Privacy Policy

A. Account Registration & Profile Data

When you create an Autopilot account, we collect:

• Legal first name, middle name (optional), and last name
• Date of birth
• Email address
• Password (stored in hashed form, we do not store plaintext passwords)
• Optional onboarding information: how you heard about us, and any referral or invite code used

B. Traveler Profile Data

To enable fare monitoring, rebooking, and reservation management, we collect the following information about you and any companion travelers on your reservations:

• Full legal name (first, middle, last) and date of birth
• Email address and phone number (as extracted from reservation records)
• Known Traveler Number (KTN) and redress number, if applicable
• Canadian travel authorization number, if applicable
• Home airport and preferred airline
• Seat preferences, cabin preferences, and CLEAR membership status
• Frequent flyer program names and numbers, airline or alliance status, and elite tier designation
• Upgrade preferences and history (target cabin, cost, upgrade type)
• Voucher and travel credit reference numbers and amounts

Note on Companion Travelers: If a reservation you import includes other travelers (e.g., family members, colleagues), we process their personal information as described in this Notice. By importing such a reservation, you represent that you have authority to do so and have informed those individuals of Autopilot's privacy practices.

C. Flight Reservation Data

For each flight reservation we track on your behalf, we store:

• Confirmation number (PNR), airline, ticket number, and ticket issue date
• Payment amounts (base fare, taxes, total), payment method type, and currency
• Reservation status and flags (e.g., refundable, award, basic economy, companion fare, elite upgrade direct booking)
• Full PNR data (JSON format) and original confirmation email (HTML format)
• Departure and arrival airports, dates, and times
• Flight number, aircraft type, seat assignment, fare class, fare code, and cabin name
• Real-time flight status and codeshare details
• Voucher and credit reference numbers and amounts

D. Hotel Reservation Data

For hotel reservations, we store:

• Confirmation number, hotel chain and property name, IATA number, and chain/brand code
• Check-in/check-out dates, number of nights, arrival time, and reservation status
• Total price, award price (points), currency, and cancellation details
• Raw reservation data (JSON) and cancellation/guarantee policy text
• Hotel property contact information and full physical address
• Geographic coordinates of the property
• Room type, maximum occupancy, rate plan code/name, and description
• Reservation flags (advanced purchase, flexible, tracking, auto-rebook, award, direct booking)
• A tokenized payment card number provided by certain hotel chains for reservation guarantee purposes only. We do not use this token for any charging or payment processing.

E. Payment & Billing Information

We use Stripe, Inc. as our payment processor. We do not store full payment card numbers on our servers. Through Stripe, we retain:

• Last four digits of your payment card
• Card type (credit/debit), card network, and issuing bank
• Billing name and billing address

All full card numbers and sensitive financial credentials are held exclusively by Stripe and are subject to Stripe's Privacy Policy (stripe.com/privacy). We have no access to your full card number.

F. Support & Communications

When you contact us for support or otherwise communicate with us, we collect the contents of those communications and any personal information you choose to share.

When you visit our website or use the Services, we and our third-party partners automatically collect:

• IP address and coarse location derived from your IP address
• Device identifiers, browser type and version, and operating system
• Pages visited, time on pages, clickstream data, and referring URLs
• Session recording data (mouse movements, scrolls, clicks) captured via PostHog
• App usage patterns and feature interaction data

We do not currently collect precise geolocation data (GPS coordinates). If we do so in the future, we will update this Notice and seek your consent where required by applicable law.

We may receive information about you from:

• Google (OAuth Sign-In): If you sign in via Google, we receive your email address, first name, last name, and profile picture URL. This does not grant access to your Gmail inbox; that requires a separate authorization (see Section 4).
• Travel Providers (Airlines & Hotels): We may receive reservation data, fare information, and itinerary updates from airline and hotel systems as part of providing the Services.
• Referral & Affiliate Sources: If you were referred by an affiliate or influencer partner, we may receive limited attribution data (e.g., a referral code), but not personal information about you from that source.

When you authorize Gmail access, Autopilot requests the following Google OAuth scopes:

• gmail.readonly : Permits read-only access to your inbox to search for and retrieve travel confirmation emails only
• userinfo.profile : Retrieves your Google profile (name and profile picture URL)
• userinfo.email and openid : Retrieves your email address for account authentication.

