Privacy notice

Who is responsible

Autopilot is operated by Sorin Cioban trading as Autopilot, based in London, UK. I am the controller of the personal information described in this notice.

For enquiries, privacy questions or requests about your information, email sorin@sorincioban.com.

This notice covers this website, initial business conversations and business contact research. Information handled on a client's behalf during a project is covered by the arrangements agreed for that project.

When you enquire

The form asks for your email address. It creates an enquiry reference and sends me a notification, followed by an acknowledgement to you. The email services also process message content, sending times and delivery information. Correspondence may include your name, role, company and anything you choose to share.

I use this information to answer you, arrange a conversation and discuss or provide services. Where you personally request steps towards a contract, that is the legal basis. For general enquiries and people contacting me on behalf of a business, I rely on my legitimate interest in responding to relevant business requests.

Providing information is voluntary, but I need an email address to respond through the form. Please avoid sending confidential client information during an initial enquiry.

Business contact research and outreach

I may record a business contact's name, professional role, published business email, company, source links and notes about the relevance of my services. Sources include company websites, public professional pages and Companies House. An initial message identifies where I found the contact details.

I rely on my legitimate interest in identifying and discussing relevant business opportunities. I assess relevance, use limited professional information and check the rules applicable to the recipient before contacting them. Public availability alone does not mean someone has consented to marketing.

You can object to direct marketing at any time. Reply to a message asking me to stop, or email sorin@sorincioban.com. I keep a minimal do-not-contact record so that you are not added to future outreach.

Website operation and analytics

Hosting and security services process technical request information, which can include IP address, browser information, requested pages and timestamps, to deliver and protect the site. The form uses a temporary coded value derived from the IP address to limit repeated submissions. New enquiry notifications do not include IP addresses or browser details, and the form no longer writes enquiries to a separate lead database.

Vercel Web Analytics provides aggregate information about visits, such as page views, referring sites, approximate location and device or browser type. It does not use analytics cookies. The website strips query strings and fragments from the page URLs it submits for analytics and does not send form email addresses as analytics events.

The legal basis is my legitimate interest in operating a secure website and understanding how its public pages are used. The site does not use advertising pixels or behavioural advertising.

Services used to handle information

• Vercel hosts the website and provides security, technical logs and aggregate analytics.
• Resend sends enquiry notifications and acknowledgements and processes delivery records.
• Cloudflare provides domain services and forwards email sent to my contact address.
• Google Gmail holds my business correspondence, including forwarded messages.
• OpenAI tools assist with business research and drafting. Relevant professional contact information and business correspondence may be used for those tasks. I review the results; submitting the website form does not itself send your enquiry to an AI model.

Earlier versions of the enquiry process used Supabase for lead records, including email, IP and browser information, and could send notifications to iCloud Mail. Any records remaining from that process are covered by the same retention and rights provisions below.

I do not sell contact information. Information may also be shared with professional advisers or authorities where necessary to meet a legal obligation or establish, exercise or defend legal claims.

Where information is processed

These services operate internationally. Information can be processed outside the UK, including in the United States and other countries where providers and their service providers operate.

The providers' published terms describe their transfer arrangements. These include UK-recognised adequacy arrangements, such as the UK Extension to the EU–US Data Privacy Framework where applicable, and standard contractual clauses with UK transfer terms. See the Vercel, Resend, Google and other provider policies linked above. You can contact me for details or copies of the safeguards relevant to your information.

How long information is kept

Retention depends on the purpose of the record. I assess whether an enquiry or project is still active, whether there is a reasonable prospect of further relevant work, and whether information is needed for a contract, accounting, a legal obligation or a dispute. Information no longer needed for these purposes is removed from working records.

Uncontacted research is assessed for continued relevance before use. An objection ends marketing use; only the information needed to honour the objection is kept for that purpose. Provider logs, deleted-item folders and backups can have separate retention cycles governed by the relevant service, so removal from working records is not a promise of immediate deletion from every backup.

The form's temporary abuse-prevention records expire from use after one hour and are cleared as further requests are processed or the server instance ends. They are separate from the providers' security and delivery logs.

Your rights and choices

Depending on the circumstances, you can ask to access, correct, erase or restrict the use of your information, object to processing based on legitimate interests, and receive a portable copy where that right applies. The right to object to direct marketing applies at any time. If I rely on consent for a particular activity, you can withdraw it without affecting earlier lawful use.

I do not use your information for solely automated decisions that have legal or similarly significant effects on you.

Send requests to sorin@sorincioban.com. I may need proportionate information to confirm your identity. You can also complain to the Information Commissioner's Office.

Changes to this notice

I update this notice when the way information is handled changes. The date above identifies the current version.