Privacy policy

1. Who this covers

This policy applies to First Pilot Inc. ("First Pilot", "we") and to three groups of people whose information reaches us:

• Site visitors — anyone reading this website or sending us an enquiry. We decide what is collected here and why, so this policy governs.
• Clients and their staff — the people we contract with and work alongside. This policy governs here too.
• People who speak to a system we deployed — our client's customers, patients or callers. Here we are handling information on our client's behalf and on their instructions. Our client decides what is collected and why, their privacy notice governs, and we hold it under the agreement described in section 13.

If you reached this page after speaking to an AI agent on another company's phone line or website, that company is accountable for your information and is the right place to send a request. If you are not sure who they are, contact us and we will point you to them where we can.

2. What we collect

From site visitors

The enquiry form collects your name, business name, work email, optional phone number, the service you are interested in, a volume band and your message. Those are the only fields, and all of them are visible on the form — there are no hidden fields collecting anything else, with one exception noted below.

We also process, transiently, the technical information every web server receives: your IP address, the requested URL, your browser's user agent and the timestamp. Your IP address is used for one purpose — rate limiting the enquiry form so it cannot be flooded — and it is truncated before it is used as a rate-limit key. It is not stored in a profile and it is not used to identify you.

The exception: the form includes an off-screen honeypot field and measures how long the form was open before submission. Both exist solely to detect automated submissions. If either indicates automation, the submission is discarded and nothing is retained.

From clients

Contract and billing details, the contact details of the people we work with, the operational information needed to scope and build your system — for example documents, recordings, price lists, process details and data from the tools involved — and our correspondence with you.

From the people who use a deployed system

Whatever our client's configuration collects during a conversation: typically a name, phone number, address, the reason for contact and appointment details. The scope is set by our client. Our practice is to configure systems to collect no more than the task needs.

3. Why we collect it

We collect and use personal information for these purposes:

• To reply to you. If you send an enquiry, we use your details to answer it and to prepare the audit you asked for.
• To do the work. Client information is used to build, run and support what you engaged us to build.
• To keep the service available. IP addresses are used for rate limiting and abuse prevention.
• To meet legal and tax obligations. Invoices and records are kept for the periods the law requires.
• For anything else we tell you about at the time, or that the law permits or requires.

You give us your information voluntarily, by sending it. Sending an enquiry is your consent to us replying to it. You can withdraw that consent at any time — see section 9.

We do not sell personal information, we do not rent or trade it, we do not share it for advertising, and we do not add enquiries to a marketing list. There is no newsletter to unsubscribe from because there is no newsletter.

We do not use client or end-user conversations to train machine learning models of our own. Where a deployment uses a third-party model provider, we choose service tiers whose published terms say submitted content is not used for training. What a provider does is governed by its own terms, which we do not control.

4. Cookies and tracking

This website sets no cookies of its own. There is no analytics script, no advertising pixel, no session recorder and no heat-mapping. You will not see a consent banner from us because our pages give you nothing to consent to.

There is one piece of third-party content: the booking calendar on the contact page, which is provided by Calendly. It is not loaded until you press the button that opens it — until then your browser makes no connection to Calendly. Once you open it, Calendly may set its own cookies inside the calendar, and the name, email and anything else you enter to book a time go to Calendly, which handles them under its own privacy policy and passes the booking to us. If you would rather not use it, the enquiry form and the email address both reach us without it.

One piece of data is stored in your browser: if you use the light/dark theme toggle, your choice is saved in localStorage under the key fp-theme. It never leaves your device, it is not a cookie, it is not sent to us, and clearing your site data removes it.

The site's content security policy restricts our pages' network connections to our own origin and allows a single outside frame, the Calendly calendar. That is a technical safeguard against information being sent to an advertising network, not a guarantee. Fonts are served from our own domain.

This site links to other sites, including YouTube and Calendly. Once you follow a link, that site's own privacy policy applies and we are not responsible for its practices.

5. Calls, chats and transcripts

Systems we deploy are configured to identify themselves as automated at the start of a conversation.

Where a deployment records calls, our client is responsible for giving callers the notice their jurisdiction requires and for obtaining consent where it is needed. We configure the disclosure the agent reads; the client is accountable for the legal basis, and their agreement with us says so.

Whether calls are recorded, whether transcripts are kept and how long either is retained are chosen by the client and set out in the agreement for that deployment. Recordings and transcripts are usually created and stored by the third-party voice platform the deployment runs on, under that platform's own terms and settings.

