Privacy policy

1. Who we are

Pileform is operated by Encelyte Ltd, a Cyprus-registered company. Encelyte Ltd is the data controller for the personal data described in this policy. Contact: contact@pileform.com.

2. What we collect

2.1 Account data

• Your email address and (if you create one) password hash
• Your firm name, if you give it to us
• Sign-in timestamps and IP address (kept for 90 days for abuse detection)

2.2 Receipt data you upload

• The PDF or image files you submit
• Extracted fields (date, supplier, line items, VAT rate, totals)
• The Excel workbooks we generate from those receipts
• Per-row confidence flags and any corrections you make

Receipts may incidentally contain personal data of third parties (a customer name on an invoice, a driver name on a taxi receipt). We treat that data as a processor on behalf of you (the accountant). Your client (the business whose receipts these are) is the controller; you are their processor; we are their sub-processor.

2.3 Billing data

• Plan tier, credits remaining, transaction timestamps
• The last 4 digits of your card and billing country (held by our payment processor, not us)

2.4 What we do NOT collect

• No advertising trackers, no Facebook Pixel, no Google Analytics
• No cross-site tracking cookies (we set only essential cookies: session, theme, and the cookie-notice acknowledgement)
• No browsing history outside of Pileform’s own pages
• The marketing site uses a privacy-respecting, cookie-less web analytics tool that counts visits in aggregate without identifying individuals. In the workspace (app.pileform.com), product analytics does not collect your name or email address and does not keep your IP address, session replay masks all text and every input, and no analytics identifier is stored on your device.

2.5 Product analytics in the workspace

• Your user ID and your organisation's ID (never your name or email address)
• The workspace pages you open, and seven workspace actions: starting a new job, opening a search result, selecting a company, switching practice, signing out, and changing the theme or the language
• Workspace errors (the error type and a shortened, scrubbed message) and server errors (the route, status and request ID); never document content
• Session replay: a recording of how the workspace pages are used, with all text and every input masked
• Your browser and device type, screen size and the referring page

We use this to find and fix errors and to improve the workspace. The legal basis is our legitimate interest (GDPR Art. 6(1)(f)). You can object at any time by email (see section 6), and we then turn product analytics off for your account; while your browser's Do Not Track setting is on, it sends nothing to product analytics. The provider is hosted in the EU.

3. Where it lives

Client documents and workbooks are stored in the EU. Receipts are encrypted at rest and in transit. Workbook output is stored in the same EU object store.

4. How long we keep it

Receipts and workbooks: retention follows the policy you configure in Settings → Data & exports (default 7 years, beyond the 6-year minimum required in Cyprus, range 6–30 years with country presets: Cyprus / UK / Ireland / Malta / Spain / Greece default to 6 years, Netherlands to 7, Germany / France / Italy / Lebanon to 10). You can request earlier deletion of any individual job at any time. We’ll honour it within 30 days unless we’re legally required to retain (e.g. an active tax audit notice). Source PDFs (the original uploads) auto-delete 30 days after processing regardless of this setting.

Account data: retained while your account is active, plus 30 days after closure for billing reconciliation. When we close an organisation (on the customer's request or at the end of the contract), its product-analytics data is deleted at the provider within 30 days.

Sign-in logs: 90 days, then deleted.

In-app assistant conversations: if you use the in-app AI assistant, the text of your questions and its answers is kept for 90 days, then deleted automatically. We separately keep a content-free record of daily spend per company (no conversation text) for up to 24 months, for billing and abuse prevention.

Product analytics: session replays are kept up to 30 days, and usage and error events at most 1 year. When we close an organisation (on the customer's request or at the end of the contract), all of its analytics data is deleted within 30 days; this also removes its users' analytics in any other organisation they belong to.

5. Sub-processors

We rely on a vetted set of infrastructure and processing providers, each under a signed Data Processing Agreement with us. Primary processing happens in the EU. Our sub-processors fall into these categories: edge, compute, storage and database infrastructure; a dedicated server for receipt processing; an AI processing provider, used both for receipt field extraction and — when a user asks the in-app assistant a question — to compose an answer using the results of queries over the Customer's own accounting records already held in Pileform; a payment processor; an EU-hosted product-analytics provider for the workspace (usage analytics, error events and session replay with all text and inputs masked); and transactional email and error-monitoring providers (customer payload data is scrubbed before transmission to the latter). Our public Data Processing Agreement describes each sub-processor by role, location and transfer mechanism; the current named list, with each provider’s retention specifics, is available on request from contact@pileform.com, and we notify customers at least 30 days before it changes.

On AI inference specifically: this covers both document-extraction inference in the capture pipeline and the in-app assistant's use of your own accounting records to compose an answer — never payroll, billing/payment-card data, or team/account-administration data, which the assistant cannot access. Our AI processing sub-processor is contractually prohibited from training its models on your content. Inference data is retained for at most 30 days for abuse-detection purposes, then deleted. Details in the DPA.

6. Your rights under GDPR

You have the right to:

• Access: request a copy of the data we hold about you
• Rectification: correct anything inaccurate
• Erasure (Article 17): delete your account and uploaded data
• Portability: export your workbooks (we already make this easy; click Download in the archive)
• Restriction: pause processing in specific cases
• Objection: object to processing on legitimate-interest grounds
• Withdraw consent: where we relied on consent (rare; we mostly rely on the contract you signed up under)

Email contact@pileform.com with the subject line “GDPR request.” We respond within 30 days. No fee, no hoops.

7. Cookies

We set six cookies: pileform_session (keeps you logged in; HTTP-only, Secure, SameSite=Lax, session-scoped), pileform-theme (remembers your light/dark preference, set only when you click the theme toggle, 1-year lifetime), pileform-lang, NEXT_LOCALE and pf_locale (remember the language you chose, set only when you switch it; the last two are the ones the app reads, so the choice follows you into it; set on the parent domain, 1-year lifetime), and pileform-cookie-notice (remembers that you dismissed the cookie notice; set on the parent domain, 1-year lifetime). All six are exempt from consent requirements under EU ePrivacy/GDPR rules (session is strictly necessary; theme, language and notice are preferences set in response to user action). No analytics cookies, no advertising cookies, no third-party cookies.

Full breakdown (what each cookie does, how long it lives, why it’s exempt) on the cookies page.

8. Security

• TLS 1.3 in transit, AES-256 at rest
• Passwords hashed with salted PBKDF2 (210,000 iterations)
• Per-account isolation at the database row level, so you cannot see another firm’s data
• Backups encrypted; retention matches the configured primary retention policy
• Sign-in attempts rate-limited; suspicious sessions auto-revoked

If we detect a breach affecting your data, we’ll notify you within 72 hours per GDPR Article 33, with what happened, what data was affected, and what we’re doing about it.

9. International transfers

Primary processing is in the EU. Where a sub-processor processes data outside the EU, transfers happen under Standard Contractual Clauses (SCCs). Available on request.

10. Children

Pileform is a B2B accounting tool. We don’t knowingly collect data from children under 16. If you believe we have, email us and we’ll delete.

11. Complaints

If we don’t resolve a privacy concern, you can complain to your national data protection authority. In Cyprus that’s the Office of the Commissioner for Personal Data Protection. You can also complain to any EU DPA where you live or work.

12. Changes

If we make a material change to this policy, we’ll email account holders before it takes effect. Minor edits (typos, clarifications) are pushed quietly with a new “Last updated” date.

Questions? Email contact@pileform.com.