Privacy policy

Version of 10.11.2026. Applies to the Telegram bot @Pilotravelbot , the website https://pilo.travel and the Pilo iPhone app. This is a translation; if it differs from the Russian version, the Russian version prevails.

1. General provisions

1.1. This policy explains what personal data the Pilo service (the “Service”) processes, why, for how long, to whom and on what grounds it is transferred, and how you can manage it.

1.2. The personal data operator is Aleksey Maltsev, Turgut Ozala st, house 7, 050011 Almaty, Kazakhstan (the “Operator”, “we”). To contact the Operator about data: pilotravelbot@gmail.com.

1.3. The Service consists of a Telegram bot, a website and an iPhone app. It is one service with a shared database: a trip created in the bot is visible on the website and in the app, and vice versa.

1.4. Access to the Service is open: anyone over 18 can sign in (section 16). The Operator may close access in case of abuse.

1.5. By starting to use the Service, you confirm that you have read this policy. Consent to the processing of personal data is given in a separate document — before the Service starts saving your trips.

1.6. The policy is published openly at the address of this page and is valid indefinitely until replaced by a new version.

2. Terms

Personal data — any information relating directly or indirectly to an identified or identifiable natural person (you).

Processing — any action with personal data: collection, recording, systematization, accumulation, storage, clarification, retrieval, use, transfer, anonymization, blocking, deletion, destruction.

Trip — a record in the Service that includes the questionnaire answers, the plan (overview, days, hourly schedule), the chat with Pilo and related PDF files.

AI model — the language model that generates plans and replies: the main one is Anthropic PBC’s Claude; the backups are OpenAI’s GPT and Moonshot AI’s Kimi (section 7.1a).

Cross-border transfer — transfer of personal data to the territory of another country.

3. What data we process

3.1. Telegram account data

Numeric identifier (Telegram ID), first name, last name and username — Telegram provides them when you message the bot or sign in to the website with Telegram. We do not receive or store your profile photo or phone number.

3.1a. Sign in with Apple or Google

If you sign in with Apple (in the iPhone app) or with Google (on the website or in the app), we receive a permanent account identifier, your name and email address from them (Apple may provide a private relay address). We use the email and name to recognise you next time and to show the owner your access request. We do not send marketing emails. If notifications in the app or browser do not reach you and you have no Telegram, we may send a service email about your trip to this address — for example, that the route is ready and the days can be planned. Every email has a “Stop emails” link; after it, no more emails are sent. We never receive your Apple ID or Google password — Apple and Google confirm the sign-in themselves. When you delete your account, the name and email are erased; only the identifier is kept so that signing in again does not create someone else’s number.

3.1b. Voice input

If you tap “Speak instead” on the website or in the app, or send the bot a voice message, the recording is sent for speech recognition (section 7.3b) and turned into text that you see in the input field; after that it is treated like typed text. The Service does not keep the recordings: they are deleted right after recognition. The microphone turns on only when you tap the button and turns off when you tap “Done”.

3.2. Trip data

Questionnaire answers: destination, departure city, dates, transport, who is traveling, pace, budget, accommodation, must-dos, bookings, constraints and interests. You fill in these fields yourself, in free text — please write only what is needed for planning.

If you provide information about health, diet, children’s ages or other circumstances yourself, we use it only to take it into account in the plan and do not process it for any other purpose.

Trip plans generated by the Service: route, days, places, restaurants, accommodation options, facts with sources.

Booking and ticket files. If you upload a file on the website or send one to the bot (photo, screenshot, PDF, email), it is stored on the server in the trip’s “Bookings” section and is available only to you — until you delete it, the trip or the account. To add the booking to the plan, the file’s content is sent to the Claude model (section 7). Before uploading, cover passport numbers and payment details — the Service does not need them.

3.3. Chats

Messages you write to Pilo in the bot, on the website or in the app, Pilo’s replies and your ratings of replies (👍/👎). Also requests to change the route.

3.4. Location

Only when you send it to the bot yourself to get a “what to do now” suggestion. Coordinates are used for one reply and are not stored separately; they may remain in the text of the request sent to the AI model.

3.5. Settings

Morning briefing time, whether it is on, which trip is currently active, interface language, the date and time of consent to data processing.

3.6. Technical data

Activity log (when you started a questionnaire, received a plan, downloaded a PDF, sent a message; errors and limits being triggered), the amount of text processed by the AI and the cost of requests, website session service data (a hash of a random token and its expiry). The application does not record website visitors’ IP addresses; the server may keep them briefly in system logs and in memory to protect against attacks (for example, to block password guessing and request floods).

