SoloPilot Privacy & Data Protection Policy
Last updated: 12 October 2026
Website: https://solopilot.co.uk
Operated by: MJ Smith Holdings Ltd
1. Introduction
SoloPilot ("SoloPilot", "we", "us" or "our") is a business management platform operated by MJ Smith Holdings Ltd, a company registered in England and Wales.
We are committed to protecting personal information and processing it lawfully, fairly and transparently in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable UK data protection and privacy legislation.
This policy explains how we collect, use, store, share, protect and delete personal information when individuals visit our website, register for an account or use our services.
Our services include customer relationship management, bookings, invoicing, payment processing, business administration, and AI-powered assistance.
Who can use SoloPilot
SoloPilot is offered to users in the United Kingdom.
By registering for an account or using the platform, you confirm that:
- You are located in the United Kingdom.
- You are at least 18 years old.
- The information you provide to us about yourself is accurate.
If we become aware that an account has been registered or used by someone who does not meet these conditions, or that the information provided was inaccurate, we may suspend or terminate that account and any associated subscription.
Where an account is terminated on this basis, we will handle any personal information held in it in accordance with section 8 of this policy and applicable law.
Data protection contact
Legal entity: MJ Smith Holdings Ltd
Trading name: SoloPilot
Registered company number: 16119280
Registered office: Black Poplar Barn, Hollow Lane, Rugeley, England, WS15 3LQ
Privacy contact: matt@mjsmithholdings.co.uk
For questions about this policy or your personal information, please contact us using the details above.
2. Our Role in Processing Personal Data
SoloPilot may act as either a data controller or a data processor, depending on the nature of the personal information being processed.
2.1 When we are a data controller
MJ Smith Holdings Ltd acts as a data controller when determining how and why personal information is processed for purposes including:
- Creating and managing SoloPilot user accounts.
- Managing subscriptions, billing and payments.
- Providing customer support.
- Monitoring platform security and preventing fraud.
- Communicating service-related information.
- Improving the performance and reliability of our services.
- Complying with legal and regulatory obligations.
2.2 When we are a data processor
When a business uses SoloPilot to store and manage information about its own customers, employees, contacts or clients, that business will generally be the data controller and SoloPilot will act as its data processor.
This may include information stored within:
- Customer and contact records.
- Bookings and appointments.
- Invoices and payment records.
- Tasks and business notes.
- Uploaded documents.
- Communications and AI-assisted workflows.
In these circumstances, we process personal information on behalf of the business, in accordance with its documented instructions, our contractual obligations and applicable data protection legislation.
Business customers are responsible for establishing an appropriate lawful basis for collecting and processing the personal information they enter into SoloPilot, providing necessary privacy information and responding to requests from their own customers.
Our Data Processing Agreement governs processing activities undertaken on behalf of business customers, and lists the sub-processors involved.
3. Personal Information We Collect
Depending on how you use SoloPilot, we may collect the following categories of personal information.
3.1 Account and identity information
- Full name.
- Email address.
- Telephone number.
- Business name.
- Business address.
- Account identifiers.
- Login and authentication information.
- Account settings and preferences.
3.2 Business information
- Customer names and contact details.
- Customer addresses.
- Appointment and booking information.
- Business notes and tasks.
- Products and services.
- Invoices, quotations and transaction records.
- Business communications.
- Files and documents uploaded to the platform.
3.3 Payment and subscription information
- Subscription plan and billing status.
- Billing name and address.
- Payment and transaction identifiers.
- Invoice and payment history.
- Limited payment method information made available by our payment provider.
Payment card information is processed by our payment provider, Stripe. We do not intentionally store complete payment card numbers or card security codes within SoloPilot's application database.
3.4 Technical and usage information
- IP address.
- Browser and device information.
- Operating system.
- Login timestamps.
- Application activity.
- Error reports.
- Security and diagnostic logs.
- Cookie and session information.
3.5 Communications and AI interactions
Where you use our communication or AI-powered features, we may process:
- Messages sent to the SoloPilot assistant, in the application or over WhatsApp.
- Instructions submitted to AI-powered features.
- Relevant customer, booking or business information needed to fulfil an instruction.
