Privacy Policy

1. Overview

AK AutoPilot ("we," "us," or "our") provides done-for-you client onboarding automation services for bookkeeping and Client Advisory Services (CAS) firms. This Privacy Policy explains how we collect, use, store, and protect data in connection with our services, including our use of Google APIs and SMS communications.

By using our services or visiting akautopilot.com, you agree to the practices described in this policy. If you do not agree, please do not use our services.

2. Google API Data Use & OAuth

AK AutoPilot integrates with Google services — including Google Calendar, Gmail, and Google Workspace — to automate client onboarding workflows for our firm clients. We use OAuth 2.0 to obtain explicit, revocable permission before accessing any Google account data.

What we access via Google APIs

Google Service	OAuth Scope	Purpose
Google Calendar	calendar.events	Create kickoff call calendar invites for new clients automatically
Gmail	gmail.send	Send automated onboarding emails (QBO invites, welcome packets) on behalf of the firm
Google Workspace	userinfo.email, userinfo.profile	Identify the authenticated firm account and personalise automation output

How we handle Google API data

• Minimum access only. We request only the OAuth scopes necessary to deliver the specific automation feature described above. We do not request broad access to your Google account.
• No transfer to third parties. Data obtained through Google APIs is not transferred to, shared with, or used by any third party, except as necessary to operate the automation (e.g., passing a calendar event to your Karbon or TaxDome account as part of the onboarding workflow).
• No use for advertising. Google API data is never used for advertising, marketing, or profiling purposes.
• No AI training. Google API data is not used to train machine learning or AI models.
• Human review limited. We do not read, review, or analyse the content of your Gmail or Google Calendar data beyond what is technically necessary to execute the automation you have configured.
• Revocation. You may revoke AK AutoPilot's access to your Google account at any time via your Google Account permissions page. Revoking access will disable the automation features that rely on Google services.

3. SMS Communications

As part of our client onboarding automation service, AK AutoPilot may send automated SMS messages to end-clients of the bookkeeping firms we serve — for example, reminders to submit outstanding documents or confirm a kickoff call time.

Consent

SMS messages are only sent to individuals who have provided explicit prior written consent to receive automated text messages in connection with their bookkeeping firm's onboarding process. This consent is captured at the point of engagement (typically when signing an engagement letter or completing an intake form).

Message types

• Document request reminders (e.g., "Your bookkeeper is waiting on your bank statements")
• Kickoff call confirmations and reminders
• Onboarding status updates

Frequency

Message frequency varies based on onboarding progress. Typically no more than 3–5 messages during the onboarding period. Standard message and data rates may apply.

Opt-out

You may opt out of SMS messages at any time by replying STOP to any message you receive. After opting out, you will receive a single confirmation message and no further SMS communications will be sent. To re-enroll, reply START.

Help

Reply HELP to any SMS for assistance, or contact us directly at akshar@akautopilot.com.

SMS provider

We use Twilio, Inc. to deliver SMS messages. Twilio's privacy policy is available at twilio.com/legal/privacy. Phone numbers collected for SMS are not shared with any party other than Twilio for message delivery.

4. Data We Collect

From firm clients (bookkeeping firms we serve)

• Business name, contact name, and email address
• Google and third-party API credentials (OAuth tokens, stored securely and never shared)
• Workflow configuration and process documentation
• Billing information (processed via Stripe; we do not store card numbers)

From end-clients (clients of the bookkeeping firms)

• Name and email address (to create accounts in Karbon, TaxDome, QBO)
• Phone number (if SMS reminders are enabled and consent is given)
• Business entity type (to personalise document checklists and welcome packets)

From website visitors (akautopilot.com)

• Name and email address submitted via contact or booking forms
• Standard server logs (IP address, browser type, pages visited) — used only for security and analytics

5. How We Use Your Data

• To build, operate, and maintain onboarding automations on your behalf
• To send automated communications (emails, SMS) as part of the onboarding workflow
• To generate personalised documents (welcome packets, document checklists) using AI
• To monitor automation health and resolve errors
• To communicate with firm clients about their account and service updates
• To comply with legal obligations

6. Data Sharing & Third Parties

We share data only with the following categories of sub-processors, strictly for the purpose of delivering our service:

• n8n — workflow orchestration platform (self-hosted on Hetzner; data does not leave our server)
• Twilio — SMS delivery
• Anthropic (Claude API) — AI-generated document personalisation
• Airtable or Supabase — per-client onboarding state tracking
• Karbon / TaxDome / QuickBooks Online / Ignition / Slack — third-party platforms your firm already uses, to which we send data as part of the automation
• Stripe — billing and payment processing

We do not sell, rent, or trade personal data. We do not share data with advertising networks or data brokers.

7. Data Retention

We retain firm client data for the duration of the active service agreement and for 12 months thereafter, to support offboarding and any disputes. End-client data passed through automations is not stored by AK AutoPilot beyond what is required to complete the onboarding workflow — it lives in your firm's own tools (Karbon, QBO, TaxDome).

You may request deletion of your data at any time by emailing akshar@akautopilot.com. We will action deletion requests within 30 days.

8. Security

We take reasonable technical and organisational measures to protect data against unauthorised access, loss, or disclosure. These include:

• OAuth tokens stored encrypted at rest
• Self-hosted n8n instance on a private VPS with restricted access
• HTTPS enforced on all web properties
• Access to client data limited to Akshar Amin (sole operator)

No method of transmission over the internet is 100% secure. We will notify affected parties promptly in the event of a data breach.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Request deletion of your personal data
• Object to or restrict processing of your personal data
• Withdraw consent at any time (including Google OAuth access and SMS consent)
• Lodge a complaint with a data protection authority

To exercise any of these rights, contact us at akshar@akautopilot.com.

10. Contact Us

This policy may be updated from time to time. Material changes will be communicated to active clients by email. Continued use of our services after updates constitutes acceptance of the revised policy.