Privacy Policy

This Privacy Policy describes how Pillar Technologies LLC ("Pillar," "we," "us," or "our") collects, uses, discloses, and protects information when you use pillar.codes, our web application, our iOS and Android apps, and related real estate research services (the "Service"). Available features depend on your account, workspace permissions, and app version.

Pillar will not sell or share your Personal Data as such terms are defined in the California Privacy Rights Act ("CPRA") or similar state privacy laws.

We are committed to protecting your privacy and handling your data responsibly. Please read this Privacy Policy carefully to understand our practices.

1. Information We Collect

1.1 Information You Provide Directly

Account Information

When you create an account, we collect:

• First and last name
• Email address
• Password authentication information (passwords are stored as hashes, not readable passwords)
• Job title (optional)
• Profile photo/avatar (optional)

Organization Information

When you create or join an Organization, we collect:

• Organization name
• Billing email address
• Team member information (names, email addresses, roles)

Payment Information

When you subscribe to a paid plan, we collect through our payment processor (Stripe):

• Billing name and address
• Payment method details (processed and stored by Stripe)
• Transaction history

User-Generated Content

When you use the Service, we collect:

• Projects, notes, and descriptions you create
• Contacts you add or import
• Files you upload (shapefiles, GeoJSON, CSV, Parquet, images)
• Custom fields and data you define
• Mail designs and campaign content
• Search queries and saved searches
• AI conversations, prompts, responses, attachments, and research context associated with those conversations

Communications

When you contact us, we collect:

• Email correspondence
• Support requests
• Feedback and suggestions

1.2 Information Collected Automatically

Usage Data

When you use the Service, we automatically collect:

• Features accessed and actions taken
• Search queries and filter criteria
• Map interactions (areas viewed, layers enabled)
• Time spent on features
• Error logs and performance data

Device and Technical Information

• IP address
• Browser type and version
• Operating system
• Device identifiers
• Referring URLs

Cookies and Similar Technologies

We use cookies and similar tracking technologies to track activity on our Service and store certain information. Cookies are files with a small amount of data which may include an anonymous unique identifier.

Types of Cookies We Use:

• Session Cookies: We use Session Cookies to operate our Service and maintain your authentication.
• Preference Cookies: We use Preference Cookies to remember your preferences and various settings.
• Security Cookies: We use Security Cookies for security purposes.
• Analytics Cookies: We use Analytics Cookies to understand how you use our Service and improve it.

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service.

Local Storage

We store certain preferences locally in your browser, including:

• Map layer visibility settings
• Basemap preferences
• UI state preferences

This data remains on your device and is not transmitted to our servers unless you explicitly save preferences to your account.

1.3 Mobile App Information and Permissions

The mobile apps use your existing Pillar account. Supabase provides our account authentication, application database, and file storage. Mobile features also use the following information:

• Optional location: If you use My location and grant permission, the app accesses your approximate or precise location while you use the feature. You can decline permission or change it in your device settings. The app does not request background location access.
• Selected photos and files: When you attach content, we receive the files you choose and their metadata. Camera or photo access, where offered, is used for the action you select; it does not give Pillar general access to your address book or unrelated files.
