Privacy Policy

1. Introduction

We at Airtap.AI, Inc. ("Airtap," "we," or "us") take your privacy seriously. This is especially important given the nature of our Airtap AI applications and services (the “Services”): Airtap's Services can operate cloud-hosted virtual devices, and on Android, your connected Android device, to open apps and process information to execute tasks on your behalf. We are committed to being transparent about what we collect, why we collect it, and how we use it.

This Privacy Policy applies to all users of the Services worldwide. Airtap.AI, Inc. is incorporated in the State of California, USA.

By using or accessing the Services, you acknowledge that you have read this Privacy Policy and consent to the collection, use, and processing of your personal data as described herein. You may withdraw consent at any time as described in Section 9.

2. What This Policy Covers

This Privacy Policy covers our collection, use, and disclosure of your personal data when you access or use the Services, including:

• The Airtap web application (airtap.ai/app);
• The PocketPilot iOS application;
• The Airtap Autopilot App installed on your Android device (Android only);
• The Cloud Phone service;
• All AI routines and tasks you configure.

This policy does not cover the privacy practices of Third-Party Services (such as Google, Slack, or WhatsApp) that you connect to Airtap. We encourage you to review the privacy policies of any Third-Party Service before connecting it to Airtap.

3. Data We Collect

3.1 Data You Provide Directly

We collect information you knowingly provide when you register and use the Services, including:

• Account data: depending on your chosen sign-in method, your name and email address obtained from your Google account (Google SSO), your name and email address provided by Apple when you use Sign in with Apple (which may be a private relay email address if you choose to hide your email), or your phone number when you sign in using phone number verification;
• Task and routine configuration: the instructions, prompts, and schedules you set for the AI;
• Support communications: messages, feedback, or attachments you send to us.

3.2 Data Processed Through Local Device Access (Autopilot App, Android Only)

This Section 3.2 applies only to the Airtap Autopilot App on Android. The PocketPilot iOS App does not access, read, or collect data from other applications installed on your Apple device.

When you install the Autopilot App on an Android device and grant the required permissions, the Airtap AI operates your device on your behalf to complete tasks you have configured. In doing so, the AI may access and process information displayed within the apps and content on your device at the time of execution. This may include content from apps such as Gmail, Google Calendar, WhatsApp, or Slack, to the extent necessary to complete your task. Data processed in this way is used solely to execute your configured tasks and is not retained beyond 30 days unless you have explicitly configured a routine that stores results.

3.3 Data Collected Automatically

When you use the Services, we automatically collect certain technical information, including:

• Device identifiers: hardware model, operating system version, unique device identifiers;
• Log data: IP address, browser type, pages visited, timestamps, session duration;
• Usage data: features used, routines created, tasks executed, task success/failure status;
• Diagnostic data: crash reports, error logs, and performance metrics;
• Approximate location: country and state/region inferred from your IP address;
• Precise device location (GPS): only where a task you have configured requires location data to complete, and only with your explicit permission at the time the task requires it.

3.4 Third-Party App Content

Any content from third-party apps is accessed only to the extent necessary to complete the tasks you have instructed Airtap to perform. Airtap's access to such content is limited to what is required to fulfill your specific instructions.

3.5 Cloud Phone Session Data

When your tasks execute on a Cloud Phone instance, we process the following data as part of the session:

• Session streams: the visual output (screen video) and audio of the Cloud Phone instance, transmitted to your device over an encrypted real-time connection (WebRTC) so you can observe and interact with the session. Session video and audio are streamed in real time and are not recorded or stored by Airtap by default.
• Control inputs: taps, text input, and navigation actions generated by the AI or by you during a session;
• App content displayed during execution: information shown on the Cloud Phone screen while your task runs, which may include content from Third-Party Services you have connected, processed solely to execute your task;
• Task prompts and results: the instructions you provide and the outputs the task produces, retained as described in Section 6.

4. How We Use Your Data

We use the data we collect for the following purposes:

• To provide the Services: authenticating your identity, managing your account, and executing AI tasks and routines on your behalf;
• To deliver scheduled routines: running your configured routines at the times you have set;
• To communicate with you: sending task completion notifications, service updates, and security alerts;
• To improve the Services: analyzing usage patterns, diagnosing errors, and developing new features, using anonymized and aggregated data;
• To improve AI performance: using anonymized and aggregated data derived from usage, subject to your consent preferences;
• To detect and prevent fraud and unauthorized access;
• To comply with legal obligations.

We process your personal data on the following lawful bases: performance of our contract with you (to provide the Services); your consent (for device access and data processing beyond contractual necessity); our legitimate interests (service improvement and security, where not overridden by your rights); and compliance with legal obligations.

5. How We Share Your Data

We do not sell your personal data to third parties. We share your personal data only in the following limited circumstances:

5.1 Third-Party AI Service Providers

To interpret and execute your tasks and routines, we share data with third-party artificial intelligence model providers. These providers are Google (Gemini), Anthropic, xAI, OpenAI, Groq, and AssemblyAI.

What we share with them: your task instructions and follow-up messages; images, files, and voice input you provide; conversation history, including prior messages and results; screenshots and extracted screen text from the Cloud Phone session while your task is running; the names of applications installed on the Cloud Phone; and content retrieved during task execution, such as webpages, search results, files, and messages. Where a task requires it, this may also include your name, email address, phone number, and precise location.

