Privacy

Who is responsible

The controller is GTA GO TO AGENCY, SAS (société par actions simplifiée), SIREN 944 980 762, RCS Dijon.

For the content a team enters itself, such as its contacts' names, emails and phone numbers, the team decides what to store and is responsible for it; GTA GO TO AGENCY processes that content on the team's behalf, to provide the service.

For anything about personal data, write to [email protected].

What Cockpilot is

A tool for teams to manage tasks, projects, contacts and KPIs, with an assistant (text and voice), and an MCP server and an API for assistants.

A team signs up on compte.cockpilot.si. It then has its own Cockpilot, at its own address (team.cockpilot.si), with its own data, kept apart from every other team's. People join a team on an invitation from its administrator. The apps for iPhone, iPad, Mac, Android, Windows and Linux connect to that address.

What the service holds

• Your account: your name, your email, your password stored as a fingerprint (scrypt), your second-factor secrets, the public keys of your passkeys and security keys, and your backup codes, stored as fingerprints.
• Your sessions: a session cookie, and the device, described from the browser's User-Agent.
• Your team's content: tasks, projects, contacts, pages and notes. Contacts may include the names, emails and phone numbers of other people, entered by the team: the team is responsible for having a legal basis to store them.
• The activity journal: who created, changed or finished what, when, and from where (the app, MCP or the API).
• The assistant: your conversations with it, your private notebook, your assistant settings, and a count of its use per day and per person (messages, the model's tokens, characters spoken, seconds of listening).
• The assistant's credits: the top-ups the space received and what the assistant used.
• The team's own Anthropic key, if an administrator saves one.
• Tokens and webhooks: API and MCP tokens, including those given to Claude when you connect it, stored as fingerprints, and the webhooks your team sets up.
• IP addresses, used to count sign-in attempts (rate limiting).

Sign-up and payment

The sign-up form on compte.cockpilot.si asks for the team's name, the address it wants, your name, your work email and the plan. We send a link to that email to confirm it. Once it is confirmed, you pay on Stripe Checkout, and the space is created only once the payment has gone through.

Access is paid. Team and Agency start with a 7-day trial that asks for a card at sign-up: the subscription starts on the eighth day unless it is cancelled before. Solo for life and the assistant's credit packs are paid once, also on Stripe Checkout. Card details are typed on Stripe's page and kept by Stripe, never by Cockpilot. Stripe also computes the VAT and issues the invoices, payments made once included; it receives the billing address and, for a business, its VAT number.

compte.cockpilot.si then keeps the team's name and address, its administrator's name and email, the plan, the trial's dates, the subscription's state, the identifiers Stripe gives the customer, the subscription and each payment, and the credits added to the space (amount, reason, date). For Solo for life, it also keeps the sale.

We email the administrator about the account: the confirmation link, the space being ready, the end of the trial three days before it, a payment that did not go through.

The assistant's credits

On a team's space (team.cockpilot.si), the built-in assistant uses credits when it writes, speaks or listens. They belong to the space, shared by its members, who can see the balance and the latest top-ups.

The space itself keeps what the assistant has used, in its own data: an amount per month and per item (text, voice, listening), not per person. It also keeps the top-ups it has received: the amount, the reason (welcome, monthly, pack, gift), the date, and Stripe's identifier of the payment or the invoice when there is one. compte.cockpilot.si keeps only the top-ups, never what was used.

Your own Anthropic key

An administrator can save the team's own Anthropic API key in the assistant's settings. It is checked once, when it is saved, with a free call to Anthropic (the list of its models). The space keeps it in its data, with the date and the person who saved it: unencrypted, since the server must send it to Anthropic, in a file with restricted access rights. It is never shown in full again: the app and the server's log show only its last four characters. An administrator can delete it at any time.

While it is there, what the team writes to the assistant goes to Anthropic with this key, billed to the team's Anthropic account, and uses no credits. The voice and the listening stay on credits.

