changed where Pylot had linked it to you, including in a transcript that arrives after you close your account; one it never could link, such as a name typed into a call that matched nobody, stays as the call reported it. So that a colleague's calendar or a late transcript cannot put you back, we keep a one-way fingerprint of your address and of the names you appeared under, which lets us recognise them if they are shown to us again and cannot be turned back into the address or the name. Words people wrote or said that mention you, and meeting summaries, stay as they were written.

How we protect it

• Everything travels over TLS.
• Google access and refresh tokens are encrypted at rest, hidden from serialization, and never logged.
• There is no public URL to a file you uploaded, and there never will be. Every file you upload is served through one signed, authenticated route that checks your organization and then the permissions of the thing the file is attached to. A file's type is determined by inspecting its actual bytes rather than trusting its name, and file types that can carry scripts are refused.
• Recordings are played differently, because a video is too large to pass through that route. After checking that you may see the meeting, Pylot sends your browser to a link into our private recording storage that is signed for that one recording and expires after three hours.
• Webhooks from our recording provider are signature-verified before anything is processed, and an unconfigured secret causes the endpoint to refuse rather than to accept.
• Passwords, where used, are hashed. Two-factor authentication and passkeys are available.

No service is perfectly secure, and we do not claim otherwise. If you believe you have found a vulnerability, please write to privacy@pylotapp.com.

Your rights

If you are in the EEA, the UK or Switzerland

You have the right to ask for a copy of the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on consent, you may withdraw it at any time, which does not affect what was done before you did. You may also complain to your data protection authority.

If you are in California

Under the CCPA as amended by the CPRA you have the right to know what personal information we collect and why, to access it, to correct it, to delete it, and to limit the use of sensitive personal information. We will not discriminate against you for exercising any of them.

We do not sell personal information, and we have not sold personal information in the preceding twelve months. We do not share personal information for cross-context behavioural advertising. There is no “Do Not Sell or Share My Personal Information” link on this site because there is nothing for it to turn off.

How to exercise any of this

Write to privacy@pylotapp.com from the address on your account, and we will answer within the time the applicable law allows — thirty days in most cases. We may need to verify who you are before acting, which for most requests means confirming control of that address. You may use an authorised agent.

If your organization administers your account, some requests are theirs to fulfil rather than ours, and we will tell you so and put you in touch rather than leaving you without an answer. Within the product you can already change your name, picture, timezone and notification preferences, and choose who your meetings are shared with.

Where your data is held

Pylot is operated from the United States and our sub-processors are principally United States companies. If you are in the EEA, the UK or Switzerland, using Pylot means your information is transferred to the United States. We rely on the European Commission's Standard Contractual Clauses, and the UK Addendum where it applies, for those transfers, and our agreements with sub-processors carry the same terms.

Children

Pylot is a workplace tool. It is not directed to children, we do not knowingly collect information from anyone under 16, and accounts are created by organizations for their own people. If you believe a child has given us information, write to us and we will delete it.

Cookies

Pylot sets one cookie, which holds your session so that you stay signed in, and one that protects forms against cross-site request forgery. Both are strictly necessary, neither is used for analytics or advertising, and there is no third-party cookie because there is no third-party script. Your browser may also keep a local preference such as the light or dark theme; that stays in your browser and never reaches us. Because nothing here is optional, there is no consent banner to click through.

Changes to this policy

We will update this page when our practices change, and the effective date at the top will move. Where a change is significant — a new sub-processor, a new category of data, a new purpose — we will tell account holders by email rather than relying on you to re-read the page.

Contact us

TAMM Ventures LLC
1098 Ann Arbor Rd W Suite 586 Plymouth, MI 48170, USA
privacy@pylotapp.com