How we collect it: from the information you provide in the Services and from the Cloud Phone session while your task is running, as described in Sections 3.1 and 3.5.

How it is used: solely to interpret your request, complete the task or routine you have configured, and return the result to you. These providers act as processors on our behalf. They do not use your data to train their models.

Provider retention: these providers may retain requests and responses for a limited period for service operation and abuse monitoring. xAI currently retains API requests and responses for up to 30 days.

Consent: in the PocketPilot iOS application, we do not share any of this data with these providers until you have reviewed and agreed to the AI Task Processing disclosure shown in the app.

We require each of these providers to provide the same or equal protection for your personal data as described in this Privacy Policy.

5.2 Other Service Providers

We share data with vetted third-party vendors who perform services on our behalf, including cloud infrastructure providers, analytics providers, and notification services. All service providers are contractually bound to protect your data, use it only for the specified purpose, and provide the same or equal protection for your personal data as described in this Privacy Policy.

5.3 Legal and Regulatory Compliance

We may disclose your personal data to government authorities, law enforcement agencies, courts, or regulators where required by applicable law. We will endeavor to notify you of such requests where permitted by law.

5.4 Business Transfers

If Airtap is acquired, merges with another company, or sells substantially all of its assets, your personal data may be transferred as part of that transaction. We will notify you before your data becomes subject to a materially different privacy policy.

5.5 Aggregated and Anonymized Data

We may share aggregated and anonymized data that cannot reasonably identify you with partners, researchers, or for public reporting purposes.

6. Data Retention

We retain your personal data for the following periods:

• Account data: retained for as long as your account is active and for 12 months after account closure or deletion;
• Task execution data and app content accessed during task execution: retained for up to 30 days after task completion, unless you have configured a routine that explicitly stores results;
• Usage and diagnostic logs: retained for up to 12 months;
• Data required for legal compliance: retained for the period required by applicable law.

After the applicable retention period, we delete or anonymize your personal data. You may also request early deletion as described in Section 9.

7. Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption of data in transit, access controls, authentication requirements, and regular security reviews.

No method of electronic transmission or storage is completely secure. We cannot guarantee the absolute security of your data. If we become aware of a personal data breach that is likely to result in harm to you, we will notify you and the relevant authorities as required by applicable law.

You can help protect your data by: connecting only apps and accounts you intend Airtap to access; reviewing your configured routines regularly; unpairing any device you no longer wish Airtap to access; and keeping your credentials secure.

8. Your Privacy Rights

Depending on your location, you may have the following rights with respect to your personal data:

• Right to Access: obtain a summary of the personal data we process about you and the purposes for which it is processed;
• Right to Correction: request correction of inaccurate or incomplete personal data;
• Right to Erasure: request deletion of your personal data where we no longer have a lawful basis for retaining it;
• Right to Withdraw Consent: where our processing is based on your consent, you may withdraw consent at any time without affecting the lawfulness of prior processing;
• Right to Data Portability: where applicable, receive a copy of your personal data in a portable format;
• Right to Object: object to processing based on our legitimate interests.

Withdrawal of certain consents (such as for device access) will prevent the relevant features of the Services from functioning. These rights may be subject to limitations under applicable law.

9. How to Exercise Your Rights

Account deletion in the app. You can delete your Airtap account and associated personal data at any time directly within the Airtap mobile application by navigating to Settings > Account > Delete Account. Deletion takes effect as described in Section 6. If you created your account using Sign in with Apple, deleting your account also revokes the associated Sign in with Apple authentication tokens.

To exercise any other rights described in Section 8, or to withdraw consent to data processing, please contact us at:

• Email: privacy@airtap.ai

We will acknowledge your request within 48 hours and respond within 30 days. We may request information to verify your identity before processing your request. We will not charge a fee for reasonable requests.

10. Children's Privacy

The Services are not directed at children under the age of 18. We do not knowingly collect personal data from minors. If we discover that we have collected personal data from a child under 18, we will delete it promptly. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@airtap.ai.

11. Cross-Border Data Transfers

Airtap.AI, Inc. is headquartered in the United States, and our Services are hosted on infrastructure located in the United States and potentially other countries. By using the Services, you acknowledge that your personal data will be transferred to, stored, and processed in the United States.

We take steps to ensure that cross-border transfers of your personal data are carried out in compliance with applicable law, including through the use of contractual safeguards with service providers.

12. Jurisdiction-Specific Rights

Depending on your jurisdiction, additional rights may apply:

California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act, including the right to know, right to delete, right to opt-out of sale, and right to non-discrimination. Airtap does not sell personal information. To submit a California privacy request, contact privacy@airtap.ai.

European Residents (GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have rights under the GDPR or applicable national law, including rights of access, rectification, erasure, restriction, portability, and objection. You also have the right to lodge a complaint with your local supervisory authority.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on our website and/or sending you an email or in-app notification before the changes take effect. Where required by law, we will obtain your fresh consent for materially changed data processing activities. Your continued use of the Services after changes take effect constitutes your acknowledgment of the updated policy.

14. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or our handling of your personal data, please contact:

• Privacy inquiries: privacy@airtap.ai
• Legal inquiries: legal@airtap.ai
• Postal address: Airtap.AI, Inc., 2105 South Bascom Avenue, Suite 380, Campbell, CA 95008, USA