Privacy policy
What happens to the receipts you upload: where they are processed, how long they are kept, and who else touches them. Source PDFs are deleted 30 days after processing; the extracted records follow the retention you set, seven years by default.
1. Who we are
Pileform is operated by Encelyte Ltd, a Cyprus-registered company. Encelyte Ltd is the data controller for the personal data described in this policy. Contact: contact@pileform.com.
2. What we collect
2.1 Account data
- Your email address and (if you create one) password hash
- Your firm name, if you give it to us
- Sign-in timestamps and IP address (kept for 90 days for abuse detection)
2.2 Receipt data you upload
- The PDF or image files you submit
- Extracted fields (date, supplier, line items, VAT rate, totals)
- The Excel workbooks we generate from those receipts
- Per-row confidence flags and any corrections you make
Receipts may incidentally contain personal data of third parties (a customer name on an invoice, a driver name on a taxi receipt). We treat that data as a processor on behalf of you (the accountant). Your client (the business whose receipts these are) is the controller; you are their processor; we are their sub-processor.
2.3 Billing data
- Plan tier, credits remaining, transaction timestamps
- The last 4 digits of your card and billing country (held by our payment processor, not us)
2.4 What we do NOT collect
- No advertising trackers, no Facebook Pixel, no Google Analytics
- No cross-site tracking cookies (we set only essential cookies: session, theme, and the cookie-notice acknowledgement)
- No browsing history outside of Pileform’s own pages
- The marketing site uses a privacy-respecting, cookie-less web analytics tool that counts visits in aggregate without identifying individuals. The workspace (app.pileform.com) has no analytics at all.
3. Where it lives
Stored in the EU (Frankfurt). Receipts are encrypted at rest and in transit. Workbook output is stored in object storage in the same region.
4. How long we keep it
Receipts and workbooks: retention follows the policy you configure in Settings → Data & exports (default 7 years, beyond the 6-year minimum required in Cyprus, range 6–30 years with country presets: Cyprus / UK / Ireland / Malta / Spain / Greece default to 6 years, Netherlands to 7, Germany / France / Italy / Lebanon to 10). You can request earlier deletion of any individual job at any time. We’ll honour it within 30 days unless we’re legally required to retain (e.g. an active tax audit notice). Source PDFs (the original uploads) auto-delete 30 days after processing regardless of this setting.
Account data: retained while your account is active, plus 30 days after closure for billing reconciliation.
Sign-in logs: 90 days, then deleted.
In-app assistant conversations: if you use the in-app AI assistant, the text of your questions and its answers is kept for 90 days, then deleted automatically. We separately keep a content-free record of daily spend per company (no conversation text) for up to 24 months, for billing and abuse prevention.
5. Sub-processors
We rely on a vetted set of infrastructure and processing providers, each under a signed Data Processing Agreement with us. Primary processing happens in the EU. Our sub-processors fall into these categories: edge, compute, storage and database infrastructure; a dedicated server for receipt processing; an AI processing provider, used both for receipt field extraction and — when a user asks the in-app assistant a question — to compose an answer using the results of queries over the Customer's own accounting records already held in Pileform; a payment processor; and transactional email and error-monitoring providers (customer payload data is scrubbed before transmission to the latter). Our public Data Processing Agreement describes each sub-processor by role, location and transfer mechanism; the current named list, with each provider’s retention specifics, is available on request from contact@pileform.com, and we notify customers at least 30 days before it changes.
On AI inference specifically: this covers both document-extraction inference in the capture pipeline and the in-app assistant's use of your own accounting records to compose an answer — never payroll, billing/payment-card data, or team/account-administration data, which the assistant cannot access. Our AI processing sub-processor is contractually prohibited from training its models on your content. Inference data is retained for at most 30 days for abuse-detection purposes, then deleted. Details in the DPA.
6. Your rights under GDPR
You have the right to:
- Access: request a copy of the data we hold about you
- Rectification: correct anything inaccurate
- Erasure (Article 17): delete your account and uploaded data
- Portability: export your workbooks (we already make this easy; click Download in the archive)
- Restriction: pause processing in specific cases
- Objection: object to processing on legitimate-interest grounds
- Withdraw consent: where we relied on consent (rare; we mostly rely on the contract you signed up under)
Email contact@pileform.com with the subject line “GDPR request.” We respond within 30 days. No fee, no hoops.
7. Cookies
We set five cookies: pileform_session (keeps you logged in; HTTP-only, Secure, SameSite=Lax, session-scoped), pileform-theme (remembers your light/dark preference, set only when you click the theme toggle, 1-year lifetime), pileform-lang and NEXT_LOCALE (remember the language you chose, set only when you switch it; the second is the one the app reads, so the choice follows you into it; set on the parent domain, 1-year lifetime), and pileform-cookie-notice (remembers that you dismissed the cookie notice; set on the parent domain, 1-year lifetime). All five are exempt from consent requirements under EU ePrivacy/GDPR rules (session is strictly necessary; theme, language and notice are preferences set in response to user action). No analytics cookies, no advertising cookies, no third-party cookies.
Full breakdown (what each cookie does, how long it lives, why it’s exempt) on the cookies page.
8. Security
- TLS 1.3 in transit, AES-256 at rest
- Passwords hashed with salted PBKDF2 (210,000 iterations)
- Per-account isolation at the database row level, so you cannot see another firm’s data
- Backups encrypted; retention matches the configured primary retention policy
- Sign-in attempts rate-limited; suspicious sessions auto-revoked
If we detect a breach affecting your data, we’ll notify you within 72 hours per GDPR Article 33, with what happened, what data was affected, and what we’re doing about it.
9. International transfers
Primary processing is in the EU. Where a sub-processor processes data outside the EU, transfers happen under Standard Contractual Clauses (SCCs). Available on request.
10. Children
Pileform is a B2B accounting tool. We don’t knowingly collect data from children under 16. If you believe we have, email us and we’ll delete.
11. Complaints
If we don’t resolve a privacy concern, you can complain to your national data protection authority. In Cyprus that’s the Office of the Commissioner for Personal Data Protection. You can also complain to any EU DPA where you live or work.
12. Changes
If we make a material change to this policy, we’ll email account holders before it takes effect. Minor edits (typos, clarifications) are pushed quietly with a new “Last updated” date.
Questions? Email contact@pileform.com.