# Privacy Policy What DunPilot collects, what leaves for an AI draft, who processes it, and how to delete all of it. Last updated: 2026-09-04 Source: https://getdunpilot.com/privacy --- DunPilot holds unpaid invoices and the people who owe them, which is about as personal as business data gets. This page says exactly what we keep, what we send elsewhere, and how to get rid of it. ## Who we are DunPilot is software for chasing overdue invoices, operated by the person who built it. Questions, requests and complaints all go to hello@getdunpilot.com, and a person reads them. ## What we collect Four things, and nothing else: - Your account. Your name and email, and a hashed password. If you sign in with Google we receive your Google account id, email address, name and profile picture, and nothing more: we never see your Google password and we cannot read your Gmail, Drive or contacts. - The invoices and clients you bring. Client names, email addresses, invoice numbers, amounts, dates, payment history and any notes you add, however they arrive: pasted from a spreadsheet, uploaded as a CSV or a PDF, forwarded by email, or pulled from a read-only Stripe connection. - What you create here. Reminder drafts, your tone and writing rules, business and tax settings, and a log of what was sent and when. - An email address from the free reminder generator, if you ask us to email you the reminders it wrote. That is the only thing that tool stores. ## How we count visits We count page views and clicks, and which link or campaign a visit arrived from, so we can tell which pages are worth writing and which buttons nobody finds. By default this happens without a cookie: nothing is stored in your browser, no profile is built for you, and one visit is not joined to the next. The bar at the bottom of the page asks about one thing, and it is not whether we may count you. We count you either way. It asks whether we may also see which country you are reading from and recognise you when you come back, and those two need a cookie. Accept and we set one. Refuse, or ignore the bar entirely, and nothing is stored. A recorded click says which control was pressed, never the words on it. That distinction is the reason the app is safe to measure at all: it means a client name or an invoice amount is never part of a measurement. ## What we do not collect There is no advertising pixel, no session recorder and no third-party cookie on this site. Nobody is followed off this site, and nothing about you is sold, shared or handed to an ad network. We set at most two cookies. One keeps you signed in. The other exists only if you pressed Accept on the bar described above, and it does nothing but tell the two visits apart. That is the whole list. A Stripe connection is read-only. We can list your invoices and payments; we cannot move money, issue refunds, or change anything in your Stripe account. ## What leaves for an AI draft Writing a reminder means sending the facts of that reminder to our AI provider: the client name, the invoice amounts and dates, how that client has paid before, and the tone rules you set. It goes over an encrypted connection, it is used to return that one draft, and we do not permit it to be used for training models. Nothing is sent for a draft you did not ask for, and no draft is emailed to anyone until you have read it and pressed send. That is a product decision as much as a privacy one: DunPilot never writes to your clients on its own. ## Who else processes it We use a small number of providers, each for one job, and each receives only what that job needs: - Cloudflare, for serving this site. - PostHog, hosted in the EU, for the page and click counts described above. It receives no name and no email address. Unless you accepted the cookie, it receives no identifier that survives your visit either. - A managed PostgreSQL host, for the database. - Resend, for the email we send you (weekly briefs, digests) and for reminders you send from here. - An AI provider, for drafting, as described above. - Polar, our merchant of record, if you subscribe. It runs the checkout, takes the payment and holds the billing details, so we never see your card. - Stripe, if you connect it, read-only. - Google, if you choose to sign in with it. - Slack, for our own operational alerts. It is told when an account is created, so we can say hello, and nothing else about you. ## We do not sell your data Not to advertisers, not to data brokers, not to anyone. We do not share your client list with other users, and we do not use one account to inform another. The only reason we would hand data to anyone else is a valid legal order, and we would tell you unless the law forbids it. ## Deleting it Every level of this is in your hands and takes effect immediately. - A single invoice or client: delete it from its page. - Everything you have imported, with the account kept: Settings, then Data. - The account itself: Settings, then Account. Deleting the account wipes every row that belongs to you, not just the login. ## How long we keep it For as long as you have an account, because an aging report is a history and it stops being useful the moment it is trimmed. After deletion the rows are gone from the live database. Encrypted backups roll over on their own schedule and are not readable by us in the ordinary course. ## Your rights Depending on where you live you may have the right to see what we hold, correct it, export it, delete it, or object to how we use it. Email hello@getdunpilot.com and we will do it. We will not make you fill in a form or ask why. ## Security Traffic runs over HTTPS. Passwords are hashed, never stored in a form we could read. Every database query is scoped to the account that made it, which is what keeps one user from ever seeing another user through a URL. No system is perfect, and if we ever have a breach affecting your data we will tell you what happened and when. ## Changes If this page changes, the date at the top changes with it. If a change materially affects what we do with your data, we will email you before it takes effect rather than quietly editing the page.