Privacy Policy

Who we are

IRAPilot ("IRAPilot", "we", "us") provides SIMPLE IRA setup software, document preparation, and deadline reminders for small businesses. This policy explains what personal information we collect through www.irapilot.com and the IRAPilot service, how we use and share it, and the choices and rights you have. It applies to business owners and administrators who use IRAPilot and to visitors to our website.

Information we collect

We collect the following categories of personal information:

• Account and contact information: name, email address, phone number, and role at your company, collected when you contact us, leave an email for deadline reminders, or create a passwordless account.
• Business information: legal business name, EIN, address, entity type, payroll provider name, and employee count, used to design your plan and fill your adoption packet.
• Plan design information: the contribution formula, eligibility choices, and any employee details you enter so we can prepare your packet and employee notices. We do not ask for Social Security numbers or bank details, and packet fields for them are left blank for you to complete by hand.
• Usage information: pages visited, approximate location derived from IP address, browser and device type, collected through server logs when you use the website.

The service is free, so we do not collect payment or billing information. We do not collect personal information from consumers for advertising purposes, and we do not buy personal information from data brokers.

How we use information

We use personal information to:

• Prepare your adoption packet and employee notices, estimate tax credits, and send deadline reminders.
• Remind you to file your state-mandate exemption yourself (for example, on the CalSavers employer portal) and keep records of your progress.
• Provide customer support, respond to inquiries, and send service and compliance notices.
• Improve the website and service, and monitor for security, fraud, and abuse.
• Comply with legal obligations, including IRS and Department of Labor rules that apply to retirement plans.

Where GDPR or a similar law applies, our legal bases are performance of a contract, compliance with legal obligations, and our legitimate interests in operating and securing the service.

How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share personal information only with:

• Service providers that host our infrastructure and deliver email, each bound by contract to use the information only to provide services to us.
• An AI provider (OpenRouter) that processes the optional business description you enter at the start of setup, only to suggest defaults for the next questions. The description is not stored beyond your session, and this step is optional.
• Government agencies when the law requires disclosure.
• A successor entity in a merger, acquisition, or asset sale, subject to this policy.

Cookies and analytics

The website does not use advertising cookies or third-party tracking pixels. We use only the cookies and similar technologies needed to operate the site and keep your session secure, and privacy-respecting, aggregate analytics to understand site usage. Because there is no accepted standard for Do Not Track signals, the site does not respond to them, though our practices do not vary based on them: we do not track visitors across other websites in any case.

Data retention

We retain your account and plan records for as long as you use IRAPilot and afterward for a reasonable period, since IRS and Department of Labor record-keeping rules can require you to keep plan records several years past a plan's termination. Website usage logs are retained for a shorter operational period. When retention periods end, we delete or de-identify the information.

Security

We protect personal information with encryption in transit and at rest, access controls limiting who can view plan data, and monitoring of our systems. Compensation and plan design data are treated as sensitive and restricted to the personnel and systems that need them to provide the service. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we notify affected users and regulators of breaches as the law requires.

Your privacy rights

Depending on where you live, you may have the right to know what personal information we hold about you, receive a copy of it, correct it, delete it, or restrict how it is used. California residents have these rights under the CCPA/CPRA, including the right to know the categories of personal information collected and shared (described above), the right to delete, the right to correct, and the right not to be discriminated against for exercising them. Because we do not sell or share personal information for advertising, there is nothing to opt out of, and we do not use sensitive personal information for purposes that trigger a right to limit.

To exercise any right, email support@irapilot.com. We verify requests using the email associated with your account and respond within the time the law requires. Some plan records must be retained despite a deletion request because federal retirement-plan rules require it, and we will tell you when that applies. You may also use an authorized agent to submit a request on your behalf.

If you are in the European Economic Area or the United Kingdom, you may also lodge a complaint with your local supervisory authority.

Children

The website and service are for businesses and their employees. We do not knowingly collect personal information from children under 16, and the service is not directed to them. If you believe a child has provided us personal information, contact us and we will delete it.

Changes to this policy

When we make material changes to this policy, we will update the effective date above and notify account holders by email or an in-product notice before the changes take effect. Continued use of the service after the effective date means the updated policy applies.

Contact us

Questions or requests about this policy or your personal information: support@irapilot.com. You can also write to IRAPilot, Attn: Privacy, at the mailing address provided on request through that email.