4. What data we don’t collect

The Service does not need or request: passport and other document numbers, bank card details, passwords, booking numbers with access codes, exact home addresses, biometrics. If you have sent such data in a message anyway, delete the trip — the chat is deleted with it. Don’t send links from booking emails: they often contain access codes to the booking.

We do not use advertising networks, social media pixels or third-party analytics. We count visits to public pages (home, Routes, Visas) ourselves, on our own server and without cookies: how many times a page was opened and where visitors came from (for example, a search engine). To avoid counting one person twice a day we use a one-day fingerprint — a hash of the address and browser with a salt that changes daily; the address itself is not stored and fingerprints are deleted after two days.

5. Purposes of processing

1. Creating, storing, showing and changing plans for your trips, including based on your messages on the road.
2. Checking facts (opening hours, timetables, quotas) via web search and calculating routes using maps.
3. Morning briefings, PDFs and other features you have turned on.
4. Sign-in to the website and account protection.
5. Limiting load and costs: message and plan limits, protection against abuse and attempts to hack the AI.
6. Improving quality: analyzing errors and poorly rated replies, anonymized statistics (how many trips, which destinations are popular, how much processing costs).
7. Complying with the law and responding to your data requests.

We do not make decisions based on your data that have legal consequences for you, and we do not use it for advertising profiling.

6. Legal grounds

• Your consent — for processing trip data and chats, sending them to the AI model and cross-border transfer (consent text).
• Performance of a contract — using the Service at your request: a plan cannot be made without processing the questionnaire and messages.
• The Operator’s legitimate interest — protecting the Service, cost accounting, anonymized statistics.
• Legal requirements — keeping information that applicable law requires to be kept.

7. How processing works: AI and other services

7.1. The Claude AI model (Anthropic PBC, USA). To make a plan or reply to a message, the Service sends the text of your request, the questionnaire and the relevant part of the plan to the Claude API. Anthropic processes this data as a service provider under its commercial terms; under Anthropic’s terms for the commercial API, customer data is not used to train models by default and is kept for a limited time. More details are in Anthropic’s documents at anthropic.com.

7.1a. Backup AI models: GPT (OpenAI, USA) and Kimi (Moonshot AI, China). If Claude is unavailable (an outage at Anthropic, overload, a technical error), the same request — the text of your request, the questionnaire and the relevant part of the plan — is automatically sent to a backup model so that the Service keeps working: first GPT via the OpenAI API, and if that is unavailable too, Kimi via the Moonshot AI API. Backup models receive the same data as Claude in section 7.1, with no passwords or payment details. Under OpenAI’s API terms, submitted data is not used to train models and is kept for a limited time for abuse monitoring. Moonshot AI processes data under its own API terms; data may be processed on servers in the People’s Republic of China. When Claude is available again, the Service switches back to it automatically.

7.2. Web search. To check facts, the AI model runs search queries through its provider’s web search tool (Anthropic, OpenAI or Moonshot AI). Search queries contain place names, dates and topics (for example, “museum opening hours in October”), not your name or Telegram ID.

7.3. Maps, weather and photos. Place names and coordinates are sent to OpenStreetMap (the Nominatim and OSRM services) to calculate routes and identify the destination, and to Open-Meteo for weather forecasts. The destination name (for example, “Lisbon Portugal”) is sent to the Wikimedia Commons (or Pexels) photo library to find a cover photo; the photo is stored on our server, so your browser does not contact the photo library. To show photos of the day’s places, the server opens the official websites of those places from the plan and takes their preview image. No personal data is sent to these services.

7.3a. Apple and Google. Sign-in with Apple or Google happens on their pages and is subject to their policies; the Service receives from them only the data listed in section 3.1a and verifies its digital signature.

7.3b. Speech recognition (OpenAI, USA). Voice recordings are sent to the OpenAI API only to convert them to text — without your name, Telegram ID or other account data. Under OpenAI’s API terms, submitted data is not used to train models and is kept for a limited time for abuse monitoring.

7.3c. Emails (Yandex Cloud Postbox, Yandex.Cloud LLC, Russia). The service emails from section 3.1a are sent through Postbox: it receives the email address, subject and text (the trip title and a link to it) and keeps a delivery log under its own rules. The address is not shared for any other purpose.