- Responses generated by AI systems.
- Conversation history, which is retained so the assistant can follow a continuing conversation and so you can revisit past conversations.
- Technical information required to operate, secure and troubleshoot these services.
We ask users not to submit unnecessary sensitive personal information to AI features.
4. How We Use Personal Information
We process personal information only where we have an appropriate lawful basis. The purposes for which we process personal information, and the lawful basis for each, are:
- Creating and managing accounts — performance of a contract.
- Delivering subscribed services — performance of a contract.
- Processing subscription payments — performance of a contract.
- Maintaining financial records — legal obligation.
- Protecting accounts and preventing fraud — legitimate interests and, where applicable, legal obligation.
- Providing customer support — contractual necessity or legitimate interests.
- Monitoring reliability and fixing errors — legitimate interests.
- Sending essential service communications — performance of a contract or legitimate interests.
- Sending optional direct marketing — consent or another lawful basis where permitted by applicable marketing rules.
- Complying with legal requests — legal obligation.
Where we rely on legitimate interests, we assess the necessity of processing against the rights and interests of affected individuals.
Where we act as a processor, the business customer is generally responsible for identifying and communicating the lawful basis for its processing activities.
5. Hosting, Storage and Service Providers
We use selected third-party providers to deliver and maintain SoloPilot.
These include:
Supabase — database infrastructure, authentication, file storage and associated backend services. SoloPilot's database is hosted in Amazon Web Services' Europe (Ireland) region.
Vercel — application hosting, serverless execution and content delivery for the SoloPilot web application.
Stripe — subscription billing, payment processing and supported point-of-sale transactions.
Anthropic — the AI provider behind our AI-powered assistant features, including the WhatsApp assistant.
Resend — delivery of transactional email, such as account, booking and service notifications.
WhatsApp Business Platform and associated Meta services — messaging functionality where users choose to connect or communicate through supported WhatsApp integrations.
Google — calendar synchronisation, where a user chooses to connect a Google account.
We may also use providers for error monitoring, analytics and customer support.
These providers process information only to the extent necessary for their respective services and subject to applicable contractual and data protection requirements.
Where a provider acts as our processor, we seek appropriate data processing agreements and security assurances.
We do not sell personal information to data brokers or advertisers.
6. AI-Powered Features
SoloPilot provides AI-assisted functionality designed to help users manage business activities and perform administrative tasks.
When an AI feature is used, relevant information may be transmitted to our AI provider, Anthropic, to process the request and generate a response.
Depending on the requested action, this information may include customer details, appointment information, invoice details, business instructions or conversation content.
We aim to limit information shared with AI providers to what is reasonably necessary to perform the requested task.
AI-generated responses may be inaccurate or incomplete. Users remain responsible for reviewing important business information and decisions.
We do not authorise AI systems to make decisions producing legal or similarly significant effects about individuals solely through automated processing without appropriate safeguards and a lawful basis.
Certain actions requested through the assistant that change financial records require explicit confirmation from the user before they take effect.
We will disclose any change of AI provider, or any material change to AI-related data processing arrangements, in this policy or in our service documentation.
7. Data Security
We implement technical and organisational measures designed to protect personal information against unauthorised access, accidental loss, destruction, alteration and disclosure.
These measures are intended to include, where appropriate:
- Encrypted communications using HTTPS and TLS.
- Access controls and authenticated user sessions.
- Database-level authorisation rules that restrict each account to its own data.
- Restricted administrative access.
- Security monitoring and application logging.
- Database backup and recovery procedures.
- Controlled access to production infrastructure.
- Security updates and vulnerability management.
- Restricted access to payment-related information.
No online system can guarantee absolute security.
We regularly review our security practices and respond to identified vulnerabilities and incidents.
Users are responsible for protecting their login credentials and ensuring that individuals granted access to their business account are appropriately authorised.
8. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including satisfying legal, accounting, contractual and regulatory obligations.
Retention periods depend on the type of information and the reasons for processing it.
8.1 Active accounts
While an account remains active, we generally retain the information necessary to provide the services and maintain the account.
Users may update or remove certain information through the platform.
