FinishPilot — Privacy Policy

Last updated: 22 July 2026

1. Who we are

FinishPilot ("the App", "we", "us") is operated by Stepan Zarichnyi, a sole trader based in the United Kingdom.

Contact: [email protected]

2. What this policy covers

This policy explains what personal data we collect when you use FinishPilot, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Two roles under data-protection law

When you enter a client's name, email, address or phone number, you are the Data Controller for that data and we process it only to provide the App's features to you. You are responsible for having a lawful basis for holding your clients' data.

3. Data we collect about you (the tradesperson)

3.1 Account data

• Email address (used to create and log in to your account)
• Password (stored as a secure hash by Supabase Auth — we never see it in plaintext)

3.2 Business profile data

• Business name, trading address, phone number
• Bank sort code and account number — displayed on your invoices only; we never process these for payments, never share them with a payment processor, and never charge or debit them

3.3 Project and quote data

• Room measurements, material and labour line items, project notes
• Quote and invoice documents you create in the App

3.4 Photos and AI-generated images

• Photos of rooms or finished work you upload for the AI Preview feature
• AI-generated preview images produced from those photos
• Your business logo (if uploaded)

Important — AI Preview photos: Photos you upload for AI Preview are sent to OpenAI for processing (see Section 6). Do not upload photos of identifiable individuals or photos you do not have the right to use.

3.5 Your clients' data (you enter on their behalf)

• Client name, email address, phone number, postal address
• Approval status and any notes on a quote/invoice

3.6 Referral program data

• A unique referral code generated for your account
• If you signed up using a friend's referral code, a link between your account and theirs (so we can credit them when you subscribe)
• Your Pro subscription status, used only to determine whether a referral qualifies for a reward

3.7 Technical and usage data

• App crash reports and error logs (via Expo / EAS)
• General usage patterns (e.g. which features you use) — no precise behaviour tracking or advertising profiles

4. How we use your data

We do not use your data for advertising, profiling, or sale to third parties.

5. Data about your clients

We process your clients' personal data solely to provide the App's features to you (generating quotes, approval links, invoices). We act as a Data Processor on your instruction. We do not use your clients' data for any other purpose.

Approval links are not sent by FinishPilot's servers. When you choose email, SMS or another app, FinishPilot opens the corresponding composer or share sheet on your device with the client's saved contact details and the message pre-filled. Delivery is then handled by the provider and account you choose.

You must ensure you have a lawful basis to hold your clients' data (e.g. legitimate interests or performance of a contract with them). If a client asks you to delete their data, you can use the App's delete functions or contact us at the address above.

6. Third-party processors

We use the following sub-processors. All were assessed for compliance before use:

Transfers outside the UK/EEA rely on the processor's Standard Contractual Clauses or UK IDTA where applicable.

7. Data retention

When you use the Delete Account feature in Settings, your account and all associated data (projects, photos, client data) are permanently and immediately deleted from our live systems and from Supabase Storage. Any copies held in automated backups are purged as those backups age out (within 7 days).

One exception, kept deliberately. We retain a one-way cryptographic hash of your e-mail address together with the number of free AI Previews the account had used. A hash cannot be turned back into your address and is never used to contact you, to profile you, or for any other purpose. It exists solely so the one-time free trial cannot be reset by deleting an account and signing up again with the same address — without it, the free allowance would be unlimited for anyone willing to re-register. If you create a new account with the same address, that account resumes the trial where the previous one left off. Our lawful basis is legitimate interest (preventing abuse of a free allowance), and this record is kept for as long as the app offers a free trial.

8. Your rights (UK GDPR)

You have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate data
• Erasure — delete your account and all associated data (use Settings → Delete Account, or email us)
• Restriction — ask us to pause processing in certain circumstances
• Portability — receive your data in a machine-readable format (email us)
• Object — object to processing based on legitimate interests

To exercise any right other than erasure (which is in-app), contact: [email protected]

We will respond within one calendar month as required by UK GDPR.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk / 0303 123 1113.

9. Security

We use industry-standard measures: HTTPS for all data in transit; Supabase Row-Level Security (RLS) so each user can only access their own data; bcrypt-hashed passwords; short-lived JWTs for API calls. No system is completely secure; if you discover a vulnerability please contact [email protected].

10. Children

FinishPilot is intended for use by adults running a trade business. We do not knowingly collect data from anyone under the age of 18. If you believe a child has created an account, contact us and we will delete it.

11. Changes to this policy

We will notify you of material changes by email and/or an in-app notice at least 14 days before the change takes effect. The "Last updated" date at the top will always reflect the current version.

12. Contact

Stepan Zarichnyi Email: [email protected]

This document was last reviewed: 22 July 2026