Last updated: 22 July 2026
FinishPilot ("the App", "we", "us") is operated by Stepan Zarichnyi, a sole trader based in the United Kingdom.
Contact: stepnice1009@gmail.com
This policy explains what personal data we collect when you use FinishPilot, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
| Role | Who | What data |
|---|---|---|
| Data Controller (us) | FinishPilot / the operator | Your account data, photos, usage data |
| Data Processor (us, on your behalf) | FinishPilot | Your clients' personal data that you enter into the App |
When you enter a client's name, email, address or phone number, you are the Data Controller for that data and we process it only to provide the App's features to you. You are responsible for having a lawful basis for holding your clients' data.
Important — AI Preview photos: Photos you upload for AI Preview are sent to OpenAI for processing (see Section 6). Do not upload photos of identifiable individuals or photos you do not have the right to use.
| Purpose | Lawful basis |
|---|---|
| Providing the App (accounts, projects, quotes, invoices, approval links) | Contract — necessary to deliver the service you've signed up for |
| AI Preview — sending your photo to OpenAI and returning a generated image | Contract — you explicitly trigger this feature |
| Displaying your bank details on your own invoices | Contract |
| Sending account emails (sign-up confirmation and password reset) | Contract |
| Fixing bugs and improving reliability (crash logs) | Legitimate interests |
| Complying with legal obligations | Legal obligation |
We do not use your data for advertising, profiling, or sale to third parties.
We process your clients' personal data solely to provide the App's features to you (generating quotes, approval links, invoices). We act as a Data Processor on your instruction. We do not use your clients' data for any other purpose.
Approval links are not sent by FinishPilot's servers. When you choose email, SMS or another app, FinishPilot opens the corresponding composer or share sheet on your device with the client's saved contact details and the message pre-filled. Delivery is then handled by the provider and account you choose.
You must ensure you have a lawful basis to hold your clients' data (e.g. legitimate interests or performance of a contract with them). If a client asks you to delete their data, you can use the App's delete functions or contact us at the address above.
We use the following sub-processors. All were assessed for compliance before use:
| Processor | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database, file storage, authentication | United Kingdom (AWS eu-west-2 — London) |
| OpenAI, LLC | AI Preview image generation (your uploaded photos are sent to OpenAI's API) | USA — OpenAI's API data usage policies apply; as of the date of this policy OpenAI does not use API inputs to train models by default |
| Expo / EAS (Expo Inc.) | App distribution, crash reporting | USA |
| Apple Inc. | App Store distribution, in-app purchases (iOS) | USA |
| Google LLC | Play Store distribution, in-app purchases (Android) | USA |
| RevenueCat, Inc. | Manages your Pro subscription status (validates your Apple/Google purchase receipt; does not process payment card details) | USA |
| Resend (Plus Five Five, Inc.) | Account email delivery used by Supabase Auth (sign-up confirmation and password reset), and delivery of the messages you send with “Report a problem” — which carry your message text and your e-mail address so we can reply | USA |
Transfers outside the UK/EEA rely on the processor's Standard Contractual Clauses or UK IDTA where applicable.
| Data | Retention |
|---|---|
| Account and business profile | Until you delete your account |
| Projects, quotes, invoices, photos, AI previews | Until you delete the project or your account |
| Crash and error logs | 30 days rolling |
| Automated database backups | Up to 7 days (Supabase daily backups), then overwritten |
When you use the Delete Account feature in Settings, your account and all associated data (projects, photos, client data) are permanently and immediately deleted from our live systems and from Supabase Storage. Any copies held in automated backups are purged as those backups age out (within 7 days).
One exception, kept deliberately. We retain a one-way cryptographic hash of your e-mail address together with the number of free AI Previews the account had used. A hash cannot be turned back into your address and is never used to contact you, to profile you, or for any other purpose. It exists solely so the one-time free trial cannot be reset by deleting an account and signing up again with the same address — without it, the free allowance would be unlimited for anyone willing to re-register. If you create a new account with the same address, that account resumes the trial where the previous one left off. Our lawful basis is legitimate interest (preventing abuse of a free allowance), and this record is kept for as long as the app offers a free trial.
You have the right to:
To exercise any right other than erasure (which is in-app), contact: stepnice1009@gmail.com
We will respond within one calendar month as required by UK GDPR.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk / 0303 123 1113.
We use industry-standard measures: HTTPS for all data in transit; Supabase Row-Level Security (RLS) so each user can only access their own data; bcrypt-hashed passwords; short-lived JWTs for API calls. No system is completely secure; if you discover a vulnerability please contact stepnice1009@gmail.com.
FinishPilot is intended for use by adults running a trade business. We do not knowingly collect data from anyone under the age of 18. If you believe a child has created an account, contact us and we will delete it.
We will notify you of material changes by email and/or an in-app notice at least 14 days before the change takes effect. The "Last updated" date at the top will always reflect the current version.
Stepan Zarichnyi Email: stepnice1009@gmail.com
This document was last reviewed: 22 July 2026