Privacy notice

Who is responsible

The controller for this website is: Ihtesham ul Haq, Street 7, Mohallah Hyderabad, Alipur Chattha 52080, Punjab, Pakistan, hello@latepilot.com

Calculators and letter templates

The interest calculators and reminder-letter generators run entirely in your browser. The amounts, dates, names and other details you enter are not sent to us and are not stored by us.

No cookies, no analytics

This website uses no analytics, advertising or tracking tools. The only cookies are two strictly necessary ones in the LatePilot app: one keeps you signed in, and one protects the Xero sign-in step for 10 minutes. The public pages set no cookies, so no consent banner is needed.

Hosting and delivery

The website is hosted by Amazon Web Services EMEA SARL (38 Avenue John F. Kennedy, L-1855 Luxembourg). Files are stored in Frankfurt (Germany) and delivered through the Amazon CloudFront network, which includes AWS WAF protection against attacks. To deliver pages and block abuse, AWS processes technical connection data such as your IP address, browser type and the requested page. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). We have not enabled access logs.

AWS may process data in countries outside the EU/EEA; such transfers are covered by the EU–US Data Privacy Framework or the EU Standard Contractual Clauses in the AWS data processing addendum.

Waitlist

If you join the waitlist, we process your email address, your language and the times you signed up and confirmed. Purpose: telling you when LatePilot's automatic reminders launch. Legal basis: your consent (Art. 6(1)(a) GDPR), which you give by clicking the link in our confirmation email (double opt-in).

Unconfirmed signups are deleted automatically after 7 days. Confirmed addresses are kept until we have sent the launch email or until you withdraw your consent, whichever is first. You can withdraw consent at any time by emailing us; this does not affect processing that already took place.

To limit abuse, we store a salted hash of your IP address (not the address itself) for up to 2 hours. Legal basis: Art. 6(1)(f) GDPR.

The waitlist runs on AWS in Frankfurt (AWS Lambda and Amazon DynamoDB) and emails are sent through Amazon Simple Email Service (Amazon SES), also run by AWS in Frankfurt under the same data processing addendum. Our emails contain no tracking pixels, and their links point straight to our website. AWS records delivery events such as bounces and spam complaints, and stops sending to addresses that bounce or complain. Legal basis: our legitimate interest in reliable email delivery (Art. 6(1)(f) GDPR).

LatePilot account (Sign up with Xero)

If you sign up with Xero, we receive your name, email address and Xero user ID from Xero, the names, countries and currencies of the organisations you connect, and access tokens that let us read your sales invoices and contacts. We do not receive your Xero password. We only change something in Xero if you click “Add to Xero”: then, after you allow it in Xero, we create a draft invoice for the interest and fixed sums, which stays a draft until you approve it. We keep that draft's Xero ID and number for about 13 months to show it next to the overdue invoice. Each time you open the app we read your overdue invoices (number, customer, dates and amounts) and your customers' email addresses from Xero to show them to you and fill in reminder drafts; we don't keep copies of invoices or contacts. When you mark a reminder as sent, we store only the invoice's Xero ID, the reminder step and the time, for about 13 months.

Purpose: providing the service you asked for. Legal basis: performance of a contract with you (Art. 6(1)(b) GDPR); for your customers' details, our and your legitimate interest in collecting overdue payments (Art. 6(1)(f) GDPR). Your account and the Xero tokens (additionally encrypted) are stored on AWS in Frankfurt until you delete your account, which disconnects Xero and deletes them at once. Sign-in sessions use one strictly necessary cookie, deleted after 30 days or when you sign out. When you sign up we email the operator your name, email and organisation names through Amazon SES, so we can welcome you personally. We also send you a welcome email and two short tips, 3 and 7 days after you sign up, through Amazon SES; reply “stop” and we send no more.

Feedback

If you use the “Was this page helpful?” box, we process your answer, your message if you write one, the page and language, the time, and your email address only if you choose to give it. Purpose: improving LatePilot and replying to you if you asked. Legal basis: our legitimate interest in improving the service (Art. 6(1)(f) GDPR).

Feedback is stored on AWS in Frankfurt (Amazon DynamoDB) and deleted automatically after 12 months. Messages are also emailed to our inbox through Amazon SES; our email provider ImprovMX forwards that inbox to the operator's mailbox. The same IP-address protection as for the waitlist applies.

Access from outside the EU

LatePilot is operated from Pakistan, which the European Commission has not recognised as providing an adequate level of data protection. Waitlist data stays on AWS servers in Frankfurt; the operator accesses it from Pakistan only to send the launch email and to answer requests from you.

Your rights

You have the right to access, rectify and erase your data, to restrict or object to processing, to data portability, and to withdraw consent at any time. Email us to use any of these rights. You also have the right to lodge a complaint with a data protection supervisory authority, for example in your EU country of residence.