88Pilot Privacy Policy
Effective Date: 9-17-2026 • Last Updated: 9-17-2026
88 Pilot ("88Pilot," "we," "us," or "our") provides an AI-powered statutory HR and multi-state compliance operating system (the "Service") accessible at 88pilot.com and related applications. This Privacy Policy explains how we collect, use, disclose, and safeguard information in connection with the Service.
This Policy is written for a United States audience. If you access the Service from outside the United States, please note the Service is designed for US-based employers and US employment law compliance, and is not intended for use by, or targeted at, individuals or organizations outside the United States.
Please read this Policy carefully. By creating an account, accessing, or using the Service, you agree to the collection and use of information as described here. If you do not agree, please do not use the Service.
1. Scope and Roles: Who This Policy Covers
88Pilot is a business-to-business ("B2B") platform. Our customers are employers ("Customers," "you," when referring to the organization) who use the Service to manage statutory HR compliance for their own workforce. Because of this structure, we act in two different capacities, and different parts of this Policy apply depending on which capacity is relevant:
- As a Data Controller— for information about our Customers' own personnel who use the Service directly (e.g., an HR Manager's account login, name, work email, and billing contact information), and for information we collect about visitors to 88pilot.com. In this capacity, we determine the purposes and means of processing, and this Policy governs that processing directly.
- As a Data Processor / Service Provider— for information about a Customer's broader workforce that is synced into the Service via HRIS integrations (e.g., BambooHR, Google Workspace), uploaded via CSV, or entered manually into Workforce Management, Knowledge Base, Training, or Audit Preparation modules ("Workforce Data" and "Customer Content"). In this capacity, the Customer (your employer) is the data controller, and we process this information solely on the Customer's behalf and instructions, as described in our Customer agreements and any applicable Data Processing Addendum ("DPA").
If you are an employee whose data has been added to 88Pilot by your employer (for example, through an HRIS sync, CSV upload, or training assignment), your employer is the appropriate party to contact regarding access, correction, or deletion of your data. We will direct such requests to the relevant Customer where required to do so, and will support the Customer in fulfilling their obligations.
2. Information We Collect
2.1 Account and Registration Information (Controller)
When a Customer creates an account, we collect:
- Full name, work email address, and password (or SSO credentials)
- Company/organization name and affiliation
- Role designation (Admin or Member)
- Phone number, if provided for account recovery or support
2.2 Organization Scope and Configuration Data (Controller/Processor)
Information entered during the Company Scope Configuration Wizard, including:
- Operating US states and jurisdictions
- Entity type and industry sector
- Headcount tier and workforce composition
- Work model, facility types, worker classifications, payroll systems used
- Active benefit programs and specialized compliance flags (e.g., PHI/HIPAA exposure, government contractor status)
2.3 Workforce Data (Processor, on behalf of Customer)
Where a Customer connects an HRIS (BambooHR, Google Workspace), uploads a CSV roster, or manually enters employee records, we process:
- Employee full name, work email address, department, worker classification (W-2/1099), primary work state, and employment status
- Audit and risk assessment responses tied to specific employees or departments where applicable
We do not control what Workforce Data a Customer chooses to input, and we process it only to provide the Service to that Customer.
2.4 Knowledge Base and Document Content (Processor, on behalf of Customer)
Documents uploaded to the Knowledge Base (existing policies, handbooks, templates, agreements) and drafts created in the Policies and Documents Studio, including AI-generated modifications and version history. These documents are indexed into private, organization-specific vector embeddings and are not shared across Customer accounts.
2.5 AI Co-Pilot and Communications Data
- Conversation content submitted to the AI Co-Pilot, including questions, uploaded context, and generated responses
- Legal Ticket content submitted for attorney escalation, including the underlying conversation, question, and any attached documents
- Support communications, feedback, and correspondence with our team
2.6 Usage and Device Data
- Log data such as IP address, browser type, device identifiers, pages viewed, and timestamps
- Feature usage metrics (e.g., queries run, policies generated, audits completed) used to enforce plan limits and improve the Service
- Cookies and similar technologies (see Section 8)
2.7 Payment and Billing Information
Billing contact name, email, and transaction details. Full payment card information is processed by our third-party payment processor and is not stored on our servers.
2.8 Information from Integrations
When a Customer connects BambooHR, Google Workspace, or Slack, we receive data made available through those platforms' APIs pursuant to the Customer's authorization (e.g., employee directory fields, organizational units, active/suspended status, or channel identifiers for notification delivery).
3. How We Use Information
We use information described above to:
- Provide, operate, and maintain the Service, including generating policy drafts, running audit modules, tracking training completion, and delivering compliance alerts
- Power the AI Co-Pilot, Risk Centre and AI Policy Co-Author, including retrieval-augmented generation grounded in a Customer's private Knowledge Base
- Route attorney escalation requests (Legal Tickets) to licensed counsel in our attorney network
- Sync and reconcile workforce records from connected HRIS integrations
- Process payments, manage subscriptions, and enforce plan-based usage limits
- Send transactional communications (deadline reminders, training notifications, alert notifications) via email or Slack, as configured by the Customer
- Monitor, secure, and troubleshoot the Service, including detecting fraud, abuse, or security incidents
- Improve and develop the Service, including analyzing aggregated or de-identified usage patterns
- Comply with legal obligations and enforce our Terms of Service
We do not use Customer Content or Workforce Data to train general-purpose or cross-customer AI models. Knowledge Base embeddings and organization-specific data remain isolated to the originating organization's private partition.
