1. Who is responsible
QUESTPIE s. r. o., Brezany 145, 010 04 Brezany, Slovak Republic, company ID (IČO) 54 027 292, tax ID (DIČ) 2121549793, registered in the Commercial Register of the District Court Žilina, section Sro, insert 77909/L. The company is not registered for VAT.
Contact for anything in this policy: privacy@questpie.com. We have not appointed a data protection officer.
2. Two roles: controller and processor
We handle personal data in two different roles.
We are the controller for data we use for our own purposes: website visits, accounts, sign-in and security, service email, billing, and messages you send us. This policy is our notice to you about that data.
We are a processor for the content a company puts into its Autopilot workspace: messages, Tasks, files, Knowledge, code and the results of Agent work. That content can contain personal data about the company's staff, customers or anyone else. The company that owns the workspace decides what goes in and why; it is the controller, and we process that data on its instructions under section 13 of our Terms of Service. If your data is in a company's workspace and you want to see, correct or delete it, ask that company first. We help the company answer you.
3. Visitors to questpie.com
What we collect. The website loads a small script from Umami, an analytics tool that we run ourselves on our own servers. For each page view it records the page address including its query string, the page title, the referring page, the browser, operating system and device type, the language and screen size, and the country, region and city worked out from the IP address. If a link that brought you here carries campaign or advertising click identifiers, they are part of the query string and are recorded with it.
The IP address itself is not stored. It is used in memory for two things: to work out the country, region and city, and to calculate a visitor identifier from the IP address, the browser and a secret value that changes every month. That identifier links the pages one visitor views within a calendar month. It changes every month and cannot be turned back into the IP address.
The script sets no cookies and stores nothing on your device, and it does not follow you across other websites.
Our web servers also write technical logs, which can include your IP address and the page requested.
The website does not use advertising cookies or pixels, and it loads no fonts, scripts or media from other companies.
Why and on what basis. To see which pages are read and to keep the site working and secure. The legal basis is our legitimate interest in doing that with a tool that stores no name, email address, cookie or IP address (Article 6(1)(f) GDPR). You can object (section 16).
If you write to us. Email sent to our addresses at questpie.com is received in our Google Workspace mailbox. We use it to answer you, on the basis of our legitimate interest in handling enquiries, or to take steps towards a contract if that is what you ask for.
4. Account holders
Account data. Your name, email address, whether the address is verified, a hash of your password, your profile picture if you add one, and your interface language. When you sign up we also record that you confirmed you use Autopilot for your business or profession and accepted the Terms and this policy, and when.
Sign-in and security data. Sign-in sessions with the IP address and browser they came from, password reset and email verification records, and invitations sent to your address. If you connect an outside client to Autopilot over MCP, we store the authorisation you gave it.
Membership data. Which companies you belong to, your name and picture in each company, your roles and permissions, and the Spaces and Channels you take part in.
Records of what was done. Autopilot keeps a history of actions: who created, changed or approved what, and when. Part of this history is visible to your colleagues as activity; part is an audit record kept for security.
Service email. We send email that the service needs: address verification, password reset and password change notices, invitations, notices about your plan, changes to the terms and the deletion of data, and notifications about mentions, an Agent waiting for you, a failed Run or a problem with an AI connection.
Why and on what basis.
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and running your account | Account and sign-in data | Performing our contract with you, where you are the customer yourself; otherwise our legitimate interest in providing the service to the company you work with |
| Showing you as a member of a company | Membership data | Legitimate interest in providing the service to that company |
| Keeping the service secure and investigating misuse | Sign-in and security data, audit records, technical logs | Legitimate interest in security |
| Proving that the Terms were accepted | The sign-up confirmation and its time | Legitimate interest in being able to prove the contract |
| Sending service email | Email address, the content of the notification | Performing the contract or legitimate interest, as in the first row |
| Billing, once paid plans start | See section 9 | Performing the contract; legal obligations on accounting and tax |
Where we rely on legitimate interest, you can object (section 16).
We do not use account data for advertising and we do not make decisions about you by automated means that have legal or similarly significant effects.
5. Content in a company workspace
A company's workspace holds what its people and Agents put there: the company profile, members, Spaces, Channels and conversations, messages and attachments, Tasks, Projects and links to code repositories, Library files, Knowledge and its revisions, Skills, Mini-apps, Automations, and the records of Agent work (the request, the context given to the Agent, events during the Run, and the result).
We process this content only to provide the service to that company: to store and show it, to search it, to run Agents on it when asked, and to keep it secure. We do not use it for our own purposes, we do not use it to train AI models, and we do not sell it.
