GDPR & Data Rights

Which role we play depends on the data, and it changes what each of us is responsible for.

You have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectify — correct anything inaccurate. Name and email are editable in your settings.
• Erase — have your account and data deleted, subject to billing records we must keep for tax purposes.
• Port — receive your data in a structured, machine-readable format. Usage history and batch results already export as CSV.
• Restrict or object — limit processing, or object to processing we base on legitimate interests.
• Withdraw consent — for anything consent-based, such as analytics cookies, at any time.

Email privacy@pilotlookup.net from your account address. We respond within 30 days and may extend by a further 60 days for complex requests, telling you why. There is no charge unless a request is manifestly unfounded or excessive.

You may have reached this page because a business validated your number using PilotLookup. Here is the honest position:

• We hold carrier reference data about number ranges, sourced from public industry records. It is about ranges, not about you.
• Where a customer sent us your specific number, we hold a log entry showing it was looked up, by which account, and when.
• Because we process that as a processor, we generally cannot action an erasure or access request directly — we must refer it to the customer who is the controller.

Write to privacy@pilotlookup.net and we will either identify the controller so you can contact them, or forward your request to them, normally within 10 business days. If you believe the lookup was unlawful, tell us — we investigate under our Acceptable Use Policy and will suspend accounts that abuse the service.

We are based in the United States and our infrastructure runs there. If you are in the UK, EEA or Switzerland, using PilotLookup involves transferring personal data to the US.

We rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum where relevant) with our sub-processors, together with technical measures including encryption in transit, encrypted storage, and access controls limited to staff who need it.

We will give notice before adding a sub-processor that handles customer-submitted data, so you have the opportunity to object.

If you need a signed DPA — including the Standard Contractual Clauses — email privacy@pilotlookup.net with your company details and we will send one for signature. We can also complete a security questionnaire for procurement.

• TLS for all data in transit; private S3 storage reachable only via short-lived signed URLs.
• bcrypt password hashing; API keys stored as hashes and displayed once.
• Role-based admin access with an audit trail of every account action.
• Breach notification without undue delay, and within 72 hours where GDPR requires it.

Under the CCPA/CPRA you may request disclosure of the categories and specific pieces of personal information we collect, request deletion, and correct inaccurate information. We do not sell or share personal information as those terms are defined, and we do not offer financial incentives for data. You may use an authorised agent, and we will not discriminate against you for exercising these rights.

Please raise concerns with us first at privacy@pilotlookup.net. You also have the right to complain to your local supervisory authority — the ICO in the UK, or your national data protection authority in the EEA.