Privacy Policy

About YOA Pilot

YOA Pilot ("Your Office Assistant") is a private pilot application that assists with procurement and engineering document processing. It is operated for a small group of invited test users and is not publicly available.

Information we collect

• Account information. When you sign up, we receive your email address and (if you sign in with Google) your name and profile picture URL from Google. This is stored by our authentication provider (Supabase).
• Google Drive access. If you choose to connect Google Drive, we request read-only access (the drive.readonly scope). This lets YOA list the bidder subfolders under the parent folder you select and download only the documents needed to generate the report you requested. We access only the files relevant to the jobs you submit, never modify or delete anything in your Drive, and you can disconnect at any time.
• Files you select. Files you choose for processing are downloaded to our processing environment, parsed to generate the report you requested, and the originals are not retained after the job completes.
• Refresh tokens. When you connect Drive, Google issues a refresh token that lets us obtain short-lived access tokens for background processing. The refresh token is encrypted at rest (AES-256-GCM) and stored only on our database.

How we use your information

• To authenticate you and let you access the portal.
• To process documents you explicitly submit for processing, and to generate the reports you request.
• To operate, debug, and improve the pilot service.

We do not sell your data, do not use it for advertising, and do not use it to train any machine-learning model.

Google API services

YOA Pilot's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Data retention

Generated reports and job metadata are retained while your account is active so you can re-download them. Source files downloaded from your Drive are deleted after processing. You can revoke Drive access at any time from the dashboard, which also revokes our refresh token with Google. You can request deletion of your account and associated data by emailing us.

Sharing

We do not share your data with third parties, except for the infrastructure providers required to operate the service (Supabase for database and auth, Vercel for hosting, Google for Drive access). Each of these processes data on our behalf under their own terms.

Contact

For privacy questions, data deletion requests, or anything else, email yoa042026@gmail.com.