Privacy

Last updated: 14 November 2026. This policy covers the Delivery Autopilot product at app.dutopilot.com and this website, dutopilot.com, including the cookies and analytics described below.

Controller: Dutopilot Ltd, registered office in London WC2, United Kingdom.

The product: data we collect and why

Delivery Autopilot runs on our managed infrastructure in Microsoft Azure, in the West Europe region, with backups in North Europe. Here is what we process, why, where it is kept and who receives it.

Sign-in email and display name

You sign in with your email address. We use it to identify you and to control access to your company's account. An optional display name, up to 80 characters, is quoted in invitation and access emails. Both are stored in Azure Table storage in West Europe. Your sign-in profile, project memberships and invitations, ticket history, the record of ticket status changes and usage metrics are not deleted automatically today. We delete them when you or your company asks us to (see Your rights).

Sign-in codes and sessions

We email a 6-digit code when you sign in. The code is stored only as a hash, is valid for 10 minutes and works once. After you sign in, a session cookie (__Host-autopilot_session) keeps you signed in and expires after 7 days without use, and signing out deletes it at once. A separate cookie (__Host-autopilot_theme) remembers your light or dark theme preference for a year. We do not store IP addresses or browser details with sessions.

Rate-limit pseudonyms

To prevent abuse, requests are rate limited using a pseudonym derived from your IP address. The raw IP address is not stored.

Tracker content

To work your tickets, the product reads and stores ticket titles, bodies, comments and replies, labels, URLs and, where present, GitHub or Jira user logins, from the tracker you connect (GitHub Issues, Notion or Jira). This is stored in Azure Table storage in West Europe.

Repository source code

Your source code is processed only inside a sandbox, an isolated micro-VM (Kata) that is discarded after the ticket. The control plane never keeps a copy of your repository.

Run logs, screenshots, diffs and gate artifacts

Each run keeps its logs, screenshots, diffs and gate reports in your company's own storage container, deleted after 90 days. Sandbox output never reaches our control-plane logs.

Human commands

Who ran a command and what it said, the actor's email and the text, is kept for 30 days.

Encrypted credentials

Credentials you supply, for AI providers, trackers and other integrations, are stored encrypted with AES-256-GCM and used only to connect to those services. They are kept until you clear them or your company's account is removed.

Email delivery

Sign-in codes, access notices, invitations and status alerts are sent through SendGrid over HTTPS.

The product: retention

Run logs, screenshots, diffs and gate artifacts are deleted after 90 days. Human commands are kept for 30 days. Control-plane logs are kept for 30 days. Tables are backed up hourly and snapshots are kept for 35 days, so data deleted from the live service can persist in backups for up to 35 days, and backed-up run records for up to 90 days. Your sign-in profile, project memberships and invitations, ticket history, the record of ticket status changes and usage metrics are not deleted automatically today. We delete them when you or your company asks us to (see Your rights).

The control plane never keeps a copy of your repository. Code is processed in a per-ticket sandbox that is discarded after the ticket. Run logs and gate artifacts can contain code the agent read, and we keep an installed dependency cache and a scan record of your default branch. All of these are deleted after 90 days.

The product: who receives data

Sub-processors

We use these sub-processors:

• Microsoft Azure, for hosting and storage.
• Twilio SendGrid, for sign-in emails.

Services you connect

• GitHub, as your code host and tracker, through the Delivery Autopilot GitHub App.
• Notion and Jira (Atlassian), as trackers, where you choose them.
• The AI providers you choose, such as Anthropic and OpenAI, used under your own account and their terms, so the provider receives ticket text and repository content under your account's terms with that provider.
• Optional SEO integrations: Google Search Console, Microsoft Clarity and DataForSEO, connected with your own accounts and credentials.

Your rights

You can ask for access to your data, ask us to correct it, ask for deletion, ask for an export, object to processing, and complain to a data protection authority, such as the UK Information Commissioner's Office (ICO). We handle requests by email to [email protected] within one month, as the law requires. For data in your company's tickets and repositories we act on your company's instructions. Ask your company's admin first.

Legal basis

We rely on contract to provide the service, on legitimate interest for our security and operations logs and for cookieless Ahrefs traffic measurement, and on consent for Microsoft Clarity's cookies.

International transfers

SendGrid is a US service. Transfers of personal data to it are covered by Twilio's Data Protection Addendum, which includes the EU Standard Contractual Clauses and terms for transfers from the UK.

SEO pack data

This applies only to companies that turn on the SEO pack. Search Console queries can contain personal data. The daily detail is kept for 35 days, monthly summaries for 25 months, and rollups until the site is turned off.

Dutopilot connector for Claude and other AI assistants

The Dutopilot connector, an MCP server, cannot read your chat history or conversation. It receives only what your assistant puts into a tool call, such as the title and text of a ticket you ask it to file.

To connect an assistant, you confirm consent with a code we send by email. The connector stores your consent record (your email, the assistant's client id, when you approved and when it expires) and a keyed hash of each access and refresh token, never the token itself. It does not store the assistant's registration, and it does not keep a log of your requests or of what your assistant sends. Access tokens last 1 hour, and every connector record is deleted by a daily clean-up once it expires. A ticket you file or an action you take through the connector is recorded like one made in the dashboard, marked as made through the connector. If you paste an AI credential into a chat to add it through update_settings, it passes through your assistant's chat.

A connection expires after 7 days without use, and you can disconnect it at any time from the assistant's connector settings. Removing a person from the project ends their connections at once.

Microsoft Clarity

This site uses Microsoft Clarity to understand how visitors use it. Clarity records usage data such as clicks, scrolling and page views, and shows it to us as session replays and heatmaps. We use it to improve the site.

Microsoft processes that data. See the Microsoft privacy statement for how.

Clarity masks sensitive content by default.

Cookies and your choice

Clarity sets cookies from the first page you open, before you choose. The site shows a banner with Accept and Decline on your first visit and remembers your choice in your browser's local storage. If you accept, the cookies stay. If you decline, we remove the Clarity cookies (_clck and _clsk), Clarity is told that analytics storage is denied so it sets no new ones, and the banner does not return. The cookies we remove are the ones Clarity sets on this site; cookies that Microsoft sets on its own domains (for example a Microsoft advertising or user identifier cookie) are outside this site's reach, and you can delete them in your browser settings. After you decline, Clarity still records clicks, scrolling and page views as session replays and heatmaps, and Ahrefs Web Analytics still counts visits, all without cookies. If your browser blocks local storage, a decline applies only to the page you are on: the next page you open is treated as a first visit, sets cookies again and shows the banner.

Through Clarity, Delivery Autopilot counts how many visitors see the banner, accept, decline or later withdraw consent. Each count sends only the event name, no visitor details, and a count made after a decline uses no cookies. If your browser blocks local storage, these choices are not counted.

To change your choice at any time, use "Privacy choices" in the footer of any page. Choosing Decline there removes the Clarity cookies and stops new ones, like declining on the banner; we still measure how the site is used without cookies, as described above.

Ahrefs Web Analytics

This site also uses Ahrefs Web Analytics to measure traffic. It works without cookies and does not depend on your choice. Ahrefs processes that data. See the Ahrefs privacy policy for how.

Contact

For any question about this policy, or to exercise your rights, email [email protected].