Special categories of data. Companies may not put special categories of personal data into Autopilot, for example health data, or data about criminal convictions, unless we have agreed to it in writing. Autopilot is not built for such data.
Secrets, such as tokens for connected services, have their own feature. Secrets stored on our servers are encrypted with AES-256-GCM. The rest of the content is not end-to-end encrypted: our systems can read it, because they have to in order to search it and hand it to Agents.
6. AI processing
Autopilot uses AI in three ways. They send different data to different places.
Search and naming, for every company. This runs on our side whether or not anyone starts an Agent. Every request goes through the Vercel AI Gateway, which passes it to the provider named here:
- Search indexes (embeddings): Google. Text passages from the Library, Tasks and messages, and images from the Library, are turned into search indexes by Google's embedding model, served by Google's Gemini API.
- Ordering search results (ranking): TypeSafe AI, Inc., served by DigitalOcean. When you search, your query and up to 16 candidate passages, each cut to 1,000 characters, are sent to the ranking model "Jev". The model is published by TypeSafe AI, Inc. and runs on DigitalOcean, which is the company that receives the request.
- Naming and choosing an Agent: OpenAI models. Short pieces of text are sent to a small OpenAI model to name a conversation, a Run or an untitled Task, and to pick which Agent answers in a Channel. OpenAI's models may be served by OpenAI, by Microsoft (Azure) or by Amazon Web Services (Bedrock). If that model is unavailable, a small Google model is used instead, served by Google's Gemini API or Google Cloud Vertex AI.
Managed AI and managed compute, if your company has them. When an Agent runs on a Work Machine that we provide, its prompts, the context it is given (for example the Task, the conversation and the files it is allowed to read) and its output pass through our model proxy to the Vercel AI Gateway and on to the model provider. The default model is an OpenAI model, which may be served by OpenAI, Microsoft (Azure) or Amazon Web Services (Bedrock). A company can choose a Claude model for an Agent instead. Claude models are made by Anthropic and are served to us only by Amazon Web Services, through Amazon Bedrock. Requests for a Claude model are not sent to any other provider. The Work Machine itself is a Vercel Sandbox in the European Union: it holds the working copy of the repository and Library files the Agent is working on, and the state of the session.
Your own AI on your own computer. When you connect your own computer as a Work Machine and sign in to your own AI plan on it, Autopilot sends the Agent's request and the context it is allowed to see to your computer. From there, prompts and content go to the AI provider you chose, under your agreement with that provider. We do not receive or store your sign-in to that provider. The working copies, session files and logs on that computer stay there until you delete them; disconnecting the computer from Autopilot does not erase its disk.
What providers keep. Vercel states that its gateway keeps no prompts or outputs: they are deleted when a request is completed. Every request we send through the gateway carries the setting that routes it only to providers that do not train models on it. This is not the same as zero data retention. Zero-retention routing is not available for the embedding and ranking models, so we do not claim it. A provider may keep requests for a time under its own terms, for example to detect abuse, and that can happen outside the region where the request was processed.
Where AI requests are processed. The gateway can process a request in any Vercel region, and the model provider can process it in any of its regions, including outside the European Economic Area. We do not promise that AI requests stay in the European Union.
People and AI. In Autopilot an Agent is always marked as an Agent: its messages and results are shown under the Agent's name and linked to the Run that produced them. AI output can be wrong; companies review it before they rely on it.
7. Services a company connects
A company can connect outside services to its workspace, for example GitHub for code, or a tool reached over MCP. Autopilot then exchanges with that service the data needed for the operations the company allows: for GitHub, repository and branch names, commits and pull request details; for an MCP tool, the arguments sent to it and its answers. These services are chosen by the company and act under the company's own agreement with them. They are not our subprocessors. The same is true of the AI provider a company uses on its own computer.
8. Who receives personal data
We share personal data only with the providers that help us run the service. The full list, with the legal entity, what each receives, where it runs and the transfer safeguard, is on the Subprocessors page. In summary:
| Provider | What it does for us | What it receives |
|---|---|---|
| Hetzner | Servers for the application, the database, analytics, email software and logs | All account data and company content, in the database and in transit |
| Cloudflare | File storage (R2) for Library files and for database backups; DNS; reports about email authentication | Library files and attachments; backup copies of the database; reports listing the servers that send email in our name, without message content |
| Vercel | AI Gateway for model requests; Sandbox for Work Machines we run | Text passages, images, queries and prompts as described in section 6; for managed Work Machines, the files an Agent works on |
| Model providers reached through Vercel: Google, DigitalOcean (serving the model of TypeSafe AI, Inc.), OpenAI, Microsoft (Azure), Amazon Web Services (Bedrock, also serving the Claude models of Anthropic, PBC) | Running the AI models | The same model requests, as section 6 sets out for each |
| Amazon Web Services (Amazon SES) | Delivering service email | Recipient address and the content of the email |
| Google (Google Workspace) | Our own mailbox | Email you send to us |
| Stripe and its company Sold through Link, LLC, from the start of paid plans | Taking payment for subscriptions and credit as merchant of record | See section 9 |
We run two tools ourselves on the Hetzner servers rather than buying them as a service: Umami for website analytics and Plunk for composing and sending email. Their data stays on our servers, apart from the email itself, which Plunk hands to Amazon SES for delivery.
