Pylot
Menu

Privacy policy

As of August 2026

This policy explains which personal data we process on pylot.ch and in the application at app.pylot.ch, what we use it for, and to whom we disclose it. It follows the Swiss Federal Act on Data Protection (FADP). Where foreign data protection law (e.g. the GDPR) applies, this information applies as well. This page is a convenience translation; the German version is authoritative.

Pylot c/o Bayo GmbH, Obergasse 24g, 8854 Galgenen, Schweiz

For privacy questions and to exercise your rights: info@pylot.ch

The application and the database holding your account and website data are operated in Switzerland. We disclose personal data only where necessary to provide our services (see sections 3 to 11).

When you open our website, connection data arises for technical reasons, such as IP address, date and time, the page requested, and browser and device information. We process it to deliver and secure the website and to prevent abuse.

We measure, in anonymised or pseudonymised form, how the website is used and how many people sign up. We record page views and selected events, such as choosing a plan or starting checkout, as well as campaign parameters. We do not automatically record all clicks.

To measure the effect of our advertising on Facebook and Instagram we use the Meta Pixel of Meta Platforms Ireland Ltd. Page views and selected events are sent to Meta together with identifiers of your browser and may be linked to your Meta account if you are signed in there. Meta acts as an independent controller and also processes the data for its own purposes; processing may take place worldwide. Information is available in Meta's privacy policy (facebook.com/privacy/policy). You can prevent the transmission through the ad settings of your Meta account, your browser settings or blockers.

We store information in your browser and may set cookies. We use them for the analytics and advertising measurement (Meta Pixel) in section 4, to keep campaign parameters during your session, and for guest checkout (so that you can later attach the purchase to your account).

You can delete or block cookies and site data at any time in your browser settings. Some functions, such as guest checkout, may then stop working.

To register and use Pylot we process your email address, password (stored only in secured form), language setting, workspace memberships and the websites, texts, images and settings you create. We process them to perform the contract.

We have confirmation, password reset and invitation emails sent by a commissioned email service provider.

When you use the AI assistant, we send your input and the website content needed for the task to a provider of AI models. For image suggestions we send search terms to image services, but no account data. Do not enter sensitive personal data into the assistant.

Payments are handled by a payment service provider. You enter card data directly with the payment service provider; we do not receive it. We store only identifiers, card brand, the last four digits and expiry date, and invoice and subscription data. The payment service provider is partly responsible for its own processing, for example fraud prevention.

Registering a domain requires the registrant's contact data (name, address, email, phone). We pass it on to a registrar and to the competent registry. Depending on the extension, registries may publish some details or release them on request. We store contact data in encrypted form.

We use infrastructure service providers to publish your websites and manage domain records. If you book an email mailbox through Pylot, the mailbox service is operated by a partner on our behalf; the content and connection data of your emails are processed there.

If you write to us by email or through a messaging service, we process your message and contact details to reply. With a messaging service, its provider receives connection data. Do not send confidential information via messaging services.

We use service providers for individual services (payment, domains, email delivery, AI features, infrastructure, analytics). They process personal data only on our behalf or, where stated above, under their own responsibility.

If service providers process personal data outside Switzerland, we ensure adequate protection, for example through an adequacy decision of the Federal Council, standard contractual clauses or other safeguards provided by law.

We process personal data for as long as the purpose requires. We delete account data after use has ended and the account has been deleted, unless statutory retention duties apply. Accounting records are kept for ten years.

You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing. Please contact the address in section 1; we may require proof of identity. Restrictions under the applicable law remain reserved.

You may also complain to the Federal Data Protection and Information Commissioner (FDPIC). If foreign data protection law applies, you can also contact the competent supervisory authority.

We take appropriate technical and organisational measures, in particular encrypted transmission and access restrictions. Complete security on the internet cannot be guaranteed.

We may amend this policy at any time. The version published on this page applies.