SoloPilot Data Processing Agreement

Last updated: 12 October 2026

Website: https://solopilot.co.uk

Processor: MJ Smith Holdings Ltd (company number 16119280), trading as SoloPilot

1. Scope and acceptance

This Data Processing Agreement ("DPA") applies where you use SoloPilot to process personal data about other people — your customers, clients, contacts or staff.

In that processing you are the controller and MJ Smith Holdings Ltd is your processor, as those terms are used in the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This DPA forms part of, and is subject to, our Terms of Service. By creating a SoloPilot account and entering personal data about other people, you accept this DPA. Where it conflicts with the Terms of Service on the subject of data protection, this DPA prevails.

This DPA does not apply to personal data for which we are the controller — your own account, billing and usage information. That processing is described in our Privacy Policy.

2. Subject matter and duration

The subject matter of the processing is the provision of the SoloPilot platform: customer records, projects, tasks, time and expense records, invoicing, bookings, calendar synchronisation and AI-assisted administration.

Processing continues for as long as your account is active, and then for the retention periods described in section 10.

3. Your obligations as controller

You remain responsible for:

Establishing and recording a lawful basis for the personal data you enter into SoloPilot.
Providing the people concerned with the privacy information they are entitled to.
Ensuring you are permitted to disclose that personal data to us.
The accuracy and relevance of the personal data you enter.
Responding to requests from the people whose data you hold, with our assistance as set out in section 8.
Not entering special category data, criminal offence data or children's data unless you have an appropriate lawful basis and safeguards.

You should not enter personal data into SoloPilot that is not needed for the purpose you are using it for.

4. Our obligations as processor

We will:

Process personal data only to provide the services, and only on your instructions. Your use of the platform's features constitutes your instructions; you may give further instructions by contacting us.
Not process the personal data for our own purposes, and not sell it or use it for advertising.
Not use your customers' personal data to train AI models, and only transmit it to an AI provider where you use an AI feature, as described in section 7.
Tell you if, in our opinion, an instruction appears to breach data protection law.
Ensure that people we authorise to access personal data are bound by confidentiality obligations and have access only where needed.
Implement and maintain the security measures described in Annex B.
Assist you as set out in sections 8 and 9.

5. Sub-processors

You give us general authorisation to engage the sub-processors listed in Annex C.

Where we engage a sub-processor we impose data protection obligations no less protective than those in this DPA, and we remain responsible for their performance.

We will give you notice before adding or replacing a sub-processor, by updating Annex C and, where the change is material, by notifying you by email. If you reasonably object to a new sub-processor on data protection grounds, you may tell us; if we cannot offer a reasonable alternative, you may close your account and stop using the affected feature.

6. International transfers

SoloPilot's primary database is hosted in the European Economic Area, in Amazon Web Services' Europe (Ireland) region.

Some sub-processors in Annex C process personal data outside the United Kingdom, including in the United States.

Where a restricted transfer takes place, we rely on an appropriate transfer mechanism, which may include UK adequacy regulations (including those covering the EEA), the UK International Data Transfer Agreement, or the UK Addendum to the European Commission's standard contractual clauses, together with any transfer risk assessment required.

7. AI-assisted features

Where you use an AI feature — including the in-app assistant and the WhatsApp assistant — the content of your instruction and the records needed to carry it out are transmitted to our AI sub-processor to generate a response.

Depending on what you ask, this may include customer names and contact details, booking details, invoice details and conversation content.

We limit what is sent to what is reasonably necessary for the request. We do not authorise our AI sub-processor to use your data to train its models.

You control whether these features are used. If you do not want customer personal data sent to an AI provider, do not use the AI features.

8. Assisting with data subject rights

If someone whose personal data you hold in SoloPilot contacts us directly, we will not respond on your behalf beyond telling them to contact you, unless you instruct us otherwise.