8.2 Account deletion and 30-day recovery period
When a user requests deletion of their SoloPilot account, the account is initially marked as deleted.
Access to the account is disabled, and the account enters a 30-day recovery period.
During this period:
- The account remains inactive.
- The user cannot use the account unless it is reactivated; signing in presents only the option to reactivate.
- Associated account and business data is retained securely for potential recovery.
- The user may reactivate the account within 30 days by signing in and confirming reactivation.
- Subscription renewal is cancelled as part of the account closure process.
After the 30-day recovery period expires, account information and associated business data are scheduled for permanent deletion from active production systems.
Once deletion has been completed, the account and its deleted data cannot be recovered through SoloPilot.
Certain information may be retained where required by law or where another valid legal basis applies, including necessary financial, tax, security or dispute-related records.
Residual copies in system backups may remain until the applicable backup retention period expires. Such copies are protected from routine use and are not used to reactivate deleted accounts.
8.3 Right to request earlier erasure
The 30-day recovery period is an account closure feature and does not remove an individual's statutory data protection rights.
Individuals may request earlier erasure of their personal information by contacting our privacy team.
Where a valid erasure request applies, we will assess and fulfil it without undue delay and within the applicable legal timeframe, subject to lawful exceptions.
Where we act as a processor for a business customer, we will handle deletion in accordance with the relevant controller's instructions and our Data Processing Agreement.
8.4 Financial and accounting records
Certain accounting and tax records may need to be retained for six years from the end of the relevant company financial year, or longer where legally required.
Such records are retained only to the extent necessary for compliance with applicable obligations.
The legal record-keeping obligations of a SoloPilot business customer do not automatically require SoloPilot to retain that customer's entire workspace after account deletion.
8.5 Other records
Security logs, diagnostic records, support communications and backup data are retained according to documented retention schedules based on operational necessity, security requirements and applicable law.
Where information is no longer required, it is deleted or irreversibly anonymised.
9. Your Data Protection Rights
Subject to applicable legal conditions and exemptions, individuals have rights under UK data protection law, including:
Right of access: Request access to personal information held about you.
Right to rectification: Request correction of inaccurate or incomplete information.
Right to erasure: Request deletion of personal information in applicable circumstances.
Right to restrict processing: Request that certain processing activities are restricted.
Right to data portability: Receive eligible personal information in a structured, commonly used and machine-readable format.
Right to object: Object to processing based on legitimate interests, including profiling, where applicable.
Right to withdraw consent: Withdraw consent where processing relies on consent, without affecting processing carried out lawfully before withdrawal.
Rights relating to automated decisions: Exercise applicable rights concerning solely automated decisions that produce legal or similarly significant effects.
You have the right to object to processing of your personal information for direct marketing purposes at any time.
Account holders can request a copy of the personal information we hold about them from within SoloPilot, under Settings, or by contacting us using the details in section 20.
We will respond without undue delay and generally within one calendar month, subject to lawful extensions where applicable.
Where a request concerns information controlled by a business using SoloPilot, we may direct the individual to that business or assist the business in responding.
10. International Data Transfers
SoloPilot's database is hosted within the European Economic Area, in Amazon Web Services' Europe (Ireland) region. Some of our other technology and service providers may process or access personal information outside the United Kingdom, including in the United States.
Where a transfer is subject to UK GDPR international transfer requirements, we will ensure an appropriate transfer mechanism is in place.
Depending on the destination and circumstances, this may include:
- UK adequacy regulations, including the adequacy decision covering the European Economic Area.
- Applicable UK-approved contractual safeguards.
- The UK International Data Transfer Agreement.
- The UK Addendum to approved standard contractual clauses.
- Other mechanisms permitted by applicable law.
We assess international transfer arrangements and seek appropriate protections for personal information.
Information about relevant transfer safeguards may be requested through our privacy contact.
11. Cookies and Similar Technologies
SoloPilot may use cookies and similar technologies to:
- Maintain authenticated sessions.
- Remember essential preferences.
- Protect accounts and prevent misuse.
- Measure service reliability.
- Understand website usage, where applicable.