Connecting Claude

If you use Claude (Claude Desktop, claude.ai or the Claude app), you can add your space to it as a custom connector. Claude then opens a page of your space in your browser: you sign in, then you allow it, read-only if you choose. Your space gives Claude a token of its own, which never has more rights than you. The space keeps only fingerprints of it, with the connector's name, yours and the rights given. You can revoke this access at any time from the Security page, where each connector appears with its name and the date you allowed it.

What Claude reads or writes in your space then goes through Anthropic, under the terms of your Claude account. It uses no Cockpilot credits.

Signing in with Google, Apple or Microsoft

If you choose to, you can sign in with your Google, Apple or Microsoft account. The provider then gives Cockpilot an identifier for your account and your email. Cockpilot keeps the identifier with your account, to recognise you next time, and nothing else from the provider. For a team's own space, this goes through compte.cockpilot.si, which hands your identity to your space and keeps nothing of it.

Finding your space

On compte.cockpilot.si/espace, and in the apps for iPhone, iPad, Mac, Android, Windows and Linux, you can type your email to reach your team's space (on the web, Google, Apple or Microsoft can also give it, once they have verified it). For this, each team's space sends compte.cockpilot.si fingerprints of the emails that have an account or a valid invitation in it, and of those of the Google, Apple or Microsoft accounts linked to them: an HMAC-SHA256 computed with a secret of that team, never the email itself. Each list replaces the previous one.

The email you type is sent to compte.cockpilot.si, which computes its fingerprint and compares it with these lists. It does not save the email: it keeps it in memory only, for about an hour, to limit searches to ten per hour for the same email, and its log notes each search with the email masked (its first two characters and its domain). The answer gives only the name and address of the space; signing in to it still asks for your password or your provider. The apps then connect directly to your space.

The early access form

The form on cockpilot.si asks for your email, your name and your company, with a hidden anti-spam field. What you send goes to Cockpilot and becomes a prospect contact in GO TO AGENCY's own Cockpilot, so we can answer your request. It is kept while the request is followed up, and deleted on request: write to [email protected].

The trial call

On the home page, the trial "Try a call" works without an account. With your permission, your browser records short phrases, at most 8 seconds each, 3 phrases and 20 seconds in all, and sends them to Cockpilot's server. ElevenLabs transcribes them, Anthropic's model answers on an example board that lives only in memory for the two minutes of the trial, and ElevenLabs speaks the answer back.

Cockpilot keeps neither the audio nor the text. Your IP address is used only to count trials, at most 3 per address per day, and is not stored beyond that.

Google Calendar, both ways

Only if you link your Google account from the app. Cockpilot then creates a calendar named Cockpilot in your Google Calendar and keeps there your own open tasks that have a date: their title, date, time, duration, a link to the task and its notes. It reads back what changes in that calendar (moving, renaming, deleting or adding an event changes your tasks), and the events of your main calendar for the next two weeks (their title, start and end, and whether you declined them), to show you your busy times, to you alone. It asks Google only for these rights: creating its own calendar and writing in it, and reading your events. It keeps a refresh token given by Google, and never your Google password. Unlinking removes the Cockpilot calendar from your Google account and revokes the access.

Capturing into your inbox

Each person can create a secret capture address. What is sent to it, from a phone shortcut, a tool, a share from the phone or the browser extension, becomes a task in their personal space: the text, a title, a link. A voice note sent to it is transcribed by ElevenLabs, then the audio is dropped. If your space receives emails, an email forwarded to your capture email address becomes a task: its subject, sender, date and text are kept in the task, its attachments are not. The address and its email stop working as soon as you remake or remove them.

The browser extension

The Cockpilot extension for Chrome, Edge and Firefox sends to your own space, through your capture address, only what you choose to send: the title and address of the page, a link, the text you select, and what you type. It reads the selected text only when you open its window or use its menu. It keeps your capture address on your browser, never synchronised, and nothing else of your account. It sends nothing to GO TO AGENCY or anyone else, and has no tracking.

Where it is stored

In Germany, at Hetzner in Nuremberg: the servers and the database.

