Privacy and data protection.

SOLUTAI S.A.S., NIT 902018075-3, Spanish NIF N0401209B. Address: Cr 7 Km 17, Chía, Cundinamarca, Colombia. Privacy and rights contact: [email protected].

Contact: if you email or call us, we process your contact details, enquiry and information you choose to provide to reply and explore your request.

Browsing and security: infrastructure processes technical connection data, including IP addresses, to deliver and protect the website. Pilo is optional and is not used to make decisions with legal effects about you. The website code contains no behavioural advertising or tracking analytics.

When you submit an enquiry, SOLUTAI S.A.S. processes your name, email address, message and preferred language and, if provided, your company and phone number to handle and answer it. The legal basis is the consent you give by selecting the mandatory checkbox before sending. You may withdraw it by emailing [email protected]; this does not affect processing carried out before withdrawal. These details are used to answer your enquiry; they are not sent to Pilo or AI models, and no automatic acknowledgement is sent to your address.

The message is sent over an encrypted connection to [email protected]. This address uses forwarding: your enquiry is stored in the receiving team mailboxes for the time needed to handle it and manage the relationship or meet applicable obligations and responsibilities. Withdrawal of consent or an erasure request will be handled unless another retention obligation applies. Do not include sensitive information or other people’s details.

Cloudflare provides the form infrastructure and Turnstile verification; SolutAI’s contracted hosting and email provider supplies SMTP and email services. They act as processors when providing these services. [email protected] forwards enquiries to external team mailboxes, whose providers also take part in delivery and storage. Ask [email protected] about the providers and safeguards applicable to possible international transfers, described in the providers and transfers section.

Selecting “Send enquiry” loads Cloudflare Turnstile, which processes technical browser and connection data, including the IP address, to prevent abuse. The server checks the single-use token, the solutai.com hostname and the contact action. The widget is configured without pre-clearance. The form keeps its fields and a random session identifier in page memory, without storing them in cookies, localStorage or sessionStorage; they disappear when you close or reload the page. If sending fails, the fields remain on the page so you can try again.

To limit abuse, the Worker stores separate HMAC pseudonyms for the IP address and session identifier, together with timestamps. It does not store the original IP address in that store. Visitor limits are deleted when their windows expire, within one hour, even if traffic stops; the global daily counter expires at the next UTC day. Messages, email addresses, names, phone numbers and tokens are not recorded in application logs. Cloudflare and the email provider process the technical data required to provide their services.

WhatsApp links are optional. Using them takes you away from solutai.com to a WhatsApp/Meta service, subject to its terms and privacy policy. This site loads no WhatsApp scripts or widgets. If you message us there, we use your contact details and the content you share to handle your enquiry. Email and phone are alternatives; do not share sensitive data.

The contact form uses the specific consent given through its mandatory checkbox (GDPR Article 6(1)(a)). Where GDPR applies, other precontractual enquiries you request are handled under Article 6(1)(b), and legal obligations under Article 6(1)(c). General guidance you request from Pilo and service security rely on our legitimate interests in answering enquiries and preventing abuse, while respecting your rights (Article 6(1)(f)).

In Colombia, Law 1581 of 2012 applies: processing requiring authorisation needs prior, informed and retrievable authorisation unless a legal exception applies. Contacting us, opening Pilo or changing a preference does not authorise advertising or additional purposes.

Send only a general description of your goal, without names, emails, phone numbers, identifiers, sensitive information or other people’s data. The contact form and email remain separate from Pilo. Free-text filters are heuristic and cannot detect every kind of personal data.

When you send a message, Cloudflare Workers processes your message, language, page, section and recent history to obtain a reply from DeepSeek or, as a fallback, Cloudflare Workers AI. The Worker does not store conversations or log their content. It does not forward visitor IP addresses, cookies, browser headers, identifiers, HMAC pseudonyms or Turnstile or session tokens to either model; the text itself may still contain personal data if you include it.

In your browser, history lives only in memory: up to six messages (three exchanges), with a total limit of 1,800 characters. It is cleared when you leave or reload the page, let Pilo rest, or the local filter detects personal data. Pilo stores no conversations, drafts or audio in Web Storage and creates no cookies of its own. Only the session credential described in this policy is stored in sessionStorage.