Cookies that are strictly necessary for providing a service requested by a user may be used without consent where permitted by law.
Where consent is required for non-essential cookies or similar technologies, we will request it before activating those technologies. On your first visit we ask you to choose between accepting all cookies, accepting only those that are strictly necessary, or rejecting everything optional.
Users may manage applicable cookie preferences through the controls provided on our website or within their browser.
Further detail about each cookie we use, and how to change your choice, is set out in our Cookie Policy.
12. Marketing Communications
We may send essential communications concerning account activity, subscriptions, billing, security, maintenance and changes to our services.
These communications are necessary for operating SoloPilot and are not treated as optional marketing.
We may also send promotional communications where permitted by applicable law.
Where consent is required, we will obtain it before sending marketing communications.
Users can unsubscribe from marketing emails using the unsubscribe link or by contacting us.
Opting out of marketing does not prevent essential account and service communications.
13. Sharing and Disclosure
We may disclose personal information where reasonably necessary to:
- Provide services through authorised technology providers.
- Process payments and subscriptions.
- Respond to customer support requests.
- Comply with applicable laws and lawful regulatory requests.
- Investigate suspected fraud or security incidents.
- Establish, exercise or defend legal claims.
- Facilitate a lawful business reorganisation, acquisition or transfer, subject to appropriate protections.
We do not disclose personal information to unrelated third parties for their independent marketing purposes without an appropriate lawful basis.
14. Personal Data Breaches
We maintain procedures for identifying, assessing, investigating and responding to suspected personal data breaches.
Where legally required, we will notify the Information Commissioner's Office (ICO) and affected individuals within the applicable statutory timeframes.
Where we act as a processor, we will notify the relevant business customer without undue delay after becoming aware of a personal data breach affecting information processed on its behalf.
We will take reasonable steps to contain incidents, mitigate harm and reduce the likelihood of recurrence.
15. Children's Personal Information
SoloPilot is intended for business and professional use and is not designed for children to register independently.
As set out in section 1, users confirm on registration that they are at least 18 years old. We do not knowingly solicit personal information directly from children for account registration.
If we become aware that an account holder is under 18, we may terminate the account and will delete personal information collected from them unless we are required or permitted by law to retain it.
Business customers should ensure they have an appropriate lawful basis and safeguards before entering information relating to children into the platform.
16. Third-Party Services and Integrations
SoloPilot may offer integrations with external services, including messaging, payment, calendar and business software providers.
Where a user enables an integration, information may be exchanged with that provider as necessary to deliver the requested functionality.
Third-party providers may operate under their own privacy policies and terms.
Users should review those policies before enabling integrations.
We are not responsible for independent processing activities undertaken by third-party controllers outside our control.
17. Data Protection by Design
We aim to incorporate data protection principles into the design, development and operation of SoloPilot.
These principles include:
- Data minimisation.
- Purpose limitation.
- Appropriate access restrictions.
- Secure system design.
- Retention and deletion controls.
- Accountability and auditability.
- Privacy-aware feature development.
We review material changes to our processing activities and undertake data protection impact assessments where required by law.
18. Changes to This Policy
We may update this policy to reflect changes in legislation, regulatory guidance, our services or our processing practices.
The latest version will be available at https://solopilot.co.uk.
Where changes materially affect how personal information is processed, we will provide additional notice where legally required or appropriate.
The date at the top of this policy indicates when it was last updated.
19. Complaints
If you have concerns about how we handle personal information, please contact us first so that we can investigate.
You also have the right to complain to the UK Information Commissioner's Office.
Information Commissioner's Office (ICO)
Website: https://ico.org.uk
Telephone: 0303 123 1113
You may contact the ICO directly if you believe your personal information has been processed unlawfully.
20. Contact Us
For questions, requests or complaints relating to this policy or data protection:
MJ Smith Holdings Ltd
Trading as SoloPilot
Website: https://solopilot.co.uk
Email: matt@mjsmithholdings.co.uk
Registered office: Black Poplar Barn, Hollow Lane, Rugeley, England, WS15 3LQ
Company registration number: 16119280
© 2026 MJ Smith Holdings Ltd. All rights reserved.