Privacy Policy
Last updated: 2 October 2026
1. Who we are
This policy explains how TOPFED WEB S.R.L., a company registered in the Republic of Moldova (IDNO 1026023125543, registered office: s. Pepeni, r-nul Sîngerei, MD-6234), which develops and operates GatPilot (“GatPilot”, “we”), collects and processes personal data when you visit gatpilot.com or gatpilot.md, use the GatPilot app or write to a GatPilot assistant. For any question about your data, write to info@gatpilot.com.
2. Who this policy covers
We distinguish two situations. (a) Business customers who create assistants in their GatPilot account, and the colleagues they invite to the dashboard: for their data, we are the controller. (b) People who write to a customer's assistants: the company's customers (Sales Assistant), employees added as team members (Team Assistant) and people who receive reports (Management Assistant). For those conversations, the customer company is the controller and we are its processor, processing the data only on its instructions.
3. What data we collect
Account data: name, email, company, team role. Billing data: company details, plan and payment history, without card data. Assistant knowledge: uploaded documents and the text of the public pages you point us to. Conversations: messages written to the assistants on any channel, the assistant's and colleagues' replies, time and channel. Team members: name and phone number or Telegram account, entered by the customer. Integrations (Custom plan): data read from the customer's systems, with read-only access. Keys and tokens: the customer's AI keys and channel tokens, stored encrypted. Technical data: IP address, browser, device, usage logs. Forms: data sent through the forms on the website.
4. What we do not collect
We do not store card data: payments are processed by Stripe on gatpilot.com, by maib on gatpilot.md and by Apple in the iOS app. We do not record audio or process phone calls. People who write to an assistant do not need to give us personal data to get an answer.
5. How we use data
To let the assistants answer from your account's documents and data; to show you conversations in the inbox and send the reports you ask for; to run your account, billing and support; to measure the cost and quality of answers; to secure and improve the service; to meet legal obligations.
6. We never train models on your data
Documents and conversations in your account are never used to train any model, neither ours nor our providers', and are never visible to other customers. The AI provider receives only the text needed for an answer, via API, under its API terms, which exclude training. On Pro and Custom, requests go out with your own AI key, and the contractual relationship with the provider you choose is directly yours.
7. Legal bases
We process data to perform our contract with you (Art. 6(1)(b) GDPR), on your consent where we ask for it, for example for marketing emails (Art. 6(1)(a)), for our legitimate interests in securing and improving the service (Art. 6(1)(f)) and to meet legal obligations (Art. 6(1)(c)). As a company established in Moldova, we also comply with Law No. 133/2011 on personal data protection.
8. Where the data is stored
Data is stored on servers in the European Union, in Germany. On the Custom plan, on request, it can be stored on your company's own server. The GatPilot team works from the Republic of Moldova and accesses data only to run the service and for the support you ask for; for data covered by the GDPR, this access is governed by the European Commission's Standard Contractual Clauses.
9. Informing the people who write to an assistant
The assistant introduces itself as the company's AI assistant and says when a colleague takes over. Our customers remain responsible for telling their customers and employees, where the law requires it, that the conversation may be handled by an AI assistant and that messages are kept.
10. Sub-processors
We never sell personal data. We share it only with providers that help us run the service and are bound by data protection terms: hosting, in Germany; AI model providers (OpenAI and DeepSeek for our model; on Pro and Custom, the provider you choose, under your own key); Google Firebase, for authentication; Brevo, for email; Cloudflare, for network and protection; Stripe, maib and Apple, for payments; the messaging platforms you connect (Telegram, WhatsApp, Viber). We disclose data to authorities only where the law requires it.
11. How long we keep data
Conversations: 30 days on Free, 365 days on Pro, no limit on Custom, then deleted. Documents: until you delete them. Account data: while the account is active; after the account is closed it is permanently deleted after 30 days. Backups are kept for 30 days. Billing data: as long as tax and accounting law requires.
12. Security
Traffic to the website, the dashboard and the API is encrypted (TLS). AI keys and channel tokens are stored encrypted and never shown again after saving. Dashboard access is role-based (owner, admin, agent), and every request is limited to your organisation's data.
13. Your rights
You can ask for access to your data, its correction or deletion, restriction of processing and portability, and you can object to processing or withdraw consent where consent is the basis. Write to info@gatpilot.com and we reply within the time the law sets. If you wrote to a company's assistant, contact that company first; we help it answer. You have the right to lodge a complaint with the data protection supervisory authority of your EU country, or with Moldova's National Center for Personal Data Protection.
14. Changes and contact
We may update this policy; the version in force is always the one on this page, with its last-updated date. Questions: info@gatpilot.com.