1. Who we are
PiecePilot is an independently operated online inventory service based in the United Kingdom. PiecePilot is the data controller for the personal information described in this policy. For privacy or data-protection questions, contact us using the email address above.
2. What this policy covers
This policy applies to the public PiecePilot website, the PiecePilot application, account and subscription services, and support communications. Third-party websites and services have their own privacy notices.
3. Information we collect
- Account information: your name, email address, securely hashed password, email-verification status and account preferences.
- Inventory and workspace information: parts, sets, colours, quantities, locations, notes, images, imports, seller records and other information you choose to add.
- Subscription information: your plan, subscription status, Stripe customer and subscription identifiers, and limited billing information returned by Stripe. PiecePilot does not receive or store your full card number.
- Support information: messages, screenshots and other information you send when asking for help or providing feedback.
- Technical and security information: IP address, browser and device information, request logs, session and authentication activity, and information needed to diagnose errors or prevent misuse.
- Integration information: records returned or submitted when you choose to use available BrickLink, eBay or Rebrickable-related features.
4. How we obtain information
We receive information directly from you when you register, add or import records, choose a paid plan or contact support. We count public website page loads and free-trial link clicks as anonymous daily totals, without visitor IDs, IP addresses or page URLs in these totals. An administrator browser can set a preference cookie to exclude itself from these counts. We also collect limited technical information automatically when you use the service. If you use an optional integration, information may also come from or be sent to the relevant third-party service at your direction.
5. Why we use information and our lawful bases
- To create your account, provide inventory features, maintain your workspace and administer your subscription. This is necessary to perform our contract with you.
- To send verification, password-reset, security, service and billing messages. This is necessary to perform our contract and supports our legitimate interest in operating the service.
- To process payments and maintain required transaction and accounting records. This is necessary to perform our contract and comply with legal obligations.
- To answer support requests and improve reliability and usability. This supports our contract with you and our legitimate interests in supporting and improving PiecePilot.
- To secure accounts, investigate errors, prevent fraud or misuse and protect the service. This supports our legitimate interests in keeping PiecePilot and its users secure and may also be required by law.
- Where we specifically ask for consent, for the purpose explained at the time. You may withdraw that consent at any time.
Where we rely on legitimate interests, we consider the need for the processing, its effect on you and whether those interests can reasonably be achieved in a less intrusive way.
6. Who receives information
We use service providers that process information on our behalf, including Cloudflare for website and application hosting, database and file storage; Stripe for subscription checkout, payments and billing; and Resend for transactional email.
If you choose an optional BrickLink, eBay or Rebrickable-related feature, relevant information may be exchanged with that service to complete your request. Those organisations act under their own privacy notices. We may also disclose information where required by law, to protect legal rights or security, or in connection with a sale or reorganisation of the service.
We do not sell personal information.
7. Cookies and similar storage
The application uses essential cookies or browser storage to keep you securely signed in. Stripe may use its own technologies when you visit its checkout or billing portal. Read our Cookie Notice for more information.
8. International transfers
Some providers may process information outside the United Kingdom. Where UK data-protection law requires it, transfers are made using a recognised adequacy decision or appropriate contractual and organisational safeguards. You can contact us for more information about the safeguards relevant to your information.
9. How long we keep information
We keep information only for as long as reasonably necessary for the purposes described above. Account and workspace information is normally retained while your account remains active. When you complete the in-app account-deletion process, account and inventory information is scheduled for deletion, subject to limited backups and information we must retain for legal, accounting, security or dispute-resolution purposes.
Subscription and transaction records may be retained for the period required by tax, accounting and fraud-prevention obligations. Security logs and support communications are retained only for as long as reasonably needed for security, diagnosis, support and legal claims.
10. Your data-protection rights
Depending on the circumstances, UK data-protection law may give you the right to:
- be informed about how your information is used;
- request access to your personal information;
- have inaccurate or incomplete information corrected;
- request erasure or restriction of processing;
- object to processing based on legitimate interests;
- receive certain information in a portable format; and
- withdraw consent where processing relies on consent.
To exercise a right, email [email protected]. We may need to verify your identity and some rights are subject to legal exceptions. You also have the right to complain to the UK Information Commissioner’s Office. Information about making a complaint is available at ico.org.uk/make-a-complaint.
11. Automated decision-making
PiecePilot does not use personal information to make solely automated decisions that produce legal or similarly significant effects, and does not use personal information for advertising profiles.
12. Security
We use technical and organisational safeguards intended to protect information, including restricted access, secure authentication and encrypted connections. No online system is completely risk-free, so you should use a strong, unique password and keep secure backups of important inventory data.
13. Children
PiecePilot is intended for users aged 18 or over and is not directed at children. If you believe a child has provided personal information, please contact us.
14. Changes to this policy
We may update this policy when the service or legal requirements change. The current version and its update date will remain available on this page. If a change materially affects how we use personal information, we will provide an appropriate notice.
15. Contact
For questions, requests or complaints about privacy, email [email protected].