JAKOV360 · ImportPilot AI
Privacy Policy
Last updated: October 28, 2026
JAKOV360 operates ImportPilot at jakov360.com. This policy explains what information ImportPilot processes, why it is used, and the choices available to you. For privacy questions or requests, contact privacy@jakov360.com.
1. Information we process
- Account information: name, email address, organization name, and account/session records.
- Email/password accounts: passwords are stored only as password hashes, not as readable passwords.
- Google Sign-In: ImportPilot requests only the OpenID Connect scopes
openid email profile. We receive your Google account identifier, verified email address, and name. The Google access token is used transiently to retrieve this identity and is not stored in the ImportPilot database. - Optional connected Gmail: mailbox address, verified Google account identifier, Gmail send permission and a server-encrypted refresh token. When you approve sending a supplier message, JAKOV360 keeps an audit record of the sender, recipient, subject, approved body hash, Google message/thread identifiers and timestamps. These records support duplicate-send prevention and linkage with the supplier project. Gmail accepting a send request does not guarantee delivery to the recipient. This is separate from Google Sign-In, is disabled by default and in public production, and may be enabled only for designated acceptance-test accounts; sending always requires explicit approval of the recipient and final message.
- Sourcing and business data: product searches, quantities, destinations, supplier links and evidence, selected offers, commercial terms you confirm, landed-cost inputs and calculations, and decision history.
- Technical and security data: essential session cookies, short-lived OAuth state/PKCE cookies, timestamps, request/error information, and operational logs needed to run, secure, and troubleshoot the service.
2. How we use information
We use information only to:
- create, authenticate, and secure your account;
- link Google Sign-In to an existing ImportPilot account when the verified email matches;
- perform supplier search, offer comparison, landed-cost calculations, and decision support;
- save the projects and results you choose to keep;
- operate, troubleshoot, protect, and improve ImportPilot.
3. Google user data
Google Sign-In does not request access to Gmail, Google Drive, Google Calendar, contacts, or other Google content; it requests only identity information. A separate optional Gmail connection would request Gmail send-only permission, not permission to read the inbox. It is currently disabled in public production. Separate acceptance testing may be enabled for designated test accounts only. When enabled, an organization owner or administrator can explicitly authorize JAKOV360 to send reviewed supplier messages from a chosen mailbox. The connected mailbox address and its encrypted OAuth refresh credential are stored for this connection. A user may disconnect the mailbox, which deletes usable local credentials and attempts provider revocation. Connection metadata can be kept for audit and support. Future automatic reading of supplier replies would require a separate read-only permission, additional disclosure and applicable Google verification before activation. Google profile and mailbox data are not used for advertising or sold to advertisers.
4. Service providers and external sources
ImportPilot uses infrastructure and service providers to host the application and database, perform authentication, run supplier-search and supplier-page enrichment, and maintain recovery/security capabilities. Supplier and marketplace links may lead to third-party websites with their own privacy practices. We do not sell personal information.
5. Cookies and sessions
ImportPilot 1.0 uses cookies that are necessary for authentication and security, including the application session and short-lived Google OAuth state/PKCE cookies. ImportPilot 1.0 does not use advertising cookies for Google Sign-In data.
6. Retention and deletion
Account and project data is retained while needed to provide the service, meet security and recovery needs, or comply with applicable obligations. Operational backups and logs may remain for a limited recovery or security period. You can request access, correction, or deletion by emailing privacy@jakov360.com.
7. Security
We use HTTPS, access controls, secure session handling, OAuth PKCE/state protections, database access controls, and backup/recovery procedures. No online service can guarantee absolute security.
8. Your rights
Depending on applicable law, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal data associated with your account. Send requests to privacy@jakov360.com.
9. Changes to this policy
We may update this policy when ImportPilot or its data practices change. The current version and effective date will remain published at this URL.