6. Service providers and third-party platforms

Most of what we build runs on platforms owned by other companies. Information handled by a system we build passes through, and is often stored by, those platforms:

• cloud hosting and infrastructure, for this site and the systems we build;
• voice platforms and telephone carriers, for voice deployments;
• speech and language model providers;
• automation and integration tools, calendars and CRMs;
• email and calendar providers, for our own business correspondence;
• Calendly, for the booking calendar on the contact page and the bookings made in it;
• accounting and payment processing, for invoicing.

Each of these companies handles information under its own terms and privacy policy. We do not own or control them, and to the extent the law permits we are not responsible for their privacy practices, security, availability or retention. In many deployments the accounts belong to the client, who then has a direct relationship with the provider. Some providers are located, or process information, outside Canada. If you are a client and want to know which providers are involved in your deployment, ask and we will tell you.

We may also disclose information where the law requires or permits it, for example in response to a valid legal request, to protect our rights, or as part of a sale or reorganisation of the business. Where a request concerns a client's information and we are permitted to, we will try to tell that client.

7. Where it is stored

We operate from Ontario, Canada and serve clients in Canada and the United States. Where conversation data is stored depends largely on the third-party platforms a deployment runs on and the regions they offer. Where a platform gives a choice, we set it up in the region agreed with the client.

Where information is stored or processed in the United States, it may be accessible to US courts and authorities under the laws of that country. If that matters to you, raise it during scoping so it can be addressed in your agreement.

8. How long we keep it

These are our normal periods, not guarantees. We may keep information longer where the law requires it, to resolve a dispute or to establish or defend a legal claim, and copies may remain in backups for a limited time after deletion. What happens to conversation data when an engagement ends is set out in the agreement for that engagement.

9. Your rights

Subject to the law that applies to you, you can ask us to:

• Access — tell you what personal information we hold about you, how we use it and who we have given it to.
• Correct — fix anything inaccurate or incomplete.
• Delete — erase it, where the law gives you that right and we have no legal reason to keep it.
• Export — give you a copy, where the law gives you that right.
• Withdraw consent — stop using it, subject to any legal or contractual restrictions. We will tell you what withdrawing means in practice before it takes effect.

Email privacy@firstpilotinc.ca. We respond within the time the law requires, which is normally 30 days, and we may need to verify your identity first. We may decline or limit a request where the law allows — for example where it would reveal someone else's information — and we will tell you why.

If you spoke to a system we run for one of our clients, that client is accountable for your information, and requests about it should go to them. We will point you to them where we can.

10. Automated decisions

The systems we deploy hold conversations, book appointments, route enquiries and carry out tasks automatically. They are not intended to make decisions that significantly affect someone, such as denying service, assessing creditworthiness, making clinical judgements or refusing a claim. Our practice is to design that kind of decision to be escalated to a person, under rules our client approves.

Systems we build are designed to hand over to a person on request. How and when that handover happens depends on how our client has set it up and staffed it.

11. How we protect it

We use safeguards appropriate to the sensitivity of the information, including encrypted transport, separation of administrative systems from public-facing ones, role-based access and logging of administrative actions. The controls implemented on this website are described on the security page.

No system is perfectly secure, and we cannot guarantee the security of information. The security of a third-party platform is that provider's responsibility, not ours. If a breach of our safeguards creates a real risk of significant harm, we will notify the affected individuals and the Office of the Privacy Commissioner of Canada as the law requires.

12. Children

Our services are sold to businesses and this site is not directed at children. We do not knowingly collect personal information from anyone under 16 through this website. Where a client deployment operates in a context involving young people — a paediatric clinic, for example — the client decides what is collected and is responsible for any consent required.

13. Data handling for clients

When we handle personal information on a client's behalf, the specifics are agreed in the written agreement for that engagement rather than assumed from this page. That agreement sets out what we may do with the information and on whose instructions, where it is stored and for how long, who is responsible for notice and consent, our confidentiality obligations, what happens if something goes wrong, and what happens to the data when the engagement ends.

If your organisation has its own requirements — a particular retention period, data kept in Canada, recordings disabled, a security review — raise them during scoping so they can be addressed in that agreement. Where this page and a signed agreement differ, the agreement governs for that engagement.

14. Changes

We may update this policy from time to time. The current version is the one on this page, with its effective date at the top. Where a change materially affects how we handle personal information, we will take reasonable steps to bring it to the attention of current clients.

15. Contact and complaints

Privacy questions and requests: privacy@firstpilotinc.ca.
Anything else: info@firstpilotinc.ca.

A named individual at First Pilot is accountable for privacy. Ask and we will tell you who it is.

If you are not satisfied with how we have handled your concern, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to the privacy regulator in your province or state. We would rather you came to us first, but we will not obstruct you.

First Pilot Inc. · Remote-first team · Coverage within Canada & US