Legal · Privacy
Privacy policy
This page explains what personal data Pilgud collects, why, who else touches it, and what you can ask us to do with it. Written to be read, not skimmed past.
Who is responsible for your data
The controller of personal data described on this page is R.J. RADIANT OÜ (registry code 17343069, Tallinn, Estonia), which runs the Pilgud brand – the website pilgud.com, the Pilgud Agent app at agent.pilgud.com and Pilgud Services.
Contact for anything on this page: info@pilgud.com, +372 510 8005. We reply within one month at the latest, usually much sooner.
The short version
- We collect what you give us (a contact form, an account, your business details) and what we need to run your ads if you connect an ad account.
- We don't sell personal data and we don't use it for anyone else's marketing.
- pilgud.com sets Google Analytics and Google's advertising cookies only if you allow them in the cookie banner; without that we count visits with cookieless Vercel Web Analytics.
- You can ask to see, correct or delete your data at any time.
What we collect and why
| Where | What | Why | Legal basis |
|---|---|---|---|
| Contact form on pilgud.com | Name, email, website, what you need, budget, timing, your message, the page you sent it from, a one-way hash of your IP address | To reply and discuss working together; the IP hash only limits spam (5 messages an hour per address) | Steps before a contract and our legitimate interest in answering (GDPR art 6(1)(b) and (f)) |
| Waitlist for Pilgud Agent (the sign-up page) | Name, email, website, type of business, main goal, the page and language you used, a one-way hash of your IP address, and – if you came through a tagged link, such as one of our own ads – that link's tags (utm_* and the ad network's click id, fbclid or gclid). If you join with Google: the name and email address your Google account shares with us | To tell you when Pilgud Agent opens for you and to understand who is waiting; the IP hash only limits spam | Consent (art 6(1)(a)); you can leave the list at any time |
| Pilot application (pilgud.com/pilot) | Name, email, phone, website, what your business does, whether you have run Meta ads, your monthly ad budget range, what the ads should bring, your optional message, when you gave consent, the page and language you used, a one-way hash of your IP address, and – if you came through a tagged link – that link's tags (utm_*, fbclid or gclid). Our own notes on the application and its status (new, call booked, pilot client, not a fit). If you confirm your email: when you did, and three sample ads our agent makes from your public website, with the pictures on that site it used | To assess your application, show you what the agent makes, call you about the pilot and, if you are not picked, tell you when Pilgud Agent opens; the IP hash only limits spam | Consent (art 6(1)(a)), given on the form; you can withdraw it at any time |
| Paying for a Pilgud Agent plan | Plan, billing status and invoice details. Card details go straight to Stripe; we never see or store them | To charge for the plan you chose and keep accounts | Contract and legal obligation (art 6(1)(b), (c)) |
| Email and phone | Whatever you send us | To answer and do the work | Contract or legitimate interest (art 6(1)(b), (f)) |
| GEO readiness checker | The web address you enter and, briefly, your IP address | To analyse the page and to stop abuse | Legitimate interest (art 6(1)(f)) |
| GEO checker report by email (optional) | Name, company, email, and the analysed address with its score summary | To send the full list and plan you asked for | Consent and legitimate interest (art 6(1)(a), (f)) |
| Pilgud Agent account | Email address, login (password or a one-time code), language | To give you an account and keep it secure | Contract (art 6(1)(b)) |
| What you give the agent | Your website address, brand profile, prices, rules and limits, photos and files, chat messages | To do the marketing work you ask for | Contract (art 6(1)(b)) |
| A connected Meta ad account | An access token (stored encrypted), your ad accounts, Pages and Instagram accounts, campaigns, ads and their results | To build campaigns you approve and report results | Contract (art 6(1)(b)) |
| Clients of Pilgud Services | Contact people, contracts, invoices | To deliver the work and keep accounts | Contract and legal obligation (art 6(1)(b), (c)) |
We don't need, and ask you not to send us, special categories of data (health, beliefs and the like).
Leads from your ads: we are your processor
When your ads collect enquiries – names and contact details of people who respond – you are the controller of that data and we process it on your behalf, only to show it to you and measure what your ads bring in. We sign a data processing agreement with every client whose leads we handle. Questions from those people about their data go to you, and we help you answer them.
Who else processes the data
We use a small number of service providers. Each processes data only on our instructions. Most do so under a data processing agreement; where a provider offers only its published terms – today Higgsfield, which makes images and videos for ads – we name it and link those terms on the subprocessors page. The full list of those that process our clients' data in Pilgud Agent, with what they do and where: subprocessors.
| Provider | Role | Where |
|---|---|---|
| Supabase | Database and file storage for Pilgud Agent and contact messages | EU (Frankfurt) |
| Vercel | Hosting of pilgud.com and agent.pilgud.com | Global network, US company |
| Google Workspace | Our email | EU / US |
| Anthropic | AI model that writes and reviews text inside Pilgud Agent | US |
| Google (Gemini API) | AI model that makes images inside Pilgud Agent | US / EU |
| OpenAI | AI model that makes the main ad pictures inside Pilgud Agent, from the ad brief only (no client photos) | US |
| Higgsfield | AI models for images inside Pilgud Agent (fallback) | US |
| Firecrawl | Reads the public pages of your website when you ask the agent to | US |
| Meta Platforms | The ad platform, only when you connect your account | EU (Meta Platforms Ireland) / US |
| Web3Forms | Delivers the optional GEO checker report request to our inbox | US |
| Resend | Sends our emails from the contact form and the waitlist: the note to our team and the confirmation to you | EU (Ireland) sending region, US company |
| Stripe | Payments for Pilgud Agent plans | EU (Stripe Payments Europe, Ireland) / US |
| Google (Sign in with Google) | Confirms your name and email address, only if you choose to join the waitlist with Google | US / EU |
| Google Analytics and Google Ads (Google Ireland Ltd) | Count visits, and measure which of our ads brought a visitor and whether they applied for the pilot — only after you allow cookies | EU / US |
| Meta Pixel (Meta Platforms Ireland Ltd) | Measure which of our Facebook and Instagram ads brought a visitor and whether they applied for the pilot — only after you allow cookies | EU / US |
We send each provider only what its task needs. When a provider is outside the European Economic Area, the transfer relies on the EU–US Data Privacy Framework where the provider is certified under it, or on the European Commission's Standard Contractual Clauses.
