Ops Pilot CRM · Privacy Policy · Terms of Service · Cookie Policy

Privacy Policy

Last updated: 14 October 2026

Ops Pilot CRM ("Ops Pilot", "we", "us") is a CRM, email marketing and outreach platform operated by Extra Web Solutions in the United Kingdom. This policy explains what personal data we collect when you use Ops Pilot, why we collect it, and the choices you have.

We process personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who is responsible for your data

For your account details and how you use the service, Extra Web Solutions is the data controller.

For the data you and your team add to Ops Pilot (for example contacts, leads, clients, invoices and email content), your organisation is the controller and we act as its processor, handling that data only to provide the service on its instructions.

2. Data we collect

• Account data: name, email address, company name, role and login credentials (passwords are stored hashed).
• Customer content: contacts, leads, companies, notes, tasks, projects, invoices, templates, campaigns and outreach emails that you create or import.
• Billing data: subscription plan and payment status. Card details are handled by Stripe and never stored on our servers.
• Technical data: IP address, browser type, log-in times and error logs, used for security and troubleshooting.
• Integration data: information from services you choose to connect, such as Gmail or WordPress (see section 4).

3. How we use your data

• To provide, maintain and secure the service and your account.
• To send emails you ask us to send, such as campaigns and one-to-one outreach.
• To process payments and manage subscriptions.
• To provide support and tell you about important changes to the service.
• To meet legal, tax and accounting obligations.

Our lawful bases are performance of our contract with you, our legitimate interests in running a secure and reliable service, and compliance with legal obligations. Where we rely on consent, you can withdraw it at any time.

4. Google user data (Gmail)

You can optionally connect your Gmail account so that outreach emails you write in Ops Pilot are sent from your own Gmail address and appear in your Gmail Sent folder.

• Access we request: your email address (to show which account is connected) and permission to send email on your behalf (the gmail.send scope). We do not request permission to read, search, modify or delete messages in your mailbox.
• How we use it: only to send an email when you click Send in Ops Pilot, to the recipient and with the content you have reviewed.
• What we store: an encrypted access token, your connected Gmail address, and for each email sent the recipient, subject, body and the Gmail message and thread IDs, so follow-ups reply in the same thread and the send appears on your timeline.
• Sharing: we do not sell Google user data, use it for advertising, or transfer it to third parties except as needed to provide this feature, to comply with the law, or as part of a merger or acquisition with your notice. No person at Ops Pilot reads this data unless you ask us to for support, it is needed for security, or the law requires it.
• AI: Google user data is not used to develop, improve or train generalised AI or machine-learning models.
• Your control: you can disconnect Gmail at any time in the Outreach tracker, which deletes the stored token and revokes our access. You can also remove access at myaccount.google.com/permissions.

Ops Pilot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Who we share data with

We use trusted service providers who process data on our behalf under contract:

• Cloud hosting and database providers, to run the application and store data.
• Stripe, for subscription payments.
• SendGrid and our email infrastructure, to deliver emails and verify addresses.
• Google, when you connect Gmail or other Google services.
• OpenAI and DeepSeek, for optional AI features such as content generation. Only the text needed for the feature you use is sent. Google user data is never sent to these providers.
• Cloudinary, to store images you upload.

We do not sell personal data. We may disclose data if required by law or to protect our rights and users.

6. International transfers

Some providers process data outside the UK. Where they do, we rely on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Addendum.

7. How long we keep data

We keep account and customer content for as long as your subscription is active. After you close your account we delete or anonymise it within 90 days, except where we must keep records (for example invoices) for legal or tax reasons. Gmail tokens are deleted as soon as you disconnect Gmail.

8. Security

We use encryption in transit (HTTPS), encryption of sensitive credentials such as integration tokens, hashed passwords, access controls and per-company data separation. No system is perfectly secure, but we work to protect your data and will notify you of any breach as required by law.

9. Your rights

You have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. To exercise these rights, email support@opspilotcrm.com. If your data is held by an organisation that uses Ops Pilot, please contact that organisation first.

You can also complain to the UK Information Commissioner's Office (ico.org.uk).

10. Changes to this policy

We may update this policy from time to time. We will post the new version here and, for significant changes, notify account owners by email.

11. Contact

Extra Web Solutions, operator of Ops Pilot CRM. Email: support@opspilotcrm.com

Questions? Email support@opspilotcrm.com.