We do not request permission to compose, send, delete, or modify emails. We do not access contacts, calendars, Google Drive, or any Google service beyond the scopes listed above.

Upon authorization, Autopilot scans your inbox for emails from travel providers using domain and subject-line matching. Specifically:

• We identify emails matching qualifying travel confirmation patterns from recognized travel provider domains
• We parse the email to extract reservation data as described in Section 2 and add the reservation to your Autopilot account

We do not read, store, or process non-travel emails. We do not currently use inbox data to serve you third-party advertising. We do not sell the contents of your emails. Any other and further use shall be disclosed to you in advance and, where required by law, will require your consent.

You may revoke Autopilot's access to your Gmail account at any time by:

• Contacting us at support@withautopilot.com to request revocation (our team will process this promptly)
• Visiting your Google Account permissions page (myaccount.google.com/permissions) and removing Autopilot's access directly.

Upon revocation, we deactivate your Gmail OAuth token promptly. Previously stored email content and extracted reservation data are subject to our standard retention policy (Section 9).

Autopilot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for purposes beyond those described in this Notice.

Stripe may use automated fraud-detection algorithms in connection with payment processing on our behalf. Autopilot does not currently make fully automated decisions about users that produce legal or similarly significant effects. We will update this Notice if that changes.

We use third-party AI tools, including OpenAI and Anthropic APIs, to assist in operational tasks such as email parsing and reservation data extraction. We do not use your personal information to train foundational AI models without your separate consent.

We disclose personal information to the following service providers who process data on our behalf, subject to contractual data processing obligations:

In the ordinary course of providing the Services, such as when we contact an airline or hotel on your behalf to rebook or inquire about a reservation, we disclose the personal information necessary to facilitate that interaction. This typically includes confirmation number (PNR), full traveler names, dates of birth, and itinerary details.

We use the Meta (Facebook) Pixel on our website. The Meta Pixel sends behavioral data, including page visits, conversion events, and device identifiers, to Meta Platforms, Inc. Meta may use this data for cross-context behavioral advertising, meaning it may serve targeted ads to you on Meta's platforms (Facebook, Instagram) based on activity on our site.

You may opt out of this sharing at any time. See Section 16.

If Autopilot is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website prior to your personal information becoming subject to a materially different privacy policy.

We may disclose personal information if required by law, regulation, court order, or legal process, or in response to a lawful request from law enforcement or government authorities. We may also disclose personal information when we believe in good faith that disclosure is necessary to protect our rights or property, prevent fraud or illegal activity, or protect the personal safety of any person.

Autopilot does not sell your personal information to data brokers or other third parties for monetary consideration. For California residents' rights regarding 'sharing' for cross-context behavioral advertising, see Sections 14 and 16.

We and our third-party partners use cookies, web beacons, pixel tags, and similar tracking technologies. The following cookies are currently deployed:

In the preceding twelve (12) months, we have collected the following categories of personal information from California residents:

California residents have the right to:

• Know : Request disclosure of the categories and specific pieces of personal information collected about you, sources, business or commercial purposes, and categories of third parties with whom we share it.
• Delete : Request deletion of personal information, subject to certain exceptions (e.g., legal obligations, fraud prevention).
• Correct : Request correction of inaccurate personal information.
• Opt-Out of Sale / Sharing : Opt out of the sale or sharing of your personal information for cross-context behavioral advertising. See Section 16.
• Limit Use of Sensitive Personal Information : Request that we limit our use of SPI to purposes specified by CPRA.
• Non-Discrimination : We will not deny Services, charge different prices, or provide a different quality of service based solely on your exercise of CPRA rights.

Submit a CPRA request to support@withautopilot.com. We will verify your identity by matching information against your account records and respond within 45 days. If we need additional time (up to 90 days total), we will notify you within the initial 45-day period. You may submit a request to know up to twice in any 12-month period.

If we deny your rights request, you may appeal by responding to our denial notice with a written explanation. If your appeal is denied, you may contact the California Privacy Protection Agency (CPPA) at cppa.ca.gov.

California customers may request information once per year about categories of personal information (if any) we share with third parties for their independent direct marketing purposes. We do not share personal information with unaffiliated third parties for their independent direct marketing purposes without your consent.