This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You.
We use Your Personal data to provide and improve the Service. By using the Service, You agree to the collection and use of information in accordance with this Privacy Policy.
About Us
PushPilot is a product operated by LEERA AI SOLUTIONS LLP (marketed as LEERA), a Limited Liability Partnership registered in India. Throughout this Privacy Policy, "Company", "We", "Us", or "Our" refers to LEERA AI SOLUTIONS LLP.
Interpretation and Definitions
Interpretation
The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.
Definitions
For the purposes of this Privacy Policy:
- Account means a unique account created for You to access our Service or parts of our Service.
- Company (referred to as either "the Company", "We", "Us" or "Our" in this Agreement) refers to LEERA AI SOLUTIONS LLP, the legal entity operating PushPilot.
- Customer means the organisation (and the individual administrators acting on its behalf) that registers for and uses a PushPilot Account to send push notifications to its own end users.
- Customer Data means Personal Data about the Customer and its administrators — for example, names, work email addresses, login credentials, billing information, and dashboard usage telemetry.
- End User means an individual who has installed a Customer's application or visits a Customer's website and to whom the Customer sends push notifications through the Service.
- End User Data means Personal Data about End Users that the Customer uploads to or transmits through the Service, including push notification tokens (FCM/APNs), subscriber identifiers, device and platform metadata, audience attributes, notification content, and delivery and engagement events.
- Data Fiduciary (referred to as “Data Controller” under the GDPR and similar regimes) is the entity that determines the purposes and means of processing Personal Data.
- Data Processor is an entity that processes Personal Data on behalf of, and on the documented instructions of, a Data Fiduciary.
- Data Principal (referred to as “Data Subject” under the GDPR) is the individual to whom Personal Data relates.
- Sub-Processor means a third party engaged by us to process Personal Data in connection with providing the Service.
- Cookies are small files that are placed on Your computer, mobile device or any other device by a website, containing the details of Your browsing history on that website among its many uses.
- Device means any device that can access the Service such as a computer, a cellphone or a digital tablet.
- Personal Data is any information that relates to an identified or identifiable individual.
- Service refers to the PushPilot website and application.
- Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself.
Our Two Roles: Data Fiduciary and Data Processor
PushPilot is a business-to-business platform. Depending on the data in question, LEERA AI SOLUTIONS LLP plays one of two distinct roles under the Digital Personal Data Protection Act, 2023 (DPDPA), the EU and UK General Data Protection Regulation (GDPR), and analogous laws:
- For Customer Data, we act as the Data Fiduciary (Data Controller). This Privacy Policy primarily governs how we handle Customer Data for our own business purposes — operating the Service, billing, support, and product communications.
- For End User Data, we act strictly as a Data Processor. The Customer is the Data Fiduciary / Controller for End User Data and is responsible for establishing a lawful basis for processing, providing notices, and obtaining any required consents from End Users. We process End User Data only on the Customer's documented instructions and only to provide the Service. We do not sell, rent, share, or use End User Data for our own marketing, for training general-purpose or public AI models, for profiling, or for any other independent commercial purpose.
Collecting and Using Customer Data
Types of Customer Data Collected
While operating an Account on the Service, we may collect:
- Account information: your name, work email address, password (stored in hashed form), organization name, role, and profile photo if provided.
- Authentication identifiers: Google OAuth identifiers when you sign in with Google.
- Billing information: billing address, GSTIN (if applicable), and a tokenized payment-method reference. Full card or bank details are handled directly by our payment processors — Polar (primary) and Razorpay (fallback for specific regions or payment methods) — and are not stored on our servers.
- Support communications: emails and chat messages you send us, along with any attachments.
- Usage Data, as described below.
Usage Data
Usage Data is collected automatically when using the Service. Usage Data may include information such as Your Device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data.
Use of Customer Data
The Company may use Customer Data for the following purposes:
- To provide, operate, secure, and maintain the Service, including monitoring usage.
- To manage your Account and your registration as a user of the Service.
- To process payments and manage subscriptions.
- To contact you by email or other equivalent forms of electronic communication for operational, security, and transactional messages.
- To provide you with product updates, special offers, and general marketing communications about PushPilot — you may opt out of marketing communications at any time.
- To manage your requests and respond to support enquiries.
- To detect, prevent, and address fraud, abuse, security incidents, and breaches of our Terms of Use.
- To comply with applicable legal obligations and enforce our agreements.
