Privacy policy
This document describes what the code of this site actually does: what it collects, why, where it goes and how long it stays. Not what it would be pleasant to write.
Last updated : 15 August 2026 · Version 2.0
Who processes your data
ProofPilot SRL, Rue Gaston Dubois 26, 1428 Braine-l'Alleud, Belgium — company registration number 1010.243.518 — is the data controller within the meaning of Article 4(7) GDPR.
For any question or request concerning your data: privacy@proof-pilot.io.
ProofPilot has not appointed a Data Protection Officer. None of the three conditions in Article 37(1) GDPR is met: we are not a public body, our core activity does not consist of regular and systematic monitoring on a large scale, and we do not process sensitive data on a large scale. Your requests therefore reach the address above directly, with no intermediary.
The principle
Three rules. The sections that follow are there so you can check them.
- We collect nothing we do not need in order to answer your request or to run the site.
- We do not sell, rent or exchange any data. With anyone, in any circumstances.
- Statistics and advertising cookies are optional: accept or decline in the banner, then change your choice through the footer preferences.
What we process, in detail
Six processing operations. For each one: the data, the purpose, the lawful basis within the meaning of Article 6 GDPR, and the retention period.
Contact form and workshop request
- Data
- Name, email address, company, job title, telephone, the content of your message, browsing language, campaign parameters (utm_source, utm_medium, utm_campaign), IP address, user agent (browser and operating system), timestamp.
- Purpose
- To answer you, understand your need, and prepare the conversation and then the quote.
- Lawful basis
- Article 6(1)(b) GDPR — pre-contractual steps taken at your request — for the form data. Article 6(1)(f) — legitimate interest in preventing automated submissions and abuse — for the IP address and the user agent.
- Recipients
- The ProofPilot team, and our internal CRM (see the section “Who else sees your data”).
- Retention
- 3 years from the last exchange. IP address and user agent: 12 months.
Only the email address and your agreement are needed for us to be able to reply. Every other field is optional.
Newsletter
- Data
- Email address, language, campaign parameters, IP address, user agent, date and time of your consent.
- Purpose
- To send you, roughly once a month, a costed automation case with the before and the after.
- Lawful basis
- Your consent — Article 6(1)(a) GDPR, and Article XII.13 of the Code of Economic Law, which in Belgium requires prior, freely given and specific consent for any advertising by electronic mail.
- Recipients
- The ProofPilot team, and our internal CRM.
- Retention
- Until you withdraw your consent. We then keep only the record of the withdrawal, so as not to sign you up again by mistake.
The unsubscribe link appears in every mailing and works in one click, with no reason to give and at no cost.
Free resources and return-on-investment calculator
- Data
- Professional identity and email address. For the calculator: the values you enter (headcount, volumes, costs) and the calculated result.
- Purpose
- To give you access to the resource requested and to send you your result.
- Lawful basis
- Article 6(1)(b) GDPR — provision of the service you request. Sending marketing communications afterwards requires your separate consent.
- Recipients
- The ProofPilot team, and our internal CRM.
- Retention
- 3 years from the last exchange.
The values entered in the calculator can say something about your business. They are used solely to produce your result. They are not used to profile you, or to adjust a price.
Conversational assistant (“Pilot”)
- Data
- A random identifier assigned to your browser — it contains no information about you — plus the language, the path of the page from which you open the conversation, the full content of your messages and of the answers, the IP address, the user agent and the timestamp.
- Purpose
- To answer your questions from our public content, and to improve the quality of the answers.
- Lawful basis
- Your consent — Article 6(1)(a) GDPR. The assistant only starts once you have explicitly agreed: until you activate it, no data is transmitted.
- Recipients
- The content of the conversations is sent to Lovable's artificial intelligence gateway, which calls models from Google (Gemini) to write the answers and from OpenAI (text-embedding-3-small) for semantic search. Your IP address, your user agent and your browser identifier are not sent to them: they stay in our database.
- Retention
- 12 months from the last message in the conversation.
Do not enter confidential information, trade secrets, health data or personal data about third parties in this chat. For those subjects, write to us. No decision producing legal effects or significantly affecting you is taken on the basis of these exchanges (Article 22 GDPR).
Protection against abuse
- Data
- IP address and a counter of requests per minute.
- Purpose
- To stop a bot from flooding our forms or our assistant.
- Lawful basis
- Article 6(1)(f) GDPR — legitimate interest — and Article 32 GDPR, which requires us to secure the processing.
- Recipients
- No one outside ProofPilot. These counters are neither exported nor looked at individually.
- Retention
- 30 days, then automatic deletion.
Audience and usage measurement
- Data
- Plausible: pages, referral source, country, device and browser in aggregate. PostHog, after your consent: page views, clicks, form and chat steps, performance and technical errors, browser information and random visitor and session identifiers. Replays mask text and inputs; form contents and conversations are excluded from automatic capture. Google Analytics 4, after consent: pages, referral source and campaign parameters, browser information and contact, newsletter, booking-click and chat-opening events, without form or conversation contents. Meta Pixel, after consent: page visits, successful contact submissions and booking clicks to measure advertising. Meta receives the URL, referrer, click/cookie identifiers and browser and connection information; our integration sends no form fields or chat messages. Saved contact requests are also reported server-side through the Conversions API, using the same event identifier as the pixel to avoid duplicates.