We may also disclose personal data when the law requires it, or to a company that takes over the Autopilot business, under the same protections.
We do not sell personal data and do not share it for advertising.
9. Billing
Admitted accounts can test the workspace free during the closed beta until commercial launch with their own AI and computer, without a payment card. Managed AI and compute require a separate payment or an approved funded grant.
From launch, paid plans and credit are sold through Stripe Managed Payments. The merchant of record is Sold through Link, LLC, a Stripe company. You give your payment details, billing address and tax number to the payment partner at checkout, and it handles them under its own terms and privacy policy. It sends you the receipt, the invoice and renewal reminders itself. QUESTPIE remains the seller and the provider of the service. Autopilot is designed not to store billing details. We receive from the payment partner what we need to run your subscription: which company has which plan or credit, whether it is paid, and when it renews.
10. Where data is processed and international transfers
In the European Union.
- The application, its database, logs and the tools we run ourselves are on servers in Falkenstein, Germany.
- Library files, attachments and database backups are stored in Cloudflare R2. We are moving them to buckets under Cloudflare's EU jurisdiction, which keeps the objects in the European Union. Until that move is complete, Cloudflare chooses where it stores them, which may be outside the European Union.
- Service email is sent from the Amazon SES region in Frankfurt, Germany.
- Work Machines that we run are Vercel Sandboxes in an EU region.
Outside the European Economic Area, or possibly so.
- AI requests (section 6): the Vercel AI Gateway and the model providers behind it can process a request in any of their regions.
- Our mailbox: Google can process mail in any country where it has facilities.
- Payment, from launch: the payment partner handles payment data under its own privacy policy, which says where it processes it.
- Cloudflare and Vercel are United States companies and Amazon Web Services belongs to a United States group. Data they store for us in the European Union can still be accessed from outside the EEA, for example for support. The safeguards on the Subprocessors page cover that access.
A transfer outside the EEA needs a safeguard under GDPR: an adequacy decision, such as the EU-US Data Privacy Framework for companies certified under it, or the European Commission's standard contractual clauses. The Subprocessors page states, for each provider, where it processes data and which safeguard applies. You can ask us for a copy of the safeguard that applies to a provider.
We do not promise that all data stays in the European Union.
11. How long we keep data
| Data | How long |
|---|---|
| Account data | While your account exists. There is no self-service account deletion yet; we delete an account on request (section 12). |
| Sign-in sessions | Until they expire or you sign out. Password reset links expire after one hour. |
| Company content | While the company's workspace exists. After a subscription is cancelled or ends: 90 days, readable and exportable, then deleted, with an email 14 days before deletion. |
| Content of a company that does not choose a plan when the beta or its trial ends | Treated like a cancellation: 90 days readable and exportable, an email 14 days before deletion, then deleted. |
| Content of an inactive company | After 12 months without a sign-in the same process starts: 90 days readable and exportable, an email 14 days before deletion, then deleted. |
| Items in the trash, archived items, removed messages | Kept while the company's workspace exists. See section 12. |
| Short-lived technical records of Work Machine traffic | Removed after 24 hours. |
| In-app notifications | Archived after 30 days. Archiving hides them; it does not delete them. |
| Database backups | A daily backup and a continuous log are kept for 7 days and then overwritten. |
| Server logs | 30 days. |
| Website analytics | 25 months. They contain no names, email addresses or stored IP addresses. |
| Records of email we sent (recipient, subject, and whether it was delivered, bounced or reported as spam) | We are introducing deletion after 90 days. Until it is in place, these records are kept. |
| Email you sent us | As long as needed to deal with your enquiry and any follow-up. |
| Billing records, once paid plans start | Held by the payment partner as merchant of record. We keep what accounting and tax law requires us to keep, for the period it sets. |
12. What deleting does today
We want to be exact about this, because the words in the product can suggest more than they do.
- Trash in the Library is a soft delete. The item is hidden and can be restored. Hiding a folder hides what is in it. Nothing in the product permanently removes the item, its earlier revisions or its file from storage.
