Data Processing Agreement

This Data Processing Agreement (“DPA”) is between PILOTLAB LLC, a Wyoming limited liability company, doing business as PilotLookup (“PilotLookup”, “we”, “us”), 1309 Coffeen Ave Ste 1200, Sheridan, WY 82801, United States, and the customer identified on the account (“you”).

It applies automatically, with no signature required, whenever you submit personal data to the service as a controller. It is incorporated into the Terms of Service. If you need a countersigned copy for your records, email privacy@pilotlookup.net.

Precedence. If this DPA and the Terms of Service conflict on anything concerning data protection, this DPA prevails.

For the phone numbers you submit and the results we return, you are the controller and we are the processor. You decide which numbers are looked up and why; we act on your instructions.

For your account, billing, website and security data we act as a controller in our own right. That is governed by the Privacy Policy, not by this DPA.

You confirm that you have a lawful basis for each number you submit, that you have given any privacy notice required of you, and that your instructions do not put us in breach of data protection law.

We process personal data only on your documented instructions, which consist of this DPA, the Terms of Service, and your use of the service’s features. We will not process it for our own purposes, and we will not sell it or use it to train models.

If law requires us to process beyond your instructions, we will tell you before doing so unless that law forbids it. If we think an instruction breaches data protection law, we will tell you.

Everyone we authorise to process the data is bound by a duty of confidentiality and has been instructed on handling it. Access is limited to those who need it to run or support the service.

We implement the technical and organisational measures in Annex II, taking account of the state of the art, the cost of implementation, and the risk to individuals. We may update them, but not in a way that materially reduces security.

You give us general authorisation to engage sub-processors. We impose data protection obligations on each of them that are no less protective than this DPA, and we remain liable to you for their performance.

The current named list is available on written request to privacy@pilotlookup.net. We provide it as confidential information, which you may not disclose to third parties. The categories and countries are published in Annex III.

We give 30 days’ notice by email before adding or replacing a sub-processor, to customers who have asked to be notified. Ask to be added to that list at the address above. You may object on reasonable data protection grounds within those 30 days; we will work with you to find a solution, and if we cannot, you may terminate the affected part of the service and receive a refund of unused credits.

Requests from individuals. If someone contacts us directly about data you submitted, we will not respond substantively; we will forward the request to you without undue delay. Taking account of the nature of the processing, we will give you reasonable technical assistance to answer it.

Impact assessments. We will give you reasonable assistance with data protection impact assessments and prior consultations with a supervisory authority, limited to information about our processing that you do not already have.

We will notify you without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting data we process for you.

The notice will describe the nature of the breach, the categories and approximate number of records affected, the likely consequences, the measures taken or proposed, and a contact point. Where we cannot provide all of it at once, we will provide it in phases without further undue delay. We will not make a public statement identifying you without your consent unless law requires it.

We will make available the information needed to demonstrate compliance with this DPA, including this document, Annex II, and written answers to reasonable security questionnaires.

You may audit us, or appoint an independent auditor who is not our competitor and who is bound by confidentiality. Audits take place on at least 30 days’ written notice, no more than once in any 12 months (except after a breach or where a supervisory authority requires it), during business hours, without unreasonable disruption, and at your cost.

You can export your data at any time while the account is open, through the dashboard or the API.

After termination we delete the personal data you submitted within 30 days, unless law requires us to keep it. Billing records are retained for 7 years for US tax purposes; they contain the amount, date and payer email, not the numbers you looked up.

You do not have to wait for termination. Delete my data in Settings erases your usage logs and batch files immediately while keeping the account and credits, and deleting the account removes the account data at once.

The application and the records it holds are hosted in the European Union. Some sub-processors are in the United States, and our support and engineering staff, including team members in Pakistan, may access data remotely.

Where personal data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, the European Commission’s Standard Contractual Clauses (Decision 2021/914) are incorporated into this DPA by reference: Module Two (controller to processor) between you and us, and Module Three (processor to sub-processor) between us and our sub-processors. The UK International Data Transfer Addendum applies to UK transfers, and the Swiss amendments — with the Federal Data Protection and Information Commissioner as supervisory authority and Swiss law where the transfer is governed by it — apply to Swiss transfers.

For the purposes of the Clauses: Annexes I, II and III below populate Annexes I, II and III of the Clauses; the optional docking clause applies; the audit terms in clause 8 above apply; and the governing law and forum for the Clauses are those of Ireland, as the Clauses require an EU member state. Where a US sub-processor is certified under the EU-U.S. Data Privacy Framework, we may rely on that certification instead for transfers to that sub-processor. PILOTLAB LLC itself is not certified under the Data Privacy Framework.

These are the measures actually in place. We do not list anything we have not implemented.

• Encryption in transit. All traffic to the site and API is served over TLS with certificates from a public certificate authority. Plain HTTP is redirected.
• Credential storage. Account passwords and API keys are stored only as salted one-way hashes, using an algorithm designed for password storage. Neither we nor anyone reading the stored data can recover them. Only a short non-secret prefix of an API key is kept in readable form, so you can tell your keys apart.
• Session handling. Session cookies are HTTP-only and SameSite-scoped, cannot be read by JavaScript, and expire 7 days after sign-in. Suspending an account invalidates its sessions immediately.
• Network isolation. The data store and cache are not reachable from the internet. Only the public web endpoint is exposed, behind TLS termination.
• Access control. Administrative functions are separated from ordinary accounts and restricted to named administrators. Staff access is limited to those who need it to run or support the service, under a duty of confidentiality.
• Logging. Sign-in, account and administrative events are recorded with their source IP address, giving an audit trail of who did what.
• Abuse limits. Requests are rate limited per API key and per IP address, and origins are checked on the public demo endpoint.
• Transport hardening. Standard browser security headers are applied at the edge.
• Data minimisation by design. The service never receives or returns subscriber identity. Results describe a line — carrier, type, registered location — and contain no names or addresses, so the data we hold about any individual is inherently limited.
• Deletion controls. You can erase usage logs and stored batch files yourself at any time, which removes both the records and the stored files.

Not claimed: we hold no SOC 2 or ISO 27001 certification, and PILOTLAB LLC is not certified under the Data Privacy Framework. We would rather you knew that than discovered it during due diligence.

Published by category and country. The named list is confidential and available on written request to privacy@pilotlookup.net.

Note that only the hosting and object storage providers process the numbers you submit. The payment, email and analytics providers never receive them.

Data protection enquiries: privacy@pilotlookup.net · PILOTLAB LLC, 1309 Coffeen Ave Ste 1200, Sheridan, WY 82801, United States.