Privacy Policy

The controller for the processing of personal data on this website and in the ProjectPilot service is:
Dipl.-Ing. Gabor Andras Varga, Im Oberen Weingarten 6, 88682 Salem, Germany
Email: info@projectpilot.eu

For data that customers store in their workspaces (for example project, partner and budget data), the respective customer is the controller and we act as their processor under Art. 28 GDPR. Data subjects should address requests about such data to the organisation that invited them; we will support that organisation.

a) Visiting the website. When you open our pages, our hosting provider automatically processes technical data such as IP address, date and time, browser and operating system, in order to deliver the website and keep it secure. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning website). These logs are deleted by the hosting provider after a short period.

b) User account. Name, email address, password (stored only in hashed form), optional phone number and country, role, organisation and workspace membership. If you sign in with Google, we receive your name, email address and Google account ID from Google. Purpose: providing your account and the Service. Legal basis: Art. 6(1)(b) GDPR.

c) Workspace content. Projects, organisations and contact persons, work packages, tasks, milestones, deliverables, budgets, cost claims and uploaded documents. Purpose: providing the Service to the customer. Legal basis: Art. 6(1)(b) GDPR towards the customer; for other persons, the customer's own legal basis (we act as processor).

d) Subscription and payment. Billing name and address, email, VAT ID, subscription status and invoice data. Card or bank details are entered directly with our payment provider Stripe and are not stored by us. Purpose: billing and fulfilling tax obligations. Legal basis: Art. 6(1)(b) and (c) GDPR.

e) Support requests. The content of your message and your contact details, to answer your request. Legal basis: Art. 6(1)(b) or (f) GDPR.

f) Emails from the Service. We send transactional emails such as invitations, password resets, billing notices and, if your workspace watches funding calls, deadline alerts to the workspace's chosen recipients. We do not send marketing newsletters without your separate consent.

g) AI-assisted features. When you use the Concept Builder or the Funding Radar, the information you enter (for example a project idea, target groups, partners and topics) is sent to AI model providers through our hosting provider in order to generate analyses, call matches and draft texts. Results are stored in your workspace. Please do not enter personal data of third parties or confidential information you are not allowed to share. Legal basis: Art. 6(1)(b) GDPR.

We only use technically necessary cookies and browser storage, for example to keep you signed in and to remember your session. These are required to provide the Service you requested (§ 25(2) TDDDG). We do not use advertising or third-party tracking cookies.

We use carefully selected service providers who process data on our behalf under data processing agreements:

• Base44 (a Wix.com Ltd. company) – hosting of the website and application, database, file storage and transactional email.
• Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland) – payment processing, invoicing and tax calculation. Stripe is also an independent controller for certain data under its own privacy policy.
• Google (Google Ireland Limited) – only if you choose "Continue with Google" to sign in.
• AI model providers engaged through Base44, currently Google (Gemini) and Anthropic (Claude) – processing of the inputs of AI-assisted features (Concept Builder, Funding Radar, AI Support) to generate results.

Data is also disclosed to tax advisers and authorities where required by law. We do not sell personal data.

Some service providers or their sub-processors are located outside the European Economic Area (for example in Israel or the United States). Transfers take place only where an adequacy decision of the European Commission exists (Israel; the EU–US Data Privacy Framework for certified US companies) or on the basis of the EU Standard Contractual Clauses (Art. 46 GDPR).

• Account and workspace data: for the duration of the contract. After termination, data can be exported for 30 days and is then deleted.
• Invoices and accounting records: 10 years, as required by German commercial and tax law (§ 147 AO, § 257 HGB).
• Support correspondence: up to 3 years after the request is closed, unless needed longer for legal claims.

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). Where processing is based on consent, you can withdraw it at any time with effect for the future.

To exercise your rights, write to info@projectpilot.eu.

You also have the right to lodge a complaint with a supervisory authority, for example the authority responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

Data is transmitted encrypted (TLS). Access within the Service is restricted by workspace, role and organisation, so partners only see the data shared with them. Uploaded documents are stored privately and are only accessible through time-limited links for authorised users.

Providing your email address and name is required to create an account. Billing details are required to start a paid subscription. Without them, we cannot provide the Service.

We may update this Privacy Policy when the Service or legal requirements change. The current version is always available on this page. See also our Terms of Service.