7.4. Telegram. Chats with the bot go through Telegram and are also subject to Telegram’s policy. Sign-in to the website with Telegram is verified using Telegram’s cryptographic signature.

7.5. Hosting. The database and files are stored on a hosting provider’s server in the Republic of Kazakhstan. The website works over HTTPS; the certificate is issued by Let’s Encrypt.

7.6. Payments. If you buy a trip or a subscription, the payment is processed by a payment service: Telegram (Stars in the bot), Robokassa or YooKassa (bank cards and SBP), Apple (in-app purchases in the iPhone app through the App Store). Card details are entered on the payment service’s page — the Service never receives or stores them. The Service keeps only the payment number, amount, date and what was bought — for your balance and for income accounting.

7.7. AI limitations. Replies are generated by a model and may contain errors. The Service marks unverified facts, but trip decisions are yours. The Service is not a travel agent and does not book services.

8. Who sees your data

• You — your trips, plans and chats, in the bot, on the website and in the app.
• The Operator — via a private admin panel: the list of users, their trips, requests and replies, the activity log and costs. Only the Operator has access to the admin panel; it is protected by Telegram sign-in.
• Service providers from section 7 — to the extent needed for their work.
• Government authorities — only upon a lawful request and to the extent established by law.
• People you send the route link to. For a finished plan the Service creates a view-only link with a long random address; search engines do not index these pages. The link shows the trip title, route and days — without bookings, files, chat or your name. Until you send it yourself, only you know it. You can turn it off on the trip page (“Turn off link”): it stops opening, and no new one is created until you turn it back on.

Apart from this, other users of the Service cannot see your data. We do not sell or rent out data.

9. Cross-border transfer

The data is stored in the Republic of Kazakhstan and transferred to the USA (Anthropic, and OpenAI during an outage) and, if both are unavailable, to China (Moonshot AI) for processing by the AI model; Telegram processes chats on its own infrastructure. The USA and China are not on the lists of countries that Russian and Kazakh law recognize as providing adequate protection of personal data. The transfer is based on your consent and only to the extent necessary for the Service to work.

10. Where and how long data is stored

11. Deleting data

11.1. A trip — the “Delete trip” button on its page on the website or in the app. The questionnaire, plan, chat and PDFs are deleted.

11.2. The account — “Delete account” in your profile or the /delete_me command in the bot. All trips, chats, name, username, settings and consent are deleted. Cost amounts and log entries remain without any link to you (anonymized).

11.3. Deletion happens immediately. Data disappears from backups when they are overwritten as scheduled (within 14 days).

11.4. You can also ask the Operator to delete data: pilotravelbot@gmail.com.

11.5. Data already sent to Anthropic, OpenAI or Moonshot AI is deleted under their terms; the Service no longer sends it.

12. Your rights

• To know what data about you is processed, why and by whom, and to get a copy — the “Download my data” button in your profile gives you everything stored about you in JSON format.
• To correct data — you can change the questionnaire by creating or adjusting a trip; your name and username are updated from Telegram.
• To delete data and withdraw consent — section 11.
• To object to processing and restrict it — by request to the Operator.
• To appeal the Operator’s actions to the authority responsible for protecting the rights of personal data subjects or to a court.

We respond to requests within no more than 10 business days of receipt. This period may be extended by no more than 5 business days with an explanation. To respond, we may need to make sure the request comes from the account owner (for example, by asking you to write from the same Telegram account).

13. Cookies and similar technologies

The main website cookie is tn_session: a random session token needed for sign-in. It is not accessible to page scripts (HttpOnly), is sent only over HTTPS (Secure) and is not sent to third-party sites (SameSite=Lax). It lasts 90 days since your last visit (the session is extended while you use the service) or until you sign out. If you choose a language at the bottom of the page, the website also remembers it in the lang cookie. If you type a trip sentence before signing in, it is kept in the pilo_phrase cookie for up to 3 hours so you can continue right after signing in; if you open a promo code link, the code is kept in the promo cookie for up to 7 days. The website also stores in your browser (localStorage and cache) trip pages for offline use, checklist ticks until they reach the server, and dismissed tips; saved trips are erased when you sign out.

The “Sign in with Telegram” button is loaded from telegram.org; Telegram may use its own cookies under its policy. We do not use advertising or analytics cookies.