Who else receives data

• Hetzner (Germany) hosts the service.
• Cloudflare runs the network and the protection in front of the site and the app: traffic passes through it.
• Anthropic (United States) runs the assistant's model. What you write or say to the assistant, the images you attach, and the task data the assistant reads to answer are sent to it; with the team's own key, they are sent with that key. If you connect Claude, what Claude reads or writes in your space goes through Anthropic, under the terms of your Claude account.
• ElevenLabs runs speech-to-text and the assistant's voice. The audio of a call, a dictation or a voice note sent to a capture address is sent to it and its text comes back; Cockpilot does not keep the audio.
• Google (Calendar): only if a person links their Google Calendar. Cockpilot then writes their dated tasks into its own calendar there, and reads their events (see Google Calendar, both ways).
• Amazon Web Services (Ireland): only if the space receives emails through Amazon SES. The forwarded email passes through it to reach the capture address.
• Open-Meteo: the weather widget asks it for the forecast of the chosen city, directly from your browser.
• Stripe (Stripe Payments Europe, Ireland) handles the payments, the subscriptions and their trial, Solo for life and the credit packs, their VAT and their invoices, and keeps the card.
• Google, Apple, Microsoft: only if you sign in with your account there.
• Web push: if you turn on notifications, your browser's push service (Google, Mozilla or Apple, depending on the browser) delivers them.
• Calendars: only if a person subscribes from Google Calendar or another calendar. The calendar then reads a secret address, one per person.
• Webhooks send data only to the addresses the team sets.

Transfers outside the European Union (Anthropic, Cloudflare, ElevenLabs, Google, Stripe, the push services) rely on the providers' standard contractual clauses and data processing terms.

Cookies and local storage

The app uses the session cookie, which is strictly necessary, and, for a few minutes, the cookies of a sign-in in progress: the second-factor step, a sign-in with Google, Apple or Microsoft, and connecting Claude. compte.cockpilot.si sets only short-lived cookies needed to sign up, sign in and reach billing, for a few minutes. The public site cockpilot.si measures its audience (page views) with Datalenk; the app does not. The theme and the voice you choose, for the site's narration and for the trial call, are kept in your browser's local storage.

What we do not do

No advertising, no selling of data, and no tracking SDK in the mobile or desktop apps. The microphone is used only during a call with the assistant or a dictation, after the system asks for your permission.

How long data is kept

• Your team's data is kept while its account is active. A space whose subscription is suspended keeps its data, read-only, until the team subscribes again or asks for it to be closed.
• A deleted item stays thirty days in the trash, then it is gone.
• Assistant conversations are kept until the person deletes them. The count of the assistant's use per day is kept four hundred days.
• The assistant's credits, the top-ups and what was used, are kept as long as the space: its balance is computed from them.
• The team's own Anthropic key is kept until an administrator deletes it.
• The link to Google Calendar, its refresh token and the busy times read, are kept until the person unlinks it, or until Google withdraws the access.
• A capture address is kept until the person remakes or removes it; what it received is ordinary content of the team.
• An access given to Claude lasts until it is revoked; left unused for ninety days, it ends.
• A sign-up whose email is never confirmed is deleted seven days after its link expires (the link lasts 24 hours). A confirmed sign-up that is not paid within 24 hours is abandoned and its address freed; its record (the team's name and address, the administrator's name and email) is deleted thirty days later.
• The whole account can be exported at any time.
• Invoices, issued by Stripe, are kept ten years, as French accounting law requires.
• An early access request is kept while it is followed up, and deleted on request ([email protected]).
• When a team leaves, its data is deleted. Write to [email protected] to close an account; its data is deleted within thirty days.

Legal bases

• Performance of the contract: providing the service and billing it.
• Legal obligation: keeping invoices.
• Steps taken at your request before a contract: answering an early access request.
• Legitimate interest: security, rate limiting, the audience measurement of the public site, and the trial call (letting visitors try the product, preventing abuse).

Your rights

Under the GDPR, you have the right of access, rectification, erasure, restriction, objection and portability. Write to [email protected]. You can also lodge a complaint with the CNIL (www.cnil.fr).