Backpilot
Privacy Policy
Last updated 16 September 2026
This policy explains what information Backpilot (Pty) Ltd(“Backpilot”, “we”, “us”) collects, why, how we protect it, and the rights you have. It is written to meet the Protection of Personal Information Act, 2013 (POPIA). By using Backpilot you agree to the handling of information as set out here.
Who we are
Backpilot is a business-intelligence service for South African businesses. We take the records a business already produces — sales, stock, supplier invoices, customer accounts — and turn them into clear views, alerts and advice, including through our AI assistant, Arthur.
- Backpilot (Pty) Ltd, registration 2026/474092/07
- 20A Protea Road, Dana Bay, Mossel Bay, 6510, South Africa
- Information Officer: Bruce Downing — privacy@backpilot.co
Two roles we play
As responsible party:for information about our own clients and the people who run them — the account holder’s name, email, and login — we decide the purpose and means, and this policy governs that directly.
As operator:most of what flows through Backpilot is a client’s own business data, which may include personal information about theircustomers, suppliers and staff (for example a customer’s name and phone number on an invoice). For that data our client is the responsible party and we act as their operator — we process it only on their documented instruction, only to provide the service, and never for our own purposes. We do not sell it, share it, or use it to build anything outside that client’s own account.
What we collect
- Account information: the name, email address and login credentials of the person who uses the portal.
- Business records: sales and transaction data, stock levels, supplier invoices and, for clients on the relevant tier, customer accounts — drawn from the systems a client already uses (their point-of-sale, their accounting software, documents they send us).
- Personal information within those records: where a client’s own records contain personal information of third parties (a customer’s name and contact number, a supplier contact), we process it as part of the record, on the client’s behalf.
- Questions you ask Arthur: the messages exchanged with the AI assistant, kept so it can hold context and improve its answers for you.
- Basic technical logs: standard information our hosting produces to keep the service secure and running.
We collect only what the service needs. We do not gather special-category information, and we do not process children’s information.
Why we process it
- To provide the dashboards, alerts, reports and AI answers that are the service.
- To connect to the systems a client asks us to read from, and keep their portal current.
- To secure the service, support our clients, and meet our legal obligations.
We rely on the lawful bases in POPIA: performance of our contract with the client, our legitimate interests in running and securing the service, consent where it applies, and compliance with the law. A client’s business data is processed on the basis of our agreement with that client.
Who we share it with
We do not sell personal information and we do not share it for anyone else’s marketing. We use a small number of trusted service providers (operators) to run Backpilot, each bound to protect the information and use it only to provide their service to us:
- Supabase — secure database hosting, where the data is stored (encrypted at rest).
- Vercel — hosting for the application itself.
- Anthropic — provides Claude, the AI model behind Arthur. When you ask Arthur a question, the relevant data is sent to Anthropic’s API to generate the answer. Anthropic does not use data submitted through its API to train its models.
- Google (Workspace) — for operational documents and generated reports.
We may also disclose information if the law requires it, or to protect our rights, safety, or the integrity of the service.
Information sent outside South Africa
Some of the providers above process data on servers outside South Africa (for example in the United States or the European Union). Where personal information is transferred across a border, we do so only as POPIA permits — the recipient is bound by agreements and safeguards that give the information a level of protection comparable to POPIA. By using the service you acknowledge these transfers, which are necessary to provide it.
How we protect it
- All traffic to and from Backpilot is encrypted in transit (HTTPS).
- Data is encrypted at rest in our hosting infrastructure.
- Each client’s data is isolated at the database level, so one client can never see another’s.
- Connection credentials to clients’ own systems are held in an encrypted vault, not in plain text.
- We read from clients’ systems; we do not write back into their accounting or point-of-sale.
- Access to production data is limited to the founders who operate the service.
No system is perfectly secure, but we take reasonable and appropriate measures, and keep them under review.
How long we keep it
We keep information for as long as we provide the service to the client it belongs to. When a client ends the relationship, we return their data and then delete it from our active systems, save where the law requires us to keep a record for longer. We never keep personal information longer than we need it.
Your rights
Under POPIA you may:
- ask what personal information we hold about you and request a copy;
- ask us to correct or delete information that is wrong, misleading or no longer needed;
- object to processing in certain circumstances; and
- complain to the Information Regulator.
Where the information is a client’s business data and we act as their operator, we will refer your request to that client (the responsible party) and support them in answering it. To exercise any right, contact our Information Officer at privacy@backpilot.co.
The Information Regulator
You have the right to complain to the Information Regulator of South Africa: The Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 — inforegulator.org.za, POPIAComplaints@inforegulator.org.za.
Changes to this policy
We may update this policy from time to time. The date at the top shows when it last changed, and material changes will be made clear on this page.
Contact us
For any privacy question or request, contact our Information Officer, Bruce Downing, at privacy@backpilot.co, or write to us at 20A Protea Road, Dana Bay, Mossel Bay, 6510, South Africa.