Privacy Policy

Overview

InfraPilot ("we", "us", or "our") operates the infrapilot.sh website and license portal. This policy explains what data we collect, why we collect it, and how it is handled.

Important note for self-hosted users: InfraPilot is a self-hosted product. Your infrastructure data — containers, logs, metrics, configurations — stays entirely on your own servers and is never transmitted to us.

Data We Collect

When you create an account on infrapilot.sh, we collect:

• Account data: your name, email address, and optionally company name.
• Authentication data: hashed password (bcrypt — we never store plaintext passwords).
• License data: your license tier, key, and activation records (instance ID, hostname, version, IP address of activating server).
• Payment data: billing is handled by Stripe. We store only your Stripe subscription ID and tier — no card numbers are stored by us.
• Usage data: session tokens (stored as httpOnly cookies) and basic server logs.

How We Use Your Data

• To create and manage your account and license keys.
• To send transactional emails: email verification, welcome email, password reset, and billing receipts.
• To validate license activations from your self-hosted InfraPilot instance.
• To process payments and manage your subscription via Stripe.
• To respond to support inquiries sent to support@infrapilot.sh.

We do not sell your data. We do not send marketing emails without explicit opt-in.

Third-Party Services

• Stripe — payment processing. Subject to Stripe's Privacy Policy.
• Zoho Mail (SMTP) — transactional email delivery.

Data Retention

Account data is retained while your account is active. You may request deletion of your account and associated data at any time by emailing support@infrapilot.sh. License activation records may be retained for up to 90 days after deletion for fraud prevention.

Security

Passwords are hashed with bcrypt. Sessions use signed JWT tokens stored in httpOnly, Secure, SameSite cookies. All data in transit is encrypted via TLS. We do not log or store plaintext credentials.

Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or export your personal data. To exercise any of these rights, contact us at:

Changes to This Policy

We may update this policy as the product evolves. Material changes will be communicated by updating the date at the top of this page. Continued use of the service after changes constitutes acceptance.