Privacy Policy.

1. Who we are.

Autopilot Pte. Ltd. ("Autopilot", "we", "us", "our") is a business architecture consultancy registered in Singapore. This privacy policy explains how we collect, use, store, and protect your personal data when you visit our website, use our services, or communicate with us.

2. What data we collect.

When you contact us through our website

• Name (required)
• Email address (required)
• Company name (optional)
• Message content (required)

When you take the diagnostic

• Diagnostic responses (anonymous unless you request the PDF)
• Name and email address only if you request the PDF

When you visit our website

• Browser type and version, operating system, device type, referring website, pages visited, time spent

We use Plausible Analytics, a cookieless, privacy-respecting tool. We don't store IP addresses, don't set tracking cookies, and don't build profiles of individual visitors. Aggregate, anonymous traffic patterns only.

3. How we use your data.

• To respond to enquiries. When you submit a contact form, your information is stored in our CRM so we can respond and manage our relationship with you.
• To improve our website. Aggregate analytics help us understand which pages are useful and where the site can be clearer.
• To comply with legal obligations. We may process your data where required by law.

We don't sell, rent, or share your personal data with third parties for their marketing purposes. We don't run a newsletter or marketing list.

4. Legal basis for processing.

• Consent. When you submit a contact form, you consent to our processing of your data for the stated purposes.
• Legitimate interests. We process aggregate, anonymous traffic data to maintain and improve our website. No personal data is involved in this analysis.
• Legal obligation. Where we are required by law to retain or disclose data.

5. Data storage and security.

Your data is stored on secure servers provided by our website platform (Odoo SA, EU-hosted). We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction.

Contact form submissions are stored in our CRM hosted by Odoo SA. Plausible Analytics is also delivered through Odoo's EU-hosted proxy and processes no personal data.

6. Data retention.

• Contact form data: retained for the duration of our business relationship plus three years, unless you request earlier deletion.
• Diagnostic responses with email (PDF requests): retained for 12 months, then automatically deleted.
• Aggregate analytics: Plausible retains anonymous, aggregated counts indefinitely; no individual identifiers exist to delete.

7. Your rights.

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: request correction of inaccurate or incomplete data.
• Deletion: request deletion of your personal data.
• Restriction: request restriction of processing of your data.
• Portability: request transfer of your data in a structured, commonly used format.
• Objection: object to processing based on legitimate interests.
• Withdrawal of consent: withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us using the details in Section 10.

8. Cookies.

We use only strictly-necessary cookies. These are set by Odoo SA to keep the website running (session management, security, CSRF protection). We don't use analytics cookies, tracking cookies, or advertising cookies. Plausible Analytics is cookieless by design.

You can block all cookies through your browser settings. Disabling strictly-necessary cookies may affect website functionality such as form submissions.

9. Third-party services.

Service	Purpose	Data processed
Odoo SA (Belgium)	Website hosting, CRM, contact-form processing	Contact form data, diagnostic responses
Plausible (via Odoo SaaS proxy)	Privacy-respecting analytics	Aggregate, anonymous traffic counts only. No IP, no cookies, no profiles
Google Fonts	Typography rendering	IP address (for font delivery)

Each of these providers has their own privacy policy governing their processing of your data.

Functional cookies in detail. Beyond the strictly-necessary session cookies, our website may set a small tz cookie storing your IANA timezone string (e.g. Asia/Singapore). This is used to display dates and times correctly to you and contains no identifying information.

10. Contact us.

If you have questions about this privacy policy or wish to exercise your data rights, contact us:

11. Changes to this policy.

We may update this privacy policy from time to time. Material changes will be communicated through our website. The "Last updated" date at the top of this policy indicates when it was last revised.

12. Singapore Personal Data Protection Act (PDPA).

Autopilot Pte. Ltd. complies with the Singapore Personal Data Protection Act 2012 (PDPA). Under the PDPA, we are obligated to:

• Obtain consent before collecting, using, or disclosing personal data
• Allow individuals to withdraw consent
• Provide access to and correction of personal data upon request
• Protect personal data in our possession with reasonable security arrangements
• Retain personal data only for as long as it is needed for business or legal purposes

Our Data Protection Officer can be contacted at the email address listed in Section 10.

13. EU General Data Protection Regulation (GDPR).

Where you are located in the European Economic Area or the United Kingdom, the EU General Data Protection Regulation (Regulation 2016/679) applies to our processing of your personal data. The lawful bases set out in Section 4 of this policy align with Article 6 GDPR (consent, legitimate interests, legal obligation). The data subject rights set out in Section 7 align with Articles 15 to 22 GDPR. Our lead supervisory authority for cross-border matters is the relevant national data protection authority of the country where you reside; you have the right to lodge a complaint there.

International transfer mechanism: contact form data may be processed in Singapore (where Autopilot Pte. Ltd. is based) and Belgium (where our hosting provider Odoo SA operates). Singapore is recognised by the European Commission as providing an adequate level of protection for personal data; Belgium is within the EEA.

14. Southeast Asian data protection regimes.

This site is offered to business owners across Southeast Asia. The following jurisdictional regimes may apply to your personal data depending on where you reside:

• Thailand. Personal Data Protection Act B.E. 2562 (PDPA Thailand). Notice and consent collected through this site satisfy s.19 of the Thai PDPA.
• Philippines. Data Privacy Act of 2012 (Republic Act 10173) and its Implementing Rules. Our processing aligns with the principles of transparency, legitimate purpose, and proportionality set out in s.11.
• Indonesia. Personal Data Protection Law (Undang-Undang Pelindungan Data Pribadi, UU 27/2022). Cross-border transfer to Singapore is permitted on the basis of consent and adequate protection.
• Vietnam. Decree 13/2023/ND-CP on Personal Data Protection. We process your data on the basis of your consent recorded at the point of submission.
• Malaysia. Personal Data Protection Act 2010 (PDPA Malaysia). The principles of notice, choice, and consent set out in s.5 apply to our handling of your data.

The Data Protection Officer named in Section 10 is your point of contact for any of these regimes.