- Archiving a Task or a company changes its status. The data stays.
- Removing a message leaves a marker in the conversation in its place. The text is not wiped from the database.
- Deactivating or removing a member ends their access. Their past messages, Tasks and history stay, attributed to them.
- Agent work keeps a copy of the request and context it started from. Deleting the original message later does not remove that copy or the results.
- Search indexes are updated when content is removed, but this is not a guarantee that every derived copy is gone at that moment.
- Download links to files are time-limited. A link that was already issued keeps working until it expires, even if access was removed in the meantime.
- Work Machines you run keep their own copies on their own disk.
- Backups keep deleted data for up to 7 days.
So today none of these actions is erasure in the sense of data protection law. Permanent deletion of an account, of a company or of specific personal data is done by us, by hand, on request: write to privacy@questpie.com. We answer within 30 days and tell you what we deleted and what we had to keep, for example audit records needed for security, and why.
13. Security
These are the measures we use to protect personal data:
- connections to the website and the application are encrypted in transit (HTTPS);
- passwords are stored only as hashes, and secrets for connected services are encrypted with AES-256-GCM;
- every action in a company is checked against the roles and permissions that company has granted, for people and Agents alike, and companies are separated from each other on the server;
- actions are recorded in an audit record that cannot be edited;
- an Agent never receives database or server credentials; a Work Machine works with short-lived credentials tied to one Run;
- Work Machines that we run are isolated sandboxes whose outgoing network access is blocked except for an approved list;
- the database is backed up daily, with a continuous log, kept for 7 days;
- access to production systems is limited to the people who operate the service, who are bound by confidentiality.
No system is perfectly secure. If a personal data breach affects you, we tell you and the authority as the law requires.
14. Cookies and storage on your device
questpie.com sets no cookies and stores nothing in your browser.
The Autopilot application (autopilot.questpie.com) uses the following. None of them is used for advertising or for tracking across sites.
| What | Purpose | How long |
|---|---|---|
| Session cookie | Keeps you signed in | Until the session expires or you sign out |
| Password recovery, invitation and Work Machine pairing cookies | Carry you through that one flow | Minutes, or until the invitation expires |
Language cookie (questpie-autopilot-locale) | Remembers your interface language | 12 months |
| Local storage: theme, open tabs, view settings, recently visited pages, layout preferences | Remember how you left the interface | Until you clear them |
| Session storage: unsent drafts and attachments | Protect text you have not sent yet | Until the browser tab is closed or you clear it |
Items in local storage can include the names or identifiers of things you opened. On a shared computer, clear the browser's site data when you finish.
15. Email
Service email carries no tracking: no tracking image and no rewritten links, so we do not record whether you opened an email or clicked a link in it. Service email is sent through our own installation of Plunk and delivered by Amazon SES. We record only whether an email was sent and delivered, whether it bounced, and whether it was reported as spam, so that we can keep delivery working.
We do not send marketing email.
16. Your rights
Under GDPR you have the right to:
- get a copy of the personal data we hold about you and information about how we use it;
- have inaccurate data corrected;
- have data deleted, where the law provides for it;
- have our use of your data restricted;
- receive data you gave us in a portable form;
- object to processing that we base on legitimate interest;
- withdraw consent, where we rely on consent.
To use any of these rights, write to privacy@questpie.com. We answer within 30 days. We may need to check that you are who you say you are before we send data, so that we do not disclose it to someone else. The product does not yet have a self-service export of all your data or a delete button; we handle these requests by hand, and your rights do not depend on a button existing.
If your request concerns content in a company's workspace, we will pass it to that company or ask you to contact it, because the company decides about that data.
You can complain to a supervisory authority. Ours is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), dataprotection.gov.sk. You can also complain to the authority in the EU country where you live or work.
17. United States residents
We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not use it for targeted advertising. We do not knowingly process sensitive personal data for our own purposes.
Several US states give residents rights over their personal data, such as the rights to know, correct and delete. Whether a state's privacy law applies to a business depends on its size and the amount of data it handles, and we do not claim that any particular one applies to us. We answer requests from anyone, wherever they live, in the way section 16 describes: write to privacy@questpie.com. We will not treat you worse for making a request.
18. Age
Autopilot is a tool for businesses. You must be at least 18 to have an account. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has given us personal data, write to us and we will delete it.
19. Changes to this policy
We will publish any new version on this page with its date. If a change matters to how we use your data, we will also tell account holders by email before it takes effect.
20. Contact
QUESTPIE s. r. o., Brezany 145, 010 04 Brezany, Slovak Republic. Email: privacy@questpie.com.