We don't sell personal data, and we don't hand it to anyone for their own marketing.
Cookies and similar storage
pilgud.com sets analytics and advertising cookies only with your permission. Without it, the site stores one item in your browser: your language choice (pg-lang, in local storage), so the next page opens in the language you picked, plus your cookie choice itself (pg-consent, in local storage). Neither leaves your device.
Google Analytics and Google Ads, only if you press "Allow". If you allow it in the cookie banner, the site loads Google's tag (Google Ireland Ltd). Google Analytics sets its cookies (_ga, _ga_<id>) to count visits and see how the site is used, and records one event when a pilot application is sent (generate_lead, with the page and the ad tags in its address — never what you typed into the form). We advertise Pilgud on Google, and Google's advertising cookies (such as _gcl_au) let Google tell us which of our ads brought a visitor and whether they applied. Google receives the page address, your browser's details and the ad click id; it does not receive what you type into our forms. Until you allow it, nothing is loaded from Google: we use Google's Consent Mode with everything set to "denied". Change your cookie choice at any time; Google's privacy policy applies to its cookies.
Meta Pixel, only if you press "Allow". We advertise Pilgud on Facebook and Instagram. If you allow cookies, the site loads Meta's pixel (Meta Platforms Ireland Ltd), which sets its cookies _fbp (this browser) and, when you came from one of our Meta ads, _fbc (the ad click). It records a page view, and one Lead event when a pilot application is sent — with an event id that our own record of the application also keeps, so the same application is never counted twice. Meta receives the page address, your browser's details and those cookies; it does not receive what you type into our forms. Until you allow it, nothing is loaded from Meta. Change your cookie choice at any time; Meta's privacy policy applies to its cookies.
If you arrive through a tagged link – one of our own ads, for example – the tags in its address (utm_*, and fbclid or gclid that Meta or Google add) are not stored in your browser. They only travel on in the addresses of the pilgud.com links you click, and reach us if you then join the waitlist or sign up, so we can see which of our ads brought you.
agent.pilgud.com uses only cookies that the app needs to work: the login session cookies that keep you signed in, and a language cookie (pilgud_keel). These are strictly necessary, so they don't need consent.
Sign in with Google on the sign-up page, if you use it, runs Google's own sign-in script, and Google's cookies and privacy policy apply to that step. We receive only your name and email address.
We count visits to pilgud.com with Vercel Web Analytics, which uses no cookies and stores nothing in your browser. It records the page, the site you came from, your country, browser and device type, and a few events such as a sent contact form or a waitlist sign-up. A visitor is recognised only by a hash of the request that resets every day, so we cannot follow anyone from one day to the next or tell who they are.
Legal basis for the analytics and advertising cookies: your consent (GDPR art 6(1)(a); ePrivacy). Withdrawing it is as easy as giving it: use the link above, and the tag is not loaded again.
The agent and automated decisions
Pilgud Agent proposes: ideas, texts, images, budgets. It makes no decisions about people that have legal or similarly significant effects. Campaigns it builds are created paused and go live only when you approve them.
How long we keep data
- Contact messages: as long as the conversation is active, then up to 12 months; longer only if we start working together.
- Waitlist: until we invite you or you ask to leave the list, and at most 24 months.
- Sample ads from a pilot application (and the website pictures they were made from): 30 days.
- Pilot applications: while the pilot is being chosen and run; if you become a pilot client, as Pilgud Agent data; if not, like the waitlist (at most 24 months) unless you ask us to delete them sooner.
- GEO checker logs: a short time, for abuse prevention only.
- Pilgud Agent data: while your account is open. When you close it or ask us to, we delete your data within 30 days, except what the law requires us to keep.
- Contracts and invoices: 7 years, as Estonian accounting law requires.
Your rights
You can ask us to show you the data we hold about you, correct it, delete it, restrict or object to how we use it, or hand it over in a portable format. Where we rely on your consent, you can withdraw it at any time. Write to info@pilgud.com; we answer within one month.
If you think we got something wrong, tell us first – and you always have the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).
Disconnecting Meta and deleting your data
To stop Pilgud Agent's access to your Meta ad account, remove Pilgud under Business integrations in your Facebook settings, or in Meta Business Settings, or ask us. To have us delete everything we hold about your business – the brand profile, synced campaign data, creatives and the stored token – email info@pilgud.com with the subject "Delete my data". We confirm when it's done, within 30 days.
Requests from authorities
If an authority asks us for personal data, we check the legal basis before anything is released and hand over only the minimum. What exactly we do is on the data requests page.
Changes to this page
When our processing changes, this page changes with it, and the date at the top moves. If a change matters to Pilgud Agent users, we tell them in the app or by email.
Contact
R.J. RADIANT OÜ · registry code 17343069 · Tallinn, Estonia · info@pilgud.com · +372 510 8005