Operator: **ULTRANE DEVELOPMENT LTD** (Companies House 15681442), trading as PortPilot. Contact [email protected]. Website: portpilot.app. Cloud API: api.portpilot.app. This page is a product-accurate draft, not counsel-signed legal advice. UK GDPR / GDPR compliance claims require solicitor review before you treat this page as final.
Summary
The agent stores machine state on the host. Cloud holds account data and, if you pair machines and hold the right entitlements, selected history, notifications, and metadata backups. Payments go through Stripe. Analytics load only if you opt in. We do not sell personal data and we do not ship product telemetry beyond optional analytics you accept.
Why we process data
We process account and service data to provide PortPilot Cloud features you request (contract). Security and abuse-prevention logs support running a safe service (candidate legitimate interests — counsel to confirm). Optional Google Analytics and Microsoft Clarity run only with your consent. Exact lawful bases are subject to legal review and may vary by jurisdiction.
Local data
On the machine, PortPilot stores identity, SQLite port history, pairing material, licence cache, and logs under %ProgramData%\\PortPilot (Windows) or /var/lib/portpilot (Linux). This data does not leave the host unless you pair and a Cloud feature syncs it. Uninstall keeps data unless you purge.
Account data
When you register we store email, password hash, optional name and organisation name, session cookies, and password-reset tokens. Sessions last 7 days. Support tickets you file are stored on your account. In Settings → Account you can download a JSON export of your cloud data and delete your account (password + typing DELETE). Deletion anonymizes your profile, revokes sessions and paired machines in Cloud, and removes cloud backups, notifications, and synced history. Licence and payment rows may remain in anonymized form for finance and fraud prevention (duration subject to counsel). Cancel any Stripe subscription in the Customer Portal. We cannot remotely wipe local SQLite on a host we cannot reach — uninstall or purge on each machine. You may also email [email protected] for a verified support-assisted request.
Machine metadata
Paired machines send hostname, OS, agent version, online state, and display metadata you set (name, environment, tags). Agents connect outbound over WebSocket. We do not accept inbound connections to your helper from browsers.
Cloud data
With a Cloud subscription, selected history can sync to Postgres, notifications can be stored and emailed, and you can create up to five account metadata backups (prefs, display names, notification prefs, bounded history summaries). Backups do not include credentials. Restore reapplies metadata only.
IP addresses and logs
The website, API, and optional waitlist/contact endpoints see IP addresses for rate limiting, abuse prevention, and operational logs. We do not sell this data.
Cookies, storage, Google Analytics, Microsoft Clarity
Essential: session cookie for signed-in Cloud, theme preference, analytics-consent flag in localStorage. Non-essential: Google Analytics 4 and Microsoft Clarity load only after you accept analytics, and only when this deployment has analytics enabled. We ask Clarity to mask sensitive fields (passwords, redeem/pairing inputs). We do not send passwords, licence keys, or pairing codes as analytics event parameters. This section is our cookie notice (no separate cookie policy page).
Analytics are not enabled in this environment, so no measurement cookies are loaded.
Payments (Stripe)
Checkout and the Customer Portal are provided by Stripe. PortPilot stores Stripe customer/subscription references and licence rows, not full card numbers. See Stripe’s own privacy policy for payment data.
Third-party processors we actually use
- Stripe — payments
- Email delivery provider configured on Cloud (transactional mail such as verify/reset)
- Google Analytics 4 — if you consent and it is enabled
- Microsoft Clarity — if you consent and it is enabled
- AppSumo — if you buy there; they send redemption events we fulfil
Hosting/Postgres for Cloud is operated as part of the PortPilot API deployment. We do not invent extra subprocessors here. Some providers may process data outside the UK/EEA; transfer safeguards are under legal review.
Support and contact forms
Public /support messages are stored (JSON log and optional webhook) with name, email, category, subject, message, and optional diagnostics you paste. Do not include secrets.
Retention
Account data lasts while the account exists. Local history default retention is 90 days on the agent. Cloud notifications are bounded (on the order of 200 per user / 30 days). Cloud backups: last 5. Licence rows remain for audit after revoke. Operational logs are kept only as long as needed for security and debugging. Operator database backups may retain copies until those backups rotate — ask support when requesting erasure.
Your rights
Depending on where you live you may have rights to access, correct, delete, or export personal data, and to object to optional analytics. Use Settings → Account for self-serve export and deletion, or email [email protected] for a data subject request. We may need to verify the account for email-only requests. Where UK GDPR applies, we aim to respond within one month of a verified request (extensions may apply in complex cases — counsel to confirm). We cannot remotely wipe local SQLite on a machine we cannot reach — uninstall/purge on the host. Operator database dumps may still contain prior copies until rotated — ask support when requesting erasure so dumps can be located.
Children
PortPilot is not directed at children under 16.
Related: Terms · Legal index