Privacy Policy

AI Asset Pilot · ai-asset-pilot.com · Effective August 11, 2026 · Last updated August 19, 2026

AI Asset Pilot ("the Platform", "we") is a private real-estate asset-management platform used internally by our own team to manage the properties we own and operate. It is not a public consumer service and is not offered to third-party businesses. This policy describes what information the Platform processes and how it is protected.

Information we process

• Team accounts. Authorized team members sign in with Google. We store the name, email address, and profile picture associated with the Google account, plus role and session records.
• Business records. Property-level operating data we create and manage ourselves: budgets, financial statements, rent rolls, leases, capital projects, tasks, and related documents.
• Connected services (authorized by the account owner). QuickBooks Online (company information, purchases, bills, and financial reports from our own company files); Google Drive and Gmail (property documents and correspondence belonging to our own organization).

How we use information

Information is used solely to operate the Platform for our own asset management: dashboards, budget-versus-actual reporting, capital-expenditure tracking, document search, and an internal AI assistant that answers questions for authorized team members. We do not sell personal or business information, do not share it with third parties for their own marketing, and do not serve advertising.

QuickBooks Online data

When the account owner connects a QuickBooks Online company, the Platform reads accounting records (company info, purchases, bills, and reports) from that company via Intuit's official API, solely to display and reconcile our own financial records inside the Platform. OAuth tokens are encrypted at rest with AES-256-GCM and are never exposed to browsers. Disconnecting the integration revokes the tokens with Intuit. Our use of Intuit APIs complies with Intuit's developer terms.

Google user data

AI Asset Pilot accesses Google user data only through Google's official APIs, only with each user's explicit consent, and only for the specific scopes listed below. We access no other Google data.

• Basic profile (openid, email, profile) — requested at sign-in. We use the name, email address, and profile picture solely to authenticate the user, create their account, and display who is signed in. This data is never used for any other purpose.
• Email drafts — the Platform never sends email. When a team member asks the Platform to prepare an email, it saves a draft in that member's own company mailbox (gmail.compose, authorized by the organization's Google Workspace administrator) or opens Gmail's own compose window. The team member reviews the draft and presses Send in Gmail themselves. The Platform does not request the gmail.send scope.
• Read email (gmail.readonly) — requested in the same opt-in connection. Used solely to retrieve replies to correspondence threads that were started from the Platform, so the conversation can be displayed alongside the related property record. The Platform does not scan, index, or store the user's general mailbox.

Storage and protection. Google OAuth refresh tokens are encrypted at rest with AES-256-GCM on our privately managed server and are never exposed to browsers or third parties. Retrieved message content is stored only when it belongs to a Platform-initiated correspondence thread, within our own database.

Sharing. Google user data is never sold, never transferred to third parties, never used for advertising, and never used to determine creditworthiness or for lending purposes. No humans read Google user data obtained through these scopes except the users of the account it belongs to and, where necessary, for security, compliance with law, or with the user's explicit consent to troubleshoot an issue.

No AI/ML training. Google user data is not used to develop, improve, or train generalized artificial intelligence or machine-learning models.

Retention and revocation. Gmail access remains active only while the user keeps the connection. A user can revoke access at any time from their Google Account security settings, which immediately invalidates the stored token; we delete stored tokens on revocation or account deactivation, and delete correspondence data on request (see Retention and deletion below).

AI Asset Pilot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Infrastructure and sub-processors

Data is stored in our own database on a privately managed server, transmitted exclusively over HTTPS. AI assistant features may transmit the specific content needed to answer an authorized user's question to our AI provider (Anthropic) for processing; that content is not used to train third-party models under our agreements. No other third parties receive Platform data.

Security

Role-based access control across the Platform; encrypted OAuth tokens at rest; revocable sessions; least-privilege access to connected services (read-only scopes where available).

Retention and deletion

Records are retained while they remain part of our business records or while the related account or integration is active. Team members and counterparties may request deletion of their personal information by contacting us; we honor such requests unless retention is required for legal or accounting purposes.

Contact

Questions or requests about this policy: [email protected]. Material changes to this policy will be posted on this page.