End User Data Processed on Behalf of Customers
When a Customer uses PushPilot to send push notifications or run campaigns, the Service processes End User Data on the Customer's behalf. End User Data typically includes:
- Push notification tokens (FCM, APNs) and subscriber identifiers (e.g., OneSignal Player IDs);
- Device metadata such as platform (iOS / Android / Web), OS version, language, and time zone;
- Audience attributes, tags, and segmentation data the Customer attaches to End Users;
- Notification content authored or selected by the Customer (which may be reviewed by AI services for campaign assistance, as described below);
- Delivery and engagement events (sent, delivered, opened, clicked, failed) returned by push gateways.
Our processing of End User Data is governed by these commitments:
- We process End User Data only on the Customer's documented instructions, which include the configuration of the Customer's Account, the Customer's use of the Service, and our Terms of Use.
- We do not sell, rent, or share End User Data with third parties for their own marketing or independent purposes.
- We do not use End User Data to train general-purpose or public AI models. Where AI services are invoked at the Customer's instruction to assist with campaign creation, the underlying AI providers are bound by enterprise data-processing terms that prohibit such training on customer inputs.
- Push provider credentials uploaded by Customers — including Firebase service-account JSON files and OneSignal API keys — are stored in encrypted form (Fernet/AES) and are accessible only to the systems that need them to dispatch notifications.
End Users who wish to exercise data rights with respect to End User Data should contact the Customer (the business whose app or website they received the notification from). The Customer is the Data Fiduciary / Controller for that data and is best positioned to fulfil the request. We will assist Customers in responding to such requests where required by law.
Aggregated and Anonymized Data
We may create aggregated, de-identified, or anonymized data sets from Customer Data and End User Data — for example, by combining delivery, engagement, and audience metrics across many Customers and stripping out information that identifies any individual Customer, End User, organization, or device. We may use and disclose such aggregated or anonymized data for any lawful purpose, including to:
- operate, secure, troubleshoot, and improve the Service;
- produce industry benchmarks, trend analyses, performance baselines, and research (for example, average open rates or send-time performance by app category or region);
- publish marketing or thought-leadership materials, such as “State of Push” reports;
- train and evaluate our internal models for product features such as send-time optimization or audience suggestions, subject to the AI-training restrictions described above for End User Data.
Aggregated and anonymized data is processed in a manner that does not, and is not reasonably capable of being used to, identify any individual Customer, End User, organization, or device. We will not attempt to re-identify such data, and we will not publish benchmarks or research at a level of granularity that could reasonably reveal a specific Customer's confidential metrics.
Disclosure of Data and Third-Party Services
We do not sell Personal Data. We disclose Personal Data (Customer Data or End User Data) to third parties only in the following circumstances:
- To Sub-Processors and service providers that help us deliver the Service, under contracts that restrict their use of the data to providing services to us. The principal categories of Sub-Processor are:
- Google Firebase Cloud Messaging (FCM) and Apple Push Notification service (APNs) — for delivery of push notifications to Android, iOS, and web devices.
- OneSignal — an optional delivery provider available to Customers who configure it.
- Cloud hosting and infrastructure providers — for application hosting, databases, queues, object storage, and CDN.
- Polar (polar.sh) as our primary payment processor and Razorpay as a fallback processor for specific regions or payment methods — for payment processing, subscription management, tax handling, and invoicing.
- Google Cloud Vertex AI and other AI service providers — for AI-assisted campaign content generation invoked at the Customer's request.
- Email and product-analytics providers — for transactional and product emails to Account users and for aggregate analytics on dashboard usage.
- For legal reasons — to comply with applicable law, a valid legal request from a public authority, or to enforce our agreements; to protect against fraud or security threats; or in connection with a corporate transaction such as a merger, acquisition, financing, or asset sale (in which case we will give Customers reasonable notice).
- With your consent — for any other disclosure, where you have given your express consent.
Tracking Technologies and Cookies
We and our service providers use cookies and similar tracking technologies (such as local storage and pixels) on the PushPilot website and dashboard. We use them only for the following purposes:
- Strictly necessary (essential) cookies — required for the Service to function, such as keeping you signed in, maintaining your active organization context (including the
X-Organization-IDassociation), and protecting against cross-site request forgery. These cannot be disabled without breaking core functionality. - Preference cookies — remember choices such as theme, language, and layout settings.
- Analytics cookies — help us understand how the dashboard is used in aggregate so we can improve it. We do not use analytics cookies to track End Users of our Customers' apps or websites.
Most browsers let you refuse or delete cookies via their settings. If you disable essential cookies, parts of the Service may stop functioning. We do not currently respond to “Do Not Track” signals because no common industry standard has been finalized.
