PRIVACY NOTICE

Last Updated: April 2026

Autopilot Travel, Inc. ("Autopilot," "we," "our," or "us") is a Delaware corporation with its principal place of business at 27 East 28th Street, New York, NY 10016. We operate the website withautopilot.com and a suite of travel-management services, including automated fare monitoring, price-drop rebooking, and travel reservation management, as well as a companion App (collectively, the "Services").

This Privacy Notice ("Notice") describes how we collect, use, retain, disclose, and protect your personal information when you visit our website, create an account, or use the Services. It also describes your rights with respect to your personal information and how you can exercise those rights.

By creating an account or using the Services, you acknowledge that you have read and understood this Notice. If you do not agree to these practices, please do not use the Services.

CONTENTS

1. Scope of This Notice

2. Information We Collect

3. How We Collect Information

4. Gmail & Email Inbox Integration

5. Purposes for Which We Use Your Information

6. Disclosure of Your Information to Third Parties

7. Cookies, Tracking Technologies & Digital Advertising

8. Sensitive Personal Information

9. Data Retention

10. Data Security

11. Children's Privacy

12. Third-Party Links and Integrations

13. Your Privacy Rights (All Users)

14. California Privacy Rights (CPRA / CCPA)

15. Additional State Privacy Rights

16. Do Not Sell or Share My Personal Information

17. Global Privacy Control (GPC)

18. Changes to This Notice

19. Contact Us

1. SCOPE OF THIS NOTICE

This Notice applies to:

• All visitors to withautopilot.com and any related subdomains (e.g., fly.withautopilot.com);
• Registered account holders who use the Services, including fare monitoring, automatic price-drop rebooking, and reservation management;
• Individuals whose travel information is processed as part of a reservation imported into an Autopilot account (e.g., companion travelers); and
• Individuals who contact us for support or who otherwise interact with Autopilot.

This Notice does not apply to the data practices of third-party service providers, airlines, hotels, or other travel providers to which we may refer or connect you. Those parties' privacy practices are governed by their own policies.

2. INFORMATION WE COLLECT

2.1 Information You Provide Directly

A. Account Registration & Profile Data

When you create an Autopilot account, we collect:

• Legal first name, middle name (optional), and last name
• Date of birth
• Email address
• Password (stored in hashed form, we do not store plaintext passwords)
• Optional onboarding information: how you heard about us, and any referral or invite code used

B. Traveler Profile Data

To enable fare monitoring, rebooking, and reservation management, we collect the following information about you and any companion travelers on your reservations:

• Full legal name (first, middle, last) and date of birth
• Email address and phone number (as extracted from reservation records)
• Known Traveler Number (KTN) and redress number, if applicable
• Canadian travel authorization number, if applicable
• Home airport and preferred airline
• Seat preferences, cabin preferences, and CLEAR membership status
• Frequent flyer program names and numbers, airline or alliance status, and elite tier designation
• Upgrade preferences and history (target cabin, cost, upgrade type)
• Voucher and travel credit reference numbers and amounts

Note on Companion Travelers: If a reservation you import includes other travelers (e.g., family members, colleagues), we process their personal information as described in this Notice. By importing such a reservation, you represent that you have authority to do so and have informed those individuals of Autopilot's privacy practices.

C. Flight Reservation Data

For each flight reservation we track on your behalf, we store:

• Confirmation number (PNR), airline, ticket number, and ticket issue date
• Payment amounts (base fare, taxes, total), payment method type, and currency
• Reservation status and flags (e.g., refundable, award, basic economy, companion fare, elite upgrade direct booking)
• Full PNR data (JSON format) and original confirmation email (HTML format)
• Departure and arrival airports, dates, and times
• Flight number, aircraft type, seat assignment, fare class, fare code, and cabin name
• Real-time flight status and codeshare details
• Voucher and credit reference numbers and amounts

D. Hotel Reservation Data

For hotel reservations, we store:

• Confirmation number, hotel chain and property name, IATA number, and chain/brand code
• Check-in/check-out dates, number of nights, arrival time, and reservation status
• Total price, award price (points), currency, and cancellation details
• Raw reservation data (JSON) and cancellation/guarantee policy text
• Hotel property contact information and full physical address
• Geographic coordinates of the property
• Room type, maximum occupancy, rate plan code/name, and description
• Reservation flags (advanced purchase, flexible, tracking, auto-rebook, award, direct booking)
• A tokenized payment card number provided by certain hotel chains for reservation guarantee purposes only. We do not use this token for any charging or payment processing.