We will give you reasonable assistance in responding to requests to access, correct, delete, restrict, port or object to processing, taking into account the tools available in the platform. Most such requests can be answered using your own access to the records concerned.

9. Personal data breaches and assistance

We will notify you without undue delay after becoming aware of a personal data breach affecting personal data we process for you, and provide the information reasonably available to us so that you can meet your own notification obligations.

We will provide reasonable assistance with data protection impact assessments and prior consultation with the Information Commissioner's Office where these arise from your use of SoloPilot.

We will make available the information reasonably necessary to demonstrate our compliance with this DPA, and will contribute to audits on reasonable notice, no more than once in any twelve-month period unless required by a supervisory authority, and subject to confidentiality.

10. Return and deletion

You can export the records you hold in SoloPilot at any time while your account is active.

When you close your account it is marked as deleted and enters a 30-day recovery period, during which the data is retained so the account can be reactivated. After that period, account and business data are permanently deleted from active production systems.

Residual copies may persist in backups until the applicable backup retention period expires. Those copies are protected from routine use and are not used to restore a deleted account.

We may retain personal data where required by law, in which case we continue to protect it and process it only for that purpose.

If you need deletion on a different timescale, contact us and we will handle it in accordance with your instructions and applicable law.

11. Liability and changes

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service.

We may update this DPA where necessary to reflect changes in law, guidance, our services or our sub-processors. Where a change materially reduces your protections we will give reasonable notice. The date at the top shows when it was last updated.

Annex A — Details of processing

Nature and purpose: Hosting and processing business records on the controller's behalf to provide customer management, project and task tracking, time and expense recording, invoicing, payment collection, bookings, calendar synchronisation, messaging and AI-assisted administration.

Duration: For the term of the account, plus the retention periods in section 10.

Categories of data subject: The controller's customers and prospective customers; the controller's contacts; people booking appointments; and any other individuals whose details the controller enters.

Types of personal data: Names; business names; email addresses; telephone numbers; postal and billing addresses; appointment and booking details; invoice, quotation and payment records; notes and tasks recorded against a customer; message and AI conversation content; files uploaded by the controller.

Special category data: Not required by the services and not requested. The controller should not enter it without an appropriate lawful basis and safeguards.

Annex B — Security measures

We maintain measures appropriate to the risk, including:

Encryption of data in transit using HTTPS and TLS.
Encryption of data at rest by our hosting and database providers.
Row-level authorisation in the database so that each account can reach only its own records.
Authenticated sessions, with password and passwordless sign-in options and emailed one-time codes.
Confirmation steps before the AI assistant changes financial records.
Restricted administrative access to production systems, limited to those who need it.
Application and security logging.
Automated database backups with point-in-time recovery provided by our database platform.
Dependency and vulnerability monitoring, with security updates applied to the application.
Payment card data handled by our payment provider and not stored in our application database.
Deletion controls, including the account closure and purge process described in section 10.

No service can guarantee absolute security. We review these measures and update them as the service changes.

Annex C — Sub-processors

Supabase — database, authentication and file storage. Data hosted in the EEA (AWS Europe, Ireland).

Vercel — application hosting, serverless execution and content delivery. Processing may occur outside the UK, including in the United States.

Stripe — subscription billing, payment processing and point-of-sale transactions. Processing may occur outside the UK.

Anthropic — AI processing for AI-assisted features, including the WhatsApp assistant. Processing may occur outside the UK, including in the United States.

Resend — transactional email delivery. Processing may occur outside the UK.

Meta Platforms (WhatsApp Business Platform) — messaging, where the controller connects WhatsApp. Processing may occur outside the UK.

Google — calendar synchronisation, where the controller connects a Google account. Processing may occur outside the UK.

Contact

MJ Smith Holdings Ltd

Trading as SoloPilot

Email: matt@mjsmithholdings.co.uk

Registered office: Black Poplar Barn, Hollow Lane, Rugeley, England, WS15 3LQ

Company registration number: 16119280