To prevent abuse, the Worker retains an HMAC pseudonym derived from the random session ID, without using IP addresses for the quota, and up to twenty timestamps in a rolling ten-minute window. Entries expire ten minutes after the last counted request and are removed through cleanup and alarms. The global daily counter is cleared at the next activity or alarm after the day changes. This store contains no IP addresses, messages, tokens or identities; Cloudflare does process IP addresses within its infrastructure. The signed token is validated without storing it on the server, and the session ID is not sent to models.

Pilo saves the key solutai_pilo_state in localStorage for this website’s origin when you change its mute or suggestion setting, or resume it. Its fields are muted (true or false), proactivity (normal or quiet) and updatedAt (the date and time of the change in ISO format). It contains no history or visitor identifiers; updatedAt is not a browsing activity log.

The preference persists across pages and visits with no automatic expiry until you delete it; changing it replaces the value. Delete it using “Reset Pilo preferences” in Pilo’s menu, or clear solutai.com site data and local storage in your browser settings. “Let Pilo rest” clears the in-memory history and saves the mute preference. If storage is blocked, the preference works only in memory.

Pilo stores an HMAC-SHA256 signed session token, its expiry and the Worker endpoint (token, expiresAt, endpoint) in sessionStorage under solutai_pilo_session. The token contains the origin and a random session ID, without an IP address or conversation. It lasts 30 minutes without activity, renewed with each authenticated request, up to an absolute maximum of 2 hours after verification. It is discarded when read after expiry, when the tab closes, when you let Pilo rest or reset its preferences. It is never stored in localStorage; if storage is blocked, it remains only in memory until reload.

Opening the text input to write to Pilo, using its controls or Alt+P, downloads Cloudflare Turnstile from challenges.cloudflare.com only when no valid conversation session exists. This happens before sending a message; reading, seeing the greeting or scrolling does not load it. With a valid session, no script is downloaded and no widget is created. The separate contact form loads Turnstile when you select “Send enquiry”. Cloudflare processes technical browser and connection data, including IP addresses, to prevent abuse.

Pilo’s first request verifies a single-use Turnstile token without adding remoteip and receives a signed session; subsequent requests validate that session without another challenge until expiry. If the server rejects the session, it is cleared and the same message is retried once with a new Turnstile challenge. Contact verifies a single-use token on each submission, with hostname solutai.com and action contact. Widgets are removed when the challenge ends. Both have pre-clearance disabled (no_clearance) and do not issue cf_clearance through that feature; Cloudflare zone protections may set security cookies separately.

DeepSeek generates Pilo’s main response. Your text and recent history are sent to its API; its policy describes processing and storage in the People’s Republic of China. Do not send personal information to this service.

Cloudflare, Inc. provides network infrastructure, the Worker and Turnstile verification; Workers AI may generate fallback replies. It may process technical data and, when fallback is used, content sent to Pilo across its international network, including the United States and other countries.

Contacting a company in Colombia may also involve processing outside the European Economic Area. Any personal-data transfers require the applicable mechanism under GDPR Chapter V and Article 26 of Law 1581. We do not claim an adequacy decision for China or contractual safeguards that have not been documented. Ask [email protected] about applicable safeguards; the conversation must not be used to transfer personal data.

Contact enquiries are retained while handling your request and, if you contract, during the relationship and legally required periods. Afterwards, information is deleted or its use restricted to outstanding liabilities.

The Worker has no conversation archive. Provider processing periods follow their terms; we do not promise immediate deletion or zero retention by DeepSeek or Cloudflare. You may enquire before conversing and use email as an alternative.

Email [email protected] with your request and preferred reply channel. We may ask only for information necessary to verify your identity.

GDPR: where applicable, request access, rectification, erasure, objection, restriction and portability, withdraw consent and complain to the competent supervisory authority, including Spain’s AEPD.

Colombia: you may know, update and rectify your data, request proof of authorisation and information about its use, obtain free access, withdraw authorisation or request deletion where applicable. Submit enquiries and complaints to SolutAI and contact the Superintendencia de Industria y Comercio after completing the required prior procedure.

Do not send personal documentation to Pilo; use the controller’s email.