E. Payment & Billing Information

We use Stripe, Inc. as our payment processor. We do not store full payment card numbers on our servers. Through Stripe, we retain:

• Last four digits of your payment card
• Card type (credit/debit), card network, and issuing bank
• Billing name and billing address

All full card numbers and sensitive financial credentials are held exclusively by Stripe and are subject to Stripe's Privacy Policy (stripe.com/privacy). We have no access to your full card number.

F. Support & Communications

When you contact us for support or otherwise communicate with us, we collect the contents of those communications and any personal information you choose to share.

2.2 Information Collected Automatically

When you visit our website or use the Services, we and our third-party partners automatically collect:

• IP address and coarse location derived from your IP address
• Device identifiers, browser type and version, and operating system
• Pages visited, time on pages, clickstream data, and referring URLs
• Session recording data (mouse movements, scrolls, clicks) captured via PostHog
• App usage patterns and feature interaction data

We do not currently collect precise geolocation data (GPS coordinates). If we do so in the future, we will update this Notice and seek your consent where required by applicable law.

2.3 Information Received from Third Parties

We may receive information about you from:

• Google (OAuth Sign-In): If you sign in via Google, we receive your email address, first name, last name, and profile picture URL. This does not grant access to your Gmail inbox; that requires a separate authorization (see Section 4).
• Travel Providers (Airlines & Hotels): We may receive reservation data, fare information, and itinerary updates from airline and hotel systems as part of providing the Services.
• Referral & Affiliate Sources: If you were referred by an affiliate or influencer partner, we may receive limited attribution data (e.g., a referral code), but not personal information about you from that source.

3. HOW WE COLLECT INFORMATION

4. GMAIL & EMAIL INBOX INTEGRATION

4.1 OAuth Scopes Requested

When you authorize Gmail access, Autopilot requests the following Google OAuth scopes:

• gmail.readonly: Permits read-only access to your inbox to search for and retrieve travel confirmation emails only
• userinfo.profile: Retrieves your Google profile (name and profile picture URL)
• userinfo.email and openid: Retrieves your email address for account authentication.

We do not request permission to compose, send, delete, or modify emails. We do not access contacts, calendars, Google Drive, or any Google service beyond the scopes listed above.

4.2 Data Accessed and Stored

Upon authorization, Autopilot scans your inbox for emails from travel providers using domain and subject-line matching. Specifically:

• We identify emails matching qualifying travel confirmation patterns from recognized travel provider domains
• We parse the email to extract reservation data as described in Section 2 and add the reservation to your Autopilot account

We do not read, store, or process non-travel emails. We do not currently use inbox data to serve you third-party advertising. We do not sell the contents of your emails. Any other and further use shall be disclosed to you in advance and, where required by law, will require your consent.

4.4 Revoking Gmail Access

You may revoke Autopilot's access to your Gmail account at any time by:

• Contacting us at support@withautopilot.com to request revocation (our team will process this promptly)
• Visiting your Google Account permissions page (myaccount.google.com/permissions) and removing Autopilot's access directly.

Upon revocation, we deactivate your Gmail OAuth token promptly. Previously stored email content and extracted reservation data are subject to our standard retention policy (Section 9).

4.5 Google API Services User Data Policy

Autopilot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for purposes beyond those described in this Notice.

5. PURPOSES FOR WHICH WE USE YOUR INFORMATION

We use your personal information only for the following purposes:

5.1 Automated Processing

Stripe may use automated fraud-detection algorithms in connection with payment processing on our behalf. Autopilot does not currently make fully automated decisions about users that produce legal or similarly significant effects. We will update this Notice if that changes.

5.2 AI-Assisted Operations

We use third-party AI tools, including OpenAI and Anthropic APIs, to assist in operational tasks such as email parsing and reservation data extraction. We do not use your personal information to train foundational AI models without your separate consent.

