This addendum describes how REGRA handles the personal data your business puts into REGRA Pilot — your customers' names, phone numbers, email addresses, job addresses and the history of their requests. It forms part of the REGRA Pilot Terms of Use and Service Agreement and applies from the moment you start using the service.
1. Who is who
You decide what to collect from your customers and why: you designed the form, you chose the questions, you answer to the people who fill it in. In data protection language you are the controller.
We hold and process that data only to run the service for you, on your instructions. We are the processor. We do not decide what to collect, we do not use your customers' data for our own purposes, and we never sell it or share it with anyone for advertising.
2. What we do with the data, and nothing else
We process your customers' personal data only to:
- run the features you use — storing requests, building quotes and invoices, sending the documents you choose to send;
- keep the service secure and working, including backups and fixing faults;
- help you when you ask us to;
- comply with a law that applies to us. If a law requires us to disclose something, we tell you first unless the law forbids it.
Anything outside that list needs your written instruction.
3. What we hold
For each person your business deals with, the service may store: the name and contact details they or you typed, the job address, what they asked for, which page or form they came from, the documents you sent them, and — if they accept a quote — the date, time and IP address of that acceptance. The IP address is kept precisely because it is what makes the acceptance provable.
We also hold the accounts of the people on your team: name, email, a password stored only as a bcrypt hash, and — if they set one up — a passkey credential. We never see or store a readable password, including when helping you.
4. What you are responsible for
- Having a lawful basis to collect what you collect, and writing the privacy notice your own website shows. We cannot write it for you, because only you know what else your website does.
- Collecting only what you actually need in order to quote and deliver the job.
- Who on your team has an account, and removing people who leave.
- Answering your customers when they ask to see, correct or delete what you hold about them. We help you find or remove the record; the answer is yours to give.
5. Security, described honestly
What is in place today:
- All traffic runs over HTTPS. The service is not reachable over plain HTTP.
- Passwords are stored as bcrypt hashes. Passkeys (fingerprint or face) are supported as a stronger alternative.
- Sessions live on the server, not in the browser, and are invalidated when a password changes.
- Every account is isolated from every other, and that isolation is re-checked from the database on every single request rather than trusted from the session.
- Every write is protected against cross-site request forgery.
- An audit log records who did what, and it is visible to you inside your own account.
- Payment card details never reach us. Card data is handled entirely by PayPal; we never see a card number.
What we do not claim: we do not operate a formal information security certification such as SOC 2 or ISO 27001, and we do not carry out third-party penetration testing on a fixed schedule. If you need either, tell us before you commit — we will tell you honestly where we are.
6. The people who can see it
Access is limited to the people who need it to run the service. Today that is a very small number of people at REGRA, bound by confidentiality, and access is used for operating the platform, fixing faults and helping you when you ask.
7. Subprocessors
We use these third parties, and only these, to deliver the service:
- Hostinger — hosting, database and outbound email. This is where your data physically lives.
- PayPal — our own subscription billing. PayPal receives the details of the person who pays us for REGRA Pilot. It does not receive your customers' data.
- Meta (WhatsApp Business Platform) — only if you switch on WhatsApp alerts. In that case the alert contains the name and phone number of the person who contacted you, because that is what the alert is for. Leave the feature off and Meta receives nothing.
If we add a subprocessor, we will tell you before it starts handling your data, and you may object. If we cannot resolve the objection, you may end the agreement without penalty for the unused part of what you paid.
8. Where the data is
Your data is stored on Hostinger infrastructure. REGRA operates from Brazil as REGRA Negócios Digitais and from the United States as REGRA Digital Business LLC, so the people who administer the service may access it from either country. If you need the data to stay in a specific country, ask us before you commit — we will tell you honestly whether we can do it.
9. If something goes wrong
If we become aware of a security incident affecting your data, we will tell you without undue delay, with what we know at the time: what happened, what data was involved as far as we can tell, what we have done, and what we suggest you do. We will keep you updated as we learn more rather than waiting until we have a complete picture.
We do not promise a fixed number of hours, because a promise like that is easy to write and hard to keep. We promise to tell you as soon as we know, and not to sit on it.
10. Getting your data out, and deleting it
You can export your data from inside the product at any time, without asking us.
What happens when you stop: your account is closed, nobody can sign in, and the data is kept, not deleted. This is deliberate — a business that comes back three months later finds its history intact, and an account closed by mistake loses nothing.
If you want it actually deleted, ask us in writing and we will delete it within 30 days and confirm when it is done. Backups age out on their own cycle and are not kept indefinitely. We will not delete anything a law requires us to keep, and if that applies we will tell you which part and why.
11. Helping you answer your customers
If one of your customers asks you for a copy of their data, asks you to correct it, or asks you to delete it, the answer is yours to give — they are your customer, not ours. The product lets you find, edit, export and delete an individual record yourself. If you cannot find something, write to us and we will help.
If one of your customers contacts us directly, we will not act on it. We will tell them to contact you, and tell you that they wrote.
12. Questions and checks
You may ask us reasonable written questions about how we handle your data, and we will answer them. We are a small company: we can give you honest answers and evidence of how the system is built, but we cannot host on-site audits or fill in long vendor questionnaires at no cost. If your own obligations require more than that, tell us early and we will work out what is possible.
13. Which document wins
On the handling of personal data, this addendum takes precedence over anything conflicting in the service agreement. Everything else in the service agreement stands.
14. Changes
If we change this addendum in a way that reduces the protection you get, we will tell you before it takes effect, and you may end the agreement without penalty for the unused part of what you paid. Smaller changes — clarifications, a new subprocessor announced as described above — are published here with a new date at the top.
Talk to us
Write to hello@regrapilot.com and a person answers. If you need this signed as a separate countersigned document for your own records, say so and we will do it.