14. How we protect data

• Encrypted connections (HTTPS) on the website, Telegram’s secure protocol in the bot.
• the admin panel — for the Operator only.
• The database stores hashes of sign-in tokens, not the tokens themselves; sign-in links are single-use and expire in 10 minutes. Your profile has a “Sign out on all devices” button — in case a phone is lost or you signed in on someone else’s computer.
• Protection of forms against request forgery (CSRF), a content security policy (CSP), a ban on embedding the website in other pages.
• Data isolation: the AI model sees only the trip of the person writing and has no access to the database or other people’s data.
• Filtering of model replies and protection against attempts to make the AI break the rules.
• Limits on login attempts to the server and on request rates to the website, OS security updates, daily database backups.

No system is perfectly secure. Please don’t send the Service data it doesn’t need (section 4).

15. Incidents

If there is a data leak or unauthorized access to data, the Operator will take measures to address it, notify affected users and, where required by law, the competent authority within the established time limits.

16. Children

The Service is intended for people over 18. If you are planning a trip with children, provide only what is needed for the plan (for example, ages to choose places), without names or documents. If you learn that a child is using the Service without parental consent, let the Operator know — we will delete the data.

17. Users from the Russian Federation

17.1. Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” applies to the processing of data of Russian citizens to the extent it applies to the Operator and the Service.

17.2. Consent to processing is given separately from this policy and any other documents — on a separate page with a separate checkbox (Part 1, Article 9 of 152-FZ). Until consent is obtained, the Service does not save trips or send requests to the AI model.

17.3. Cross-border transfer. The data is stored on a server in the Republic of Kazakhstan and transferred to the USA (Anthropic PBC, and OpenAI, L.L.C. during an outage) and to the People’s Republic of China (Moonshot AI, if both are unavailable). The USA and China are not included in the list of foreign countries providing adequate protection of the rights of personal data subjects. The transfer is carried out with your written (electronic) consent (Article 12 of 152-FZ).

17.4. Storage location. Please note: the Service’s database is not located in the Russian Federation. If it is important to you that your data is stored in Russia, do not use the Service or delete your account.

17.5. Your rights under Articles 14–17 of 152-FZ: to receive information about processing, to demand clarification, blocking or destruction of data if it is incomplete, outdated, inaccurate, unlawfully obtained or not needed for the stated purpose; to withdraw consent; to appeal the Operator’s actions to Roskomnadzor or a court.

17.6. Time limits. The Operator responds to a request for information within 10 business days (may extend by another 5 business days with a reasoned notice). When consent is withdrawn, processing stops and the data is destroyed within no more than 30 days, unless otherwise provided by law; in the Service, deletion by button happens immediately.

17.7. Data categories. The Service does not request special categories of data (health, etc.) or biometrics. If you provided such information in a questionnaire or message yourself, it is processed only to take it into account in the trip plan, based on your consent, and is deleted together with the trip.

17.8. Requests are accepted at: pilotravelbot@gmail.com. In your request, state how to address you, your Telegram ID (the /id command in the bot shows it) or the email you sign in with via Apple or Google, and what you are asking for.

18. Users from the Republic of Kazakhstan

18.1. Law of the Republic of Kazakhstan No. 94-V of 21.05.2013 “On Personal Data and Their Protection” applies to the processing of data of citizens of the Republic of Kazakhstan.

18.2. Personal data is stored in a database located in the Republic of Kazakhstan.

18.3. Collection and processing are carried out with your consent; cross-border transfer (to the USA — Anthropic and OpenAI; to China — Moonshot AI) is also based on consent, to the extent necessary for the Service to work.

18.4. You have the right to know whether the Operator holds your data and to receive it, to demand its modification, supplementation, blocking and destruction, to withdraw consent, and to appeal the Operator’s actions to the competent authority or a court.

19. Users from other countries

If your country’s data protection law applies to you (for example, the EU General Data Protection Regulation — GDPR), you have the rights it grants: access, rectification, erasure, restriction of processing, data portability (download in your profile), objection and withdrawal of consent, as well as the right to complain to a supervisory authority. The grounds and purposes of processing are in sections 5 and 6.

20. Changes to this policy

We may update the policy — for example, when new features or providers appear. A new version is published on this page with its date. We will announce significant changes (new data recipients, new purposes) in the bot in advance, and if a change requires new consent, we will ask for it.

21. Contacts

Operator: Aleksey Maltsev, Turgut Ozala st, house 7, 050011 Almaty, Kazakhstan.
Data requests: pilotravelbot@gmail.com.
Bot: @Pilotravelbot. Your Telegram ID — the /id command.