6. DISCLOSURE OF YOUR INFORMATION TO THIRD PARTIES

6.1 Service Providers (Processors / Contractors)

We disclose personal information to the following service providers who process data on our behalf, subject to contractual data processing obligations:

6.2 Travel Providers (Airlines & Hotels)

In the ordinary course of providing the Services, such as when we contact an airline or hotel on your behalf to rebook or inquire about a reservation, we disclose the personal information necessary to facilitate that interaction. This typically includes confirmation number (PNR), full traveler names, dates of birth, and itinerary details.

6.3 Cross-Context Behavioral Advertising (Meta Pixel)

We use the Meta (Facebook) Pixel on our website. The Meta Pixel sends behavioral data, including page visits, conversion events, and device identifiers, to Meta Platforms, Inc. Meta may use this data for cross-context behavioral advertising, meaning it may serve targeted ads to you on Meta's platforms (Facebook, Instagram) based on activity on our site.

You may opt out of this sharing at any time. See Section 16.

6.4 Business Transfers

If Autopilot is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website prior to your personal information becoming subject to a materially different privacy policy.

6.5 Legal Disclosures

We may disclose personal information if required by law, regulation, court order, or legal process, or in response to a lawful request from law enforcement or government authorities. We may also disclose personal information when we believe in good faith that disclosure is necessary to protect our rights or property, prevent fraud or illegal activity, or protect the personal safety of any person.

6.6 No Sale of Personal Information

Autopilot does not sell your personal information to data brokers or other third parties for monetary consideration. For California residents' rights regarding 'sharing' for cross-context behavioral advertising, see Sections 14 and 16.

7. COOKIES, TRACKING TECHNOLOGIES & DIGITAL ADVERTISING

7.1 Cookie Inventory

We and our third-party partners use cookies, web beacons, pixel tags, and similar tracking technologies. The following cookies are currently deployed:

8. SENSITIVE PERSONAL INFORMATION

Under the California Privacy Rights Act (CPRA) and similar state laws, certain categories of personal information receive heightened protection ("Sensitive Personal Information" or "SPI"). We handle the following categories of SPI:

We use Sensitive Personal Information only as necessary to provide the Services and for limited additional purposes permitted by applicable law. We do not use SPI to infer characteristics about you unrelated to our Services.

We do not collect biometric information, racial or ethnic origin, religious beliefs, health conditions (beyond incidental SSR contact), union membership, or the contents of personal communications unrelated to travel reservations.

9. DATA RETENTION

We retain personal information for as long as necessary to fulfill the purposes described in this Notice, subject to applicable legal obligations:

10. DATA SECURITY

We implement technical and organizational measures designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction:

• Encryption in transit
• Encryption at rest
• Access controls: Access to production database environments and business intelligence tools is restricted to a small number of authorized personnel and requires multi-factor authentication (MFA).
• Payment security: All payment card data is processed exclusively by Stripe, Inc., a PCI-DSS certified processor. Full card numbers never touch our servers.

No security system is impenetrable. In the event of a data breach that creates a material risk to your rights, we will notify you as required by applicable law.

11. CHILDREN'S PRIVACY

The Services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. We do not engage in targeted advertising to individuals under the age of 18.

If you become aware that a child under 13 has provided us with personal information, please contact us at support@withautopilot.com and we will delete that information promptly.

12. THIRD-PARTY LINKS AND INTEGRATIONS

Our Services may contain links to or integrations with third-party websites, services, and platforms, including airlines, hotel booking sites, affiliate partners, and social media influencers.

This Notice does not cover the data practices of any third party. We encourage you to review the privacy policies of any third-party service you access through or in connection with Autopilot.

13. YOUR PRIVACY RIGHTS (ALL USERS)

Regardless of your state of residence, you have the following rights with respect to your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct inaccurate or incomplete personal information. Certain fields may be restricted for service-integrity reasons.
• Deletion: Request deletion of your personal information. All users may submit a request to support@withautopilot.com. Note that some data may be retained by third-party service providers (e.g., Stripe, Customer.io) per their own retention policies.
• Opt-Out of Marketing: Unsubscribe from marketing emails at any time using the unsubscribe link in any marketing email.
• Opt-Out of Sharing for Cross-Context Behavioral Advertising: See Section 16.

We may need to verify your identity before fulfilling a rights request. We will ask you to confirm information associated with your account. We will not discriminate against you for exercising any of your privacy rights.