Retention of Your Data
Customer Data is retained for as long as your Account is active and for a reasonable period thereafter, in line with our Terms of Use. Following termination of your Account, Customer Data is retained for thirty (30) days to allow for reactivation or export, after which it is deleted or anonymized from our active systems. Encrypted backups may persist for a limited additional period as part of our standard backup-rotation schedule and will be overwritten on rotation.
End User Data is retained for as long as the Customer's Account is active and the Customer has not deleted it. The Customer controls the retention of End User Data within the Service and may delete subscribers, campaigns, and event logs at any time. Following termination of the Customer's Account, End User Data is subject to the same thirty (30)-day deletion window described above.
We may retain certain data for longer where required to comply with legal obligations, resolve disputes, prevent fraud or abuse, or enforce our agreements.
Security of Your Personal Data
We implement reasonable technical and organizational measures designed to protect Personal Data, including encryption in transit (TLS), encryption of sensitive credentials at rest, role-based access controls, audit logging, and regular review of our Sub-Processors. However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.
Your Data Rights
Subject to applicable law — including the Digital Personal Data Protection Act, 2023 (DPDPA) in India, the EU and UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and equivalent regimes — you have the following rights with respect to your Personal Data:
- Right to access: to obtain a copy of the Personal Data we hold about you and information about how we process it.
- Right to correction (rectification): to ask us to correct inaccurate or incomplete Personal Data.
- Right to erasure (deletion / “right to be forgotten”): to ask us to delete your Personal Data, subject to our legal obligations to retain certain records.
- Right to withdraw consent: where processing is based on your consent, to withdraw that consent at any time without affecting the lawfulness of prior processing.
- Right to opt out of marketing communications: by using the unsubscribe link in our marketing emails or by emailing us. You will continue to receive operational, security, and transactional messages relating to your Account.
- Right to nominate (DPDPA): to nominate another individual to exercise your rights in the event of your death or incapacity.
- Right to data portability (where applicable under GDPR and similar regimes): to receive certain Personal Data in a structured, commonly used, machine-readable format.
- Right to lodge a complaint with the Data Protection Board of India, your local supervisory authority, or any other competent regulator.
To exercise any of these rights with respect to Customer Data, email us at info@pushpilot.ai from the email address associated with your Account. We may need to verify your identity before fulfilling your request and will respond within the timeframes required by applicable law.
If you are an End User whose data has been processed through PushPilot by one of our Customers, please direct your request to that Customer (the business whose app or website you received the notification from). They are the Data Fiduciary / Controller for that data and are best positioned to fulfil your request. We will assist Customers in responding to such requests as required by law.
International Data Transfers
We are based in India, and our Sub-Processors may be located in India, the United States, the European Union, the United Kingdom, or other jurisdictions. When Personal Data is transferred internationally, we rely on appropriate safeguards, such as the service provider's contractual data-protection commitments and, where applicable, Standard Contractual Clauses or other transfer mechanisms recognized under the relevant law.
Children's Privacy
PushPilot is a business-to-business product and is not directed to children under the age of 18 (or the equivalent minimum age under applicable law). We do not knowingly collect Personal Data directly from children. Customers are responsible for ensuring that, where their campaigns may reach minors, they obtain any verifiable parental consent required by applicable law.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our practices, the Service, or applicable law. We will notify you of material changes by posting the updated Privacy Policy on this page and updating the “Last updated” date at the top. Where the change is material, we will provide additional notice (for example, by email or an in-product notification) before it takes effect. You are advised to review this Privacy Policy periodically.
Grievance Officer and Data Protection Contact
In accordance with the Information Technology Act, 2000 and the rules made thereunder, and the Digital Personal Data Protection Act, 2023, the designated contact for grievances and data-protection enquiries is:
- Entity: LEERA AI SOLUTIONS LLP
- Product: PushPilot
- Designated Role: Privacy Lead, PushPilot
- Email: info@pushpilot.ai (please use the subject line “Privacy Request” or “Grievance” for faster routing)
The Privacy Lead is the point of contact for: complaints under the IT Act and DPDPA, Data Principal rights requests, Sub-Processor enquiries, and data-incident reporting. We will acknowledge complaints within a reasonable period of receipt and endeavour to resolve them within the timeframes required by applicable law.
Contact Us
If you have any questions about this Privacy Policy, you can contact us:
- By email: info@pushpilot.ai
- Company Name: LEERA AI SOLUTIONS LLP
- Product: PushPilot