Privacy Policy

VastPilot is operated by KairoSystems. This page explains what data we hold, why, where it lives, and how to get it back or delete it. It is written to be read, not to protect us.

1. Two kinds of people

You — the business owner using VastPilot. We hold your account data.

Your clients — the people you book appointments for. We hold their details only because you entered them, and only to deliver the reminders you scheduled. Under GDPR terms, you are the controller of that data and we are a processor acting on your instructions.

2. What we collect

• Your account: email address, password (stored hashed, never in readable form), business name, industry, working hours, service list and prices, time zone.
• Appointments you create: client name, client email address, optional phone number, service, date, time, status and notes.
• Reminder records: which reminder was sent, to which address, and when.
• Billing: handled entirely by Polar. We never see or store your card number.

We do not use advertising trackers, analytics profiling or third-party marketing cookies.

3. Why we hold it

To run the Service: show your calendar, send the reminders you scheduled, show you what was sent, and manage your subscription. Nothing else. We do not sell data, and we do not email your clients anything other than the reminders you set up.

4. Who processes it

• Supabase — database and authentication. Your data is isolated at the database level so no other VastPilot business can read it.
• Resend — sends the reminder emails. Receives the recipient's address and the message content.
• Netlify / Cloudflare — serve the website and the panel.
• Polar — payments, acting as Merchant of Record.

These providers process data on our behalf under their own data protection agreements. We add no other third parties without updating this page.

5. Where it lives and how long

Data is stored on servers operated by the providers above. We keep your data while your account is active. If you delete your account, appointment and client data is deleted with it. Reminder delivery records may be kept up to 12 months for troubleshooting and abuse prevention, then removed.

6. Security

Access is protected by authentication and by row-level security rules in the database, so each business can read only its own rows. Traffic is encrypted in transit (HTTPS). Passwords are hashed. No system is perfectly secure; if a breach affects your data we will tell you promptly and plainly.

7. Your rights

You can ask us at any time to:

• send you a copy of your data,
• correct anything inaccurate,
• delete your account and everything in it,
• stop processing while a dispute is resolved.

Write to contactlabskairos@gmail.com. We answer within 30 days, usually much sooner. If one of your clients contacts us directly, we will refer them to you, since the data is yours.

8. Children

VastPilot is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16.

9. Changes

If we change how we handle data in a way that affects you, we update this page and email account holders before the change takes effect.

10. Contact

KairoSystems, Türkiye — contactlabskairos@gmail.com