Privacy Policy

PilotLookup is a phone number validation and carrier lookup service operated by PILOTLAB LLC, 304 S. Jones Blvd, Las Vegas, Nevada 89107, United States. In this policy “we”, “us” and “PilotLookup” mean PILOTLAB LLC.

For privacy questions, data requests or complaints, contact privacy@pilotlookup.net.

Two roles. For your account and billing data we are the controller. For the phone numbers you submit through the API or a batch upload we are a processor acting on your instructions — you remain responsible for having a lawful basis to submit them. See GDPR & Data Rights.

Information you give us

• Account details — name, email address and a hashed password. Passwords are stored using bcrypt and are never readable by us.
• Billing details— credit pack purchases and their status. Card details are entered on Stripe’s systems and never touch our servers; we store only the Stripe identifiers and the amount.
• Support messages — anything you send through a contact form or by email.

Information you submit for processing

• Phone numbers submitted to /api/validate or in an uploaded file, and the carrier, line type and location we resolve for them.
• Uploaded files for batch validation, including every column in them — not only the phone column you map.

Information collected automatically

• Usage logs — which API key was used, the number looked up, whether it matched, and a timestamp.
• Authentication records — sign-ins, sign-up, failed sign-in attempts, password resets, and the IP address and browser user-agent attached to each. We keep these to detect account compromise.
• Cookies and analytics — described in our Cookie Policy.

We do not sell personal information, and we do not use the phone numbers you submit to build or enrich any marketing database.

We use a small number of processors, each bound by contract to protect your data:

We may also disclose data where legally required, or in connection with a merger or acquisition — in which case we will tell you before your data becomes subject to a different privacy policy.

• Account data — for as long as your account is open, then up to 90 days after deletion.
• Batch upload files and results — until you delete the job. Deleting a job removes both files from S3.
• Usage logs — 24 months, so you can audit and reconcile your spend.
• Authentication records — 12 months.
• Billing records — 7 years, as required by US tax law.

• All traffic is encrypted in transit with TLS.
• Passwords are hashed with bcrypt; API keys are stored only as hashes and shown to you once.
• Batch files are stored in a private S3 bucket and reached only through short-lived signed URLs.
• Administrative actions against an account are recorded in an audit trail.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant supervisory authority without undue delay, and within 72 hours where GDPR requires it.

Depending on where you live you may have the right to access, correct, delete, port or restrict the processing of your personal data, and to object to processing based on legitimate interests. California residents have rights under the CCPA/CPRA, including the right not to be discriminated against for exercising them.

Exercise any of these by writing to privacy@pilotlookup.net. We respond within 30 days. Full detail, including how we handle requests about numbers you submitted, is in GDPR & Data Rights.

PilotLookup is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

We will post any change on this page and update the date above. For material changes we will email account holders at least 14 days before the change takes effect. Continuing to use the service after that date means you accept the updated policy.