Notice
Privacy Policy
Last updated: 14 May 2026 · Reg. UE 2016/679 (GDPR)
1. Data controller
The data controller is MachinePilot (hereinafter also "MachinePilot", "we", "Controller"), operating from Italy, accessible via the website machinepilot.eu. For any request you can contact us at privacy@machinepilot.eu.
2. Types of data collected
- Account data: email, name, company name, VAT number, address, country.
- Credentials: password (bcrypt hash — never plain text), session tokens (JWT).
- Industrial data uploaded by the user: technical drawings (images/PDF), Time Studies, machine configurations, hourly rates, materials, CRM customers, quotes, RFQs published on the marketplace.
- Usage data: application logs (access timestamps, masked IP, browser).
- Payment data: handled entirely by Stripe Payments Europe Ltd (Ireland) — MachinePilot does NOT store card data. We only receive the transaction ID and amount.
- AI Copilot conversations: chat texts and related quote context (stored to enable conversation history).
3. Purposes and legal basis
- Service delivery (Art. 6.1.b GDPR — contract performance): authentication, quote generation, B2B marketplace access, AI calibration.
- Legal obligations (Art. 6.1.c): invoicing, accounting records.
- Legitimate interest (Art. 6.1.f): IT security, fraud prevention, service improvement via aggregated anonymous analytics.
- Consent (Art. 6.1.a): preference/analytics/marketing cookies, commercial communications. Revocable at any time.
4. Uploaded industrial data — use and AI sub-processors
The technical drawings, part photos, Time Studies and quotes you upload are considered sensitive industrial data of the workshop. They are processed with the following additional safeguards:
- AI vision analysis: to extract geometry, tolerances and operations from drawings we use the Claude Sonnet 4.5 model provided by Anthropic PBC (San Francisco, USA) via technical integration. Anthropic acts as a sub-processor on behalf of MachinePilot and is bound by the EU Commission's Standard Contractual Clauses for extra-EEA transfers.
- Storage and retention: your drawings remain in MachinePilot's storage as long as your account is active, or until you manually delete them. Anthropic declares that it does NOT use content submitted via API to train its models.
- B2B Marketplace: the RFQs you publish become visible to other registered users with the fields you explicitly selected for publication (title, material, quantity, country). Sensitive data (full drawings) is not shown publicly.
- Confidentiality: MachinePilot staff accesses user content only for technical support explicitly requested by the user.
5. Sub-processors and vendors
- Anthropic PBC — Claude Sonnet 4.5 AI model (drawing analysis, AI Copilot, Lost Opportunity insights). USA, EU SCC.
- Stripe Payments Europe Ltd — Payment and subscription management. Ireland (EU).
- MongoDB Atlas — Main database. EU region.
- Resend / SMTP provider — Transactional emails (account verification, notifications).
- exchangerate.host — EUR/USD/GBP/CHF exchange rates (server-side request, no user data transmitted).
6. Retention periods
- User account: for the entire duration of the contractual relationship, then 30 days of backup.
- Quotes and drawings: as long as the account is active or until the user deletes them.
- Security logs: 90 days.
- Invoices and transactions: 10 years (tax obligation).
- AI Copilot conversations: until the user deletes them or deletes the account.
7. Your rights (Arts. 15-22 GDPR)
You can exercise the following rights at any time:
- Access and portability: download all your data in JSON format from the Settings → My data page.
- Rectification: edit your account data from the profile page.
- Erasure (right to be forgotten): permanently delete your account and all associated data from the Settings → Delete account page.
- Restriction, objection and consent withdrawal: write to us at privacy@machinepilot.eu.
- Complaint to the supervisory authority: www.garanteprivacy.it
8. Cookies
We use technical, preference, analytics and marketing cookies. Cookie choices are managed via the consent banner on first access, and can be changed at any time from the Settings page. For more details see the Cookie Policy.
9. Security
- Mandatory HTTPS/TLS connection.
- Bcrypt password hashing (never plain text).
- Brute-force protection on logins (5 attempts → lockout).
- Daily database backups.
- Internal access authorized only for technical staff when assistance is required.
10. Changes
We reserve the right to update this policy. Substantial changes will be notified via email or in-app banner.
DPO / Privacy contacts: privacy@machinepilot.eu · Postal address available upon written request.