Authorized agents may submit requests on your behalf with written authorization signed by you. We may require you to directly verify your identity with us even when using an authorized agent.

14. CALIFORNIA PRIVACY RIGHTS (CPRA / CCPA)

This section applies to California residents and supplements the rights described in Section 13.

14.1 Categories of Personal Information Collected

In the preceding twelve (12) months, we have collected the following categories of personal information from California residents:

14.2 California Consumer Rights

California residents have the right to:

• Know: Request disclosure of the categories and specific pieces of personal information collected about you, sources, business or commercial purposes, and categories of third parties with whom we share it.
• Delete: Request deletion of personal information, subject to certain exceptions (e.g., legal obligations, fraud prevention).
• Correct: Request correction of inaccurate personal information.
• Opt-Out of Sale / Sharing: Opt out of the sale or sharing of your personal information for cross-context behavioral advertising. See Section 16.
• Limit Use of Sensitive Personal Information: Request that we limit our use of SPI to purposes specified by CPRA.
• Non-Discrimination: We will not deny Services, charge different prices, or provide a different quality of service based solely on your exercise of CPRA rights.

14.3 Verifiable Consumer Requests

Submit a CPRA request to support@withautopilot.com. We will verify your identity by matching information against your account records and respond within 45 days. If we need additional time (up to 90 days total), we will notify you within the initial 45-day period. You may submit a request to know up to twice in any 12-month period.

14.4 Appeals

If we deny your rights request, you may appeal by responding to our denial notice with a written explanation. If your appeal is denied, you may contact the California Privacy Protection Agency (CPPA) at cppa.ca.gov.

14.5 Shine the Light (Cal. Civ. Code Section 1798.83)

California customers may request information once per year about categories of personal information (if any) we share with third parties for their independent direct marketing purposes. We do not share personal information with unaffiliated third parties for their independent direct marketing purposes without your consent.

15. ADDITIONAL STATE PRIVACY RIGHTS

While Autopilot does not currently meet the volumetric thresholds that trigger mandatory compliance under all applicable state privacy laws, we respect the privacy rights of users from all states and voluntarily extend similar rights to all users. States with comprehensive consumer privacy laws include:

Targeted Advertising: We use the Meta Pixel and Customer.io for marketing purposes that may constitute 'targeted advertising' or 'sharing' under state law definitions. You may opt out -- see Section 16.

Profiling: We use PostHog and Customer.io to segment users into behavioral categories based on travel patterns. We do not currently make automated decisions that produce legal or similarly significant effects. We will update this Notice if that changes.

To exercise your state privacy rights, contact us at support@withautopilot.com. We will not discriminate against you for exercising these rights.

16. DO NOT SELL OR SHARE MY PERSONAL INFORMATION

Autopilot does not sell personal information for monetary consideration. However, our use of the Meta Pixel may constitute a 'share' of personal information for cross-context behavioral advertising under California law and may constitute 'targeted advertising' under other state laws.

To opt out of this sharing / targeted advertising:

• Email us at support@withautopilot.com with the subject line 'Opt-Out of Data Sharing' and include your name and account email address;
• Use Meta's Ad Preferences controls at https://www.facebook.com/settings?tab=ads to restrict Meta's use of your data;
• Use the DAA opt-out tool at https://optout.aboutads.info/ or the NAI opt-out tool at https://optout.networkadvertising.org/.

We will process opt-out requests within 15 business days. We will not deny you access to the Services because you have exercised this right.

18. CHANGES TO THIS PRIVACY NOTICE

We may update this Privacy Notice from time to time. When we make material changes, we will notify you by email to the address on file with your account. The updated Notice will also be posted on our website with a revised "Last Updated" date at the top.

For non-material changes (such as typographical corrections or clarifications that do not affect your rights or our data practices), we may update the Notice without separate notice. Your continued use of the Services following posting of any changes constitutes your acceptance of the updated Notice.

We recommend reviewing this Notice periodically to stay informed about our data practices.

19. CONTACT US

If you have any questions, concerns, or requests related to this Privacy Notice or our data practices, please contact us:

For California residents exercising CPRA rights, you may also contact the California Privacy Protection Agency (CPPA) at cppa.ca.gov if you believe we have failed to fulfill your rights request