4. How We Share Information
We do not sell personal information. We disclose information only as follows:
4.1 Service Providers and Subprocessors
We share information with vendors who perform services on our behalf, including cloud hosting, AI model providers, payment processing, email/notification delivery, and customer support tooling. These providers are contractually bound to use information only to provide services to us and to maintain appropriate confidentiality and security safeguards.
4.2 Attorney Network
When you submit a Legal Ticket or request attorney review of a document, relevant conversation content, documents, and limited account/organization information are shared with the licensed Labor and Employment Counsel handling that request, solely to provide the requested legal review.
4.3 HRIS and Communication Integrations
Where a Customer enables an integration (BambooHR, Google Workspace, Slack), information flows to and from those platforms consistent with the permissions the Customer grants during OAuth connection.
4.4 Within a Customer Organization
Workforce Data and Customer Content are visible to authorized users within that Customer's own organization account, based on the roles and permissions the Customer configures (Admin/Member).
4.5 Legal and Safety Reasons
We may disclose information where required by law, subpoena, or legal process, or where we believe disclosure is necessary to protect the rights, property, or safety of 88Pilot, our Customers, or others.
4.6 Business Transfers
If 88Pilot is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to confidentiality obligations consistent with this Policy.
5. Data Retention
We retain information for as long as necessary to provide the Service and for legitimate business purposes, including:
- Account and Workforce Data: for the duration of the Customer's subscription, and for 90 days following cancellation to allow for data export and account reactivation, after which it is deleted or de-identified, unless a longer period is required by law or by Customer instruction.
- AI Co-Pilot conversations and Legal Tickets: retained to maintain thread history and audit trails, consistent with the Customer's account settings, until deletion is requested or the account is closed.
- Billing records: retained as required for tax, accounting, and legal compliance purposes.
- Audit and training records: retained as configured by the Customer, recognizing that certain statutory retention schedules (e.g., I-9, OSHA recordkeeping) may require longer retention windows, which remain the Customer's responsibility to configure appropriately.
6. Data Security
We implement administrative, technical, and physical safeguards designed to protect information, including:
- Encryption in transit (TLS) and at rest (AES-256)
- Organization-specific, isolated data partitions, with Knowledge Base embeddings never shared across accounts
- Role-based access controls and configurable session timeout
- Admin-level ability to revoke active sessions
- SOC 2 Type II compliance (available at the Enterprise tier)
- HIPAA-aware data handling practices for Customers uploading PHI-adjacent documentation
No system is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting personal information, we will notify affected Customers as required by applicable law and our contractual commitments.
7. HIPAA and Protected Health Information
88Pilot is not, in most configurations, a covered entity under HIPAA. Where a Customer's use of the Service involves Protected Health Information (PHI) or PHI-adjacent documentation (e.g., HIPAA Business Associate Agreement management, healthcare-sector audit modules), and 88Pilot qualifies as a "business associate," we will enter into a Business Associate Agreement (BAA) with that Customer governing the handling of such information, which supplements and, where inconsistent, controls over this Policy with respect to PHI.
8. Cookies and Tracking Technologies
We use cookies and similar technologies to:
- Keep you logged in and maintain session state
- Remember preferences (e.g., sidebar collapse state, dashboard filters)
- Understand feature usage and improve the Service
- Support security functions such as fraud detection
You can control cookies through your browser settings. Disabling certain cookies may limit functionality of the Service. For more details, see our Cookie Policy.
9. Your Choices and Rights
9.1 Account Information
You may review and update your account information at any time through Account and Profile Settings.
9.2 Communications
You may opt out of non-essential email notifications through in-app settings, though transactional and compliance-critical alerts (e.g., statutory deadline reminders configured by your employer) may not be optable-out-of at the individual level, as they are configured by the Customer administrator.
9.3 State Privacy Law Rights
Depending on your state of residence and applicable law (which may include laws such as the CCPA/CPRA and similar state statutes), you may have rights to:
- Know what personal information we hold about you
- Request access to or a copy of that information
- Request correction of inaccurate information
- Request deletion of your information, subject to legal exceptions
- Opt out of "sale" or "sharing" of personal information (we do not sell personal information)
- Not be discriminated against for exercising these rights
Where you are an employee whose data was added by an employer Customer, we will typically direct such requests to your employer as the data controller, consistent with our role as a processor, unless direct fulfillment is required by law. To submit a request, contact us using the information in Section 13.
9.4 Do Not Track
We do not currently respond to browser "Do Not Track" signals.
10. Children's Privacy
The Service is intended for business use by adult employees and representatives of Customer organizations. We do not knowingly collect personal information from individuals under 18.
11. Third-Party Links and Services
The Service may reference or link to third-party statutes, government agency websites, or integrated platforms (e.g., BambooHR, Google Workspace, Slack, payroll systems). This Policy does not apply to those third-party services, and we encourage you to review their respective privacy policies.
12. Changes to This Policy
We may update this Policy from time to time to reflect changes in our practices, the Service, or legal requirements. We will post the updated Policy with a revised "Last Updated" date, and where changes are material, we will provide additional notice (such as email or an in-app notification) to Customer administrators.
13. Contact Us
If you have questions about this Privacy Policy, or wish to submit a data subject request, please contact us at:
88 Pilot Helpdesk Email:
support@88pilot.comIf you are an employee of a Customer organization and your question relates to data your employer has added to the Service, we may direct you to contact your employer's HR or People Operations team directly.