Last updated 12 Sep 2026. Written in plain language on purpose — have your own counsel check it against the law where you operate.
Who's responsible
wowpilot is run by the wowpilot operating entity, which is the data controller for everything on this page. Privacy questions go to [email protected] and are answered by a person.
What we hold about you
- Your account — email address, a bcrypt hash of your password (never the password), your display name, and a profile picture if you add one.
- Your ratings — the score, headline, text, any photos or videos, and which business they're about.
- What you do here — replies you post, pages you claim, reports you file, ratings you mark as helpful.
- Technical traces — a one-way hash of the IP address behind each rating (the raw address is not stored), your browser's user-agent string, timestamps, and a signed-in flag on this device.
- One-time tokens — for confirming your email, resetting a password, and proving domain ownership during a claim.
Why we hold it
- To make the site work: sign you in, publish your ratings, deliver replies, count views.
- To keep it honest: enforce limits, spot manipulation, weigh anti-fraud signals.
- To talk to you when we must: confirm your email, answer your reports, alert you to activity on a page you own (only if you switch alerts on).
- To show what you chose to make public: your ratings, replies and reviewer profile.
What other people can see
Your display name, profile picture, published ratings and replies — on your reviewer page and on any business you've rated. Your email is never shown. Your IP is only ever a hash. Your join date appears as nothing more precise than "Reviewer since {year}".
Who else touches it
We don't sell personal information, full stop. A short list of providers handle specific jobs for us:
- Brevo — sends the transactional emails (confirmation, reset, invitations, alerts).
- Cloudflare — content delivery, DDoS protection, and the Turnstile bot check.
- Our hosting provider — the servers and database.
We'll also disclose information if the law requires it, or to protect the safety of people using the site.
Search engines and AI assistants
Published ratings are public, and we deliberately let search engines and AI crawlers read them. That means a published rating of yours can be quoted or summarised by an AI assistant when someone asks about that business — the same as it can be by a search result. Your name on a rating is your display name, never your email.
How long we keep it
- Account — while it's open, then a short window after deletion so abuse can still be traced and mistakes undone.
- Ratings — while your account is open. Delete one and it leaves the public site immediately; the row is kept for audit only, unseen and uncounted.
- Tokens — claim tokens 7 days, email confirmation 2 days, password reset 1 hour.
- Reports and moderation logs — kept, so patterns of abuse remain investigable.
Your rights
Depending on where you live, you can ask to see, correct, export or delete what we hold about you, and object to some uses of it. Email [email protected] from your account address and we'll respond within 30 days. Deleting your account from the account page removes your public presence immediately.
Under 16s
wowpilot isn't for people under 16. If we find we hold a child's information without a parent's consent, we delete it.
How it's protected
HTTPS everywhere, bcrypt for passwords, session cookies marked HttpOnly, Secure and SameSite, and IP addresses stored only as hashes. Nothing is perfect: if you find a weakness, tell [email protected] and we'll take it seriously and credit you if you want.
If this changes
The date at the top moves and, for anything material, a notice appears on your account overview the next time you sign in.