On this page
Purpose and parties
This agreement forms part of the Pro Terms. It applies as soon as a Customer uses InvestPilot Pro and governs the processing of personal data carried out by Res Procuratio Sàrl ("InvestPilot", the processor) on behalf of the Customer (the controller), in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR) and Article 9 of the Swiss Federal Act on Data Protection (FADP).
Roles
The Customer is the controller of the "Customer Data": the personal data it receives, enters or manages in its Pro space. InvestPilot processes it only to provide the service.
When a buyer sends a request from a listing, InvestPilot collects it on its own site, as described in its Privacy policy, and then makes it available to the Customer. From that point, the request is Customer Data.
InvestPilot remains the controller of Pro users' account data, billing, the security of the service and the measurement of how it works.
Description of the processing
| Data subjects | Buyers and other people who contact the Customer from its listings; members of the Customer's team invited to the Pro space; people mentioned in conversations with Copilot. |
| Data | Identity (first name, last name, title), contact details (email, phone), message and project stated in the request, listing concerned, status and follow-up of the request, statistics of interaction with listings, content of conversations with Copilot. |
| Sensitive data | None is requested. The Customer refrains from entering any. |
| Operations | Hosting, display in the Pro space, email notification, statistics, search and summaries by Copilot, backup, deletion. |
| Purpose | To let the Customer receive and follow up requests about its listings and manage its activity on InvestPilot. |
| Duration | Term of the subscription, then until deletion under section 10. |
The Customer's instructions
InvestPilot processes Customer Data only on the Customer's documented instructions. The Pro Terms, this agreement and the settings made in the Pro space are those instructions. If an instruction appears to infringe the GDPR or the FADP, InvestPilot tells the Customer without delay. InvestPilot does not use Customer Data for its own purposes, does not sell it and does not use it to train artificial intelligence models.
Confidentiality
People authorised to access Customer Data are bound by confidentiality and access it only when needed for the service, for support requested by the Customer or for security.
Security
InvestPilot implements technical and organisational measures appropriate to the risk, in particular:
- encryption of data in transit (TLS) and at rest;
- database hosted in the European Union (Ireland);
- separation by agency: each user only accesses their own agency's data, according to their role;
- authentication by hashed password or identity provider, time-limited sessions;
- administrative access limited to those who need it; database backups at the hosting provider;
- error monitoring with masking of typed text.
Sub-processors
The Customer gives general authorisation for the sub-processors listed below. InvestPilot imposes equivalent data protection obligations on them by contract and remains responsible for their compliance. InvestPilot tells the Customer by email of any addition or replacement at least 30 days in advance; the Customer may object on legitimate grounds and, if no solution is found, cancel at no cost.
| Provider | Role | Place of processing |
|---|---|---|
| Supabase Inc. | Database, authentication, file storage | European Union (Ireland) |
| Vercel Inc. | Application hosting | European Union and United States |
| Resend Inc. | Notification emails | United States |
| Functional Software Inc. (Sentry) | Error monitoring | European Union (Germany) |
| OpenRouter Inc. and the provider of the model used | Copilot assistant answers | United States |
| Geoapify GmbH | Address autocomplete for listings | European Union (Germany) |
Transfers outside the European Union
InvestPilot is established in Switzerland, which the European Commission recognises as providing an adequate level of protection. When a sub-processor processes data outside the European Economic Area and Switzerland, the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework and its Swiss extension) or on the European Commission's standard contractual clauses.
Assistance to the Customer
InvestPilot helps the Customer, by appropriate measures, to respond to data subjects' requests (access, rectification, erasure, objection, portability); a request received directly is passed on to the Customer without delay. InvestPilot provides the Customer with the information it needs for a data protection impact assessment or a consultation of the supervisory authority.
In the event of a personal data breach affecting Customer Data, InvestPilot notifies the Customer without undue delay, where possible within 48 hours of becoming aware of it, with the information available on its nature, its likely consequences and the measures taken.
End of the contract
Before the subscription ends, the Customer may ask by email for a copy of the Customer Data in a common format. When the agency's account is deleted, Customer Data is erased at the end of the 30-day cancellation period, and then from backups according to their rotation cycle, unless the law requires it to be kept.
Audits
InvestPilot makes available to the Customer the information needed to demonstrate compliance with this agreement. The Customer may have an audit carried out, at its own cost, by an auditor bound by confidentiality, no more than once a year, with 30 days' notice and without disrupting the service.
Final provisions
In case of conflict, this agreement prevails over the Pro Terms as regards data protection. The limitation of liability in the Pro Terms applies, unless a mandatory rule provides otherwise. The governing law and jurisdiction are those of the Pro Terms. Contact for any data question: contact@investpilot.co.
Last updated : 20 October 2026