Privacy Policy
1. Overview
MAS Pilot LLC operates maspilot.io. This Privacy Policy explains how we collect, use, and protect information from users of our GSA MAS compliance platform.
2. Information We Collect
Account Information
When you create an account, we collect your name, work email address, organization name, and billing information. Billing information is processed by our payment provider and is not stored on MAS Pilot servers.
Transactional Data
The description below is the platform's target design. When you upload TDR data for checking, that data is designed to be processed in-memory for checking purposes only and not persisted to a database. Compliance results are temporarily stored to display your report and deleted after 30 days. Independent attestation of these controls (SOC 2 Type II) is planned; enterprise evaluators may request current status under NDA.
Usage Data
We collect information about how you use the Service to improve it. This data is not sold to third parties.
Access Request Form
When you request access, we collect the information you submit on the form: name, phone number, work email, company name, contract-type category, and an optional Unique Entity ID (UEI). We also record which of our own campaign links brought you to the site, where one applies: if you arrived through a tagged MAS Pilot link (for example from an email or advertisement we sent), the campaign labels contained in that link are stored alongside your request so we can tell which of our outreach reached you. These labels are values we place in our own links; they are not derived from you, and requests from untagged or direct visits carry none. We do not store your IP address, user agent, country, referring website, or browsing history from an access-request submission.
Your application is stored in our application database and, separately, in an internal sales workspace that only MAS Pilot's founder can access (the MAS Pilot GTM database). We also copy the application fields listed above to our customer relationship management (CRM) system so we can follow up on your access request and, where you have told us we may, contact you about MAS Pilot. The CRM copy holds the same fields you submitted, the campaign labels described above, and a reference number for your application; it never holds your IP address, user agent, or browsing data, and no TDR or contract data is ever placed in the CRM. Applications received before this update took effect are copied to the CRM only after we have notified the applicant by email, as Section 8 requires.
Contact Form
When you use our contact form, we collect the information you submit: your name, work email address, and, if you choose to provide them, your phone number, company name, topic, and message.
We store contact-form submissions in the MAS Pilot GTM database, our internal sales workspace, and send a notification to authorized MAS Pilot personnel so we can respond to your inquiry. Contact-form submissions are not copied to our CRM or any other customer relationship management system.
We do not store your IP address, browsing history, referring website, user agent, country, or other web-activity information in the contact-form submission record or the MAS Pilot GTM database.
Please do not submit sensitive contract, pricing, proprietary, controlled, or other confidential information through the contact form.
3. How We Use Your Information
- To provide and improve the Service
- To send compliance deadline alerts
- To process billing
- To communicate service updates and policy changes
- To follow up on access requests and, where permitted, to contact applicants about MAS Pilot
- To comply with legal obligations
We do not sell your personal information. We do not use your TDR data to train models.
4. Data Retention
Account information is retained for the duration of your subscription plus 90 days after cancellation. Compliance results are retained for 30 days. Transactional pricing data is not retained beyond the checking session. Application audit logs are retained for 7 years, aligned to federal contractor records-management practice under FAR Part 4 (including FAR 4.703 as applicable to contract-related records). FAR 4.703 governs contractor retention of contract-related records; MAS Pilot's audit-log retention is set to that baseline and is not itself a statement that FAR 4.703 prescribes a SaaS audit-log retention period.
Access requests, including the copy in our sales workspace and in the CRM, are retained for 12 months from your last activity and are then deleted or anonymized. Activity means an action you take: sending us a new request or message, replying to us, scheduling, accepting or attending a call with us, or subscribing. An access decision or reply sent by MAS Pilot alone, opening an email, or clicking an advertisement does not extend the retention period. We link your requests and messages by email address: activity from the same email address counts for all of them, and a request from a different address is kept and deleted separately. Unless you become a subscriber, a request is deleted or anonymized no later than 24 months after you first contacted us, even if there has been more recent activity. If you become a subscriber, your earlier requests are kept for 12 months after your last activity, with your subscription counting as activity, and your account information is retained as described above. Two exceptions apply: where you have asked us not to contact you, we keep a minimal suppression record, a hash derived from your email address rather than the address itself, so we can recognize the address if it is submitted again and keep honoring your request (this record is not anonymous: it can be matched against your address); and where law requires longer retention.
Contact-form submissions are retained for 12 months after your last activity and are then deleted or anonymized, unless a longer retention period is required by law. Unless you become a subscriber, they are deleted or anonymized no later than 24 months after you first contacted us, even if there has been more recent activity.
For contact-form submissions, activity means a new message or request you send us, a reply you send us, or a call you schedule, accept or attend with us. A reply or access decision sent by MAS Pilot alone, opening an email, or clicking a link does not extend the retention period. We link your submissions by email address: activity from the same email address counts for all of your submissions, and a message from a different address is kept and deleted separately.
We maintain internal notification copies only as long as needed to respond to and manage the inquiry and delete them under the same retention schedule, subject to applicable legal retention requirements.
5. Security
The Service uses encryption in transit today, and stored data in our managed database is encrypted at rest by our infrastructure provider. Audit logs for covered system and access events and regular security reviews are in place for MAS Pilot's own systems. Least-privilege access controls, and role-based access, multifactor authentication for customer accounts and application-level audit trails in the customer platform, are being implemented. See our Security page for the breakdown of what is live today versus planned.
Service providers and data location
We use a small number of service providers to operate the Service, and our data is hosted in the United States: cloud database and hosting providers for application and access-request data and, separately, for the internal sales workspace described in Section 2; a customer relationship management provider for the CRM copy of access requests; a payment processor for subscription billing; an email delivery service for transactional email (request confirmations and internal notifications); and a web hosting and security provider for hosting, DNS, and bot protection on maspilot.io. These providers process data on our behalf under their respective data-processing terms. A current list of named sub-processors is available upon written request.
Breach notification
If MAS Pilot becomes aware of a security incident that has resulted in, or is reasonably believed to have resulted in, unauthorized acquisition of unencrypted personal information, we will notify affected contractors within 72 hours of confirming the incident, unless a longer delay is required by law-enforcement request. Notifications will describe the categories of information involved, the steps MAS Pilot has taken in response, and the steps we recommend the contractor take. This commitment is consistent with the Maryland Personal Information Protection Act (MD Code Com. Law §14-3504), state-equivalent breach-notification statutes, and the GDPR 72-hour controller-notification standard where applicable. Where MAS Pilot acts as a processor, we will notify the responsible Controller without undue delay upon becoming aware of a breach so the Controller can meet its own notification obligations.
6. Your Rights
You may request access to, correction of, or deletion of your personal information at any time by contacting [email protected]. We will respond within 30 days.
7. Cookies
We use essential cookies for authentication and session management only. See our Cookie Policy for full details. We do not use advertising or third-party tracking cookies.
8. Changes
Material changes will be communicated via email at least 15 days before taking effect.
9. Contact
Privacy inquiries: [email protected] · Legal notices: [email protected] · MAS Pilot LLC · Washington, DC