- Purpose
- Understand journeys, measure enquiries and identify difficulties using the site.
- Lawful basis
- Plausible: legitimate interest in measuring the site's audience. PostHog: your consent, requested before activation and withdrawable through Analytics preferences. Google Analytics 4: the same analytics consent, withdrawable in the footer. Meta Pixel: consent to statistics and advertising, withdrawable through the footer preferences.
- Recipients
- Plausible Insights OÜ for aggregate statistics; PostHog Cloud, in the European Union region, for optional measurement and masked replays. Google for Google Analytics 4. Meta Platforms Ireland for advertising measurement.
- Retention
- Plausible: aggregate statistics. PostHog: replays retained for 30 days; retention of other events depends on project settings. Withdrawal stops new captures; contact us to request deletion of data already received. Google Analytics 4: according to the property retention settings. Meta: according to its own retention rules.
Plausible runs separately. PostHog loads only after your consent. Its identifiers connect events within a visit without sending your form text or messages. Administration pages and conversations accessed through private links are excluded. You can withdraw consent at any time through Analytics preferences. Google Analytics 4 is also blocked before acceptance, after withdrawal and on private pages.
What we do not do
- No sale, rental or commercial provision of your data.
- No advertising trackers activated without your consent.
- No profiling, and no automated decision-making within the meaning of Article 22 GDPR.
- No deliberate collection of sensitive data within the meaning of Article 9 GDPR — origin, opinions, health, sexual orientation, biometric data.
- This site is not aimed at minors and offers them no service.
Who else sees your data
We use processors within the meaning of Article 28 GDPR. Each one is bound by a contract that prohibits it from using your data for its own purposes.
We disclose your data to no other third party, except where required by law or on formal request from a competent authority. Where that happens, we tell you, unless the law prohibits us from doing so.
Transfers outside the European Union
Some of our processors are established in the United States. These transfers are covered by the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914) and, where the provider is certified under it, by the adequacy decision of 10 July 2023 on the EU–US Data Privacy Framework.
You can ask us for a copy of the safeguards applying to a specific processing operation by writing to privacy@proof-pilot.io.
The data from your forms, and the record held in our CRM, stay in the European Union.
How long
These periods are applied automatically, not by hand.
Security
Encryption of exchanges in transit (TLS), row-level access policies in the database, no direct writing to or reading from the database from the browser, interface keys kept in a secrets vault, mandatory authentication for internal accounts, rate limiting on every public entry point.
No measure makes a system impregnable. In the event of a data breach likely to result in a high risk to your rights and freedoms, we will inform you in accordance with Article 34 GDPR, and we will notify the Belgian Data Protection Authority within 72 hours in accordance with Article 33.
Your rights
The GDPR gives you the following rights over your data.
- Access — obtain confirmation that we process your data, and receive a copy of it (Article 15).
- Rectification — have inaccurate or incomplete data corrected (Article 16).
- Erasure — request the deletion of your data (Article 17).
- Restriction — request that a processing operation be frozen while a check is carried out (Article 18).
- Portability — receive your data in a structured, machine-readable format (Article 20).
- Objection — object to processing based on our legitimate interest (Article 21). For direct marketing, the objection is absolute and needs no reason.
- Withdrawal of consent — at any time, without calling into question the lawfulness of what was done before (Article 7(3)).
An email to privacy@proof-pilot.io is enough. We reply within the month (Article 12(3) GDPR) and free of charge (Article 12(5)).
We will ask you for proof of identity only if we have reasonable doubts about it (Article 12(6)) — not as an administrative reflex.
Complaints
If our answer does not satisfy you, you can lodge a complaint with the Belgian supervisory authority. You can also go to the authority of the Member State where you live, where you work, or where the infringement took place — or take the matter to court.
- Address
- Rue de la Presse 35, 1000 Brussels
- Telephone
- +32 (0)2 274 48 00
- contact@apd-gba.be
What is stored in your browser
The site uses local storage for its features. After you accept analytics, PostHog also uses cookies and browser storage for visitor and session identifiers. Declining this tracking does not block the site. Google Analytics 4 also uses cookies after acceptance.
You can delete all of it at any time from your browser settings. The site keeps working: it will simply ask you again for your language and for your agreement for the assistant.
Pilot chatbot
Pilot is an AI-powered conversational assistant. In line with article 50 of the EU AI Act, you are informed that you are not talking to a human. Sending your first message constitutes acceptance of this processing.
What is stored: the content of the messages, the language of the conversation, the page it starts from, your IP address and your user agent.
Why: to answer your question, keep the thread of the conversation, improve answer quality and prevent abuse (rate limiting).
How long: IP address and user agent 90 days, message content 12 months, then deletion.
Where: conversations are processed and stored in our internal CRM, hosted in the European Union. They are never resold, nor used to train a public model.
Do not enter confidential information or personal data about third parties. To request deletion of your conversations, write to info@proof-pilot.io.
Outbound links
Some pages link to third-party services — LinkedIn, our AI Radar diagnostic tool. As soon as you leave our site, it is the privacy policy of the destination site that applies. We send no data about you there beyond what the link itself contains.
Changes
We update this policy when our processing changes. The date shown at the top of the page is the date of an actual change: it is not generated automatically on every page view.
Any substantial change is flagged on this page for thirty days.
Write to us
ProofPilot SRL — Rue Gaston Dubois 26, 1428 Braine-l'Alleud, Belgium.