Where your data lives, and when it goes
Last updated 27 October 2026
- Your data sits with a handful of named suppliers, each working only on our instructions.
- It travels encrypted. Encrypted backups are kept at Cloudflare (EU) for 30 days.
- Every kind of data has a set keeping period. The checker deletes free-report requests and accounts automatically when theirs ends. Dashboard data is still deleted by hand; nothing is due before June 2028.
- Ask us to delete your data and we do it within one month.
- If something goes wrong, we have a plan, and we tell you when the law says we must.
This page sits beside our privacy policy. The privacy policy says what we collect and why. This page says where it is kept, how it is protected, and when it is deleted.
Where it is kept
| Data | Kept in | Where |
|---|---|---|
| Free-report requests and your account: first name, email, website, business type, every scan with its date, your tick on the email box (when, and the words), your password and the codes we email you (scrambled only), and a record of each login (when and whether it worked; not your internet address) | The checker's database, on Railway | United States |
| What you add at login, and your dashboard | The checker and the dashboard, on Railway | United States |
| Email list: first name, email, a tag, the emails we sent you and whether you clicked their links, mail you send to support@aiwebpilot.com | HighLevel (GoHighLevel) | United States |
| Anonymous statistics, and the note of which group your website counts in | The checker, on Railway | United States |
| Encrypted backup copies of the checker's data, kept 30 days | Cloudflare storage | European Union |
| A daily encrypted copy of the checker's backups | The AI Web Pilot owner's computer, with its disk encrypted | France |
| Server logs (internet address, browser, page asked for) | Railway (checker, dashboard) and Bluehost (this website) | United States |
How it is protected
- Encrypted on the way. Every page and every connection to our suppliers uses HTTPS.
- Encrypted backups. Backup copies are encrypted before they leave the checker, with the key kept apart from the copies.
- Few hands. Only the owner of AI Web Pilot can reach the stored data. Supplier keys give each tool only the access it needs: the key that sends our emails can only add contacts and send messages.
- Secrets kept secret. Passwords and keys are kept in our hosting settings, not in our code.
- Collect less. We ask only for what the service needs. Your internet address is used in memory to stop abuse, and never saved.
- Safe scanning. The scanner reads only public web pages and refuses private network addresses.
- Private reports. Your report opens only with the private report link in your email, and search engines are told not to list it.
- Passwords and codes scrambled. Your password and the codes we email you are stored only in scrambled form, which can't be turned back into the password or code.
How long we keep it
| Data | Kept for | Then |
|---|---|---|
| Free-report request and scan | 2 years after your newest scan | Deleted |
| Dashboard and what you added at login | While you use it, and 2 years after your last login | Deleted |
| Email list entry | As the free-report request; sooner if you unsubscribe | Deleted |
| "Do not email" list | 3 years after you unsubscribe | Deleted |
| Emails you send us | 2 years after the last one | Deleted |
| Done-for-you work | For the work, and 3 years after it ends | Deleted |
| A request to use your rights, and our answer | For as long as a claim about it could be made | Deleted |
| Backup copies | 30 days | Deleted automatically |
| Server logs | The short period each hosting provider sets | Deleted by the provider |
| Anonymous statistics | No limit | They identify no one |
When paid AI Web Pilot plans start, invoices will be kept for the period Australian tax law sets.
How deletion works
When you ask. Email support@aiwebpilot.com. Within one month we delete your name, email, scan, login answers, the note of which statistics group your website counts in, and your dashboard, from the checker, the dashboard and our email list, then confirm it to you. Today this is done by hand.
When a keeping period ends. The checker deletes free-report requests and accounts automatically. Dashboard data is still deleted by hand; nothing is due before June 2028. Our first free-report request dates from June 2026.
Backups. Deleted data can stay in a backup copy until that copy expires, at most 31 days later (longer only if our backups stop, until they run again). Nobody uses it in that time. If we ever have to restore a backup, we delete your data again before the service runs on it.
What stays. Your email stays on our "do not email" list if you unsubscribed, so we never email you by mistake. Your scan's contribution to the anonymous statistics stays, because it can no longer be linked to you.
If something goes wrong
If personal data is lost, leaked or reached by someone who shouldn't have it, we:
- stop it and work out what happened, whose data, and the risk to them;
- write it down, every time, with what we did about it;
- tell the data protection authorities of the people affected within 72 hours of finding out where we can, unless the breach is unlikely to put anyone at risk, and the Australian Information Commissioner where Australian law requires it;
- tell you directly, without delay, if the breach is likely to put you at high risk, with what happened and what you can do.
Our suppliers must tell us without delay if a breach hits their systems.
Our suppliers
These suppliers handle your data only for us. We are putting data-processing agreements in place with each, with the safeguards for data leaving Europe listed in our privacy policy.
- Railway (Railway Corporation, United States): runs the checker and the dashboard.
- HighLevel (HighLevel LLC, United States): email sending, our email list and our support inbox.
- Mailgun (United States): carries our emails for HighLevel.
- Cloudflare (Cloudflare, Inc.; storage in the European Union): encrypted backups, and the bot check on our checker's forms.
- Bluehost (United States): hosts aiwebpilot.com and passes on mail sent to support@aiwebpilot.com.
- Anthropic (United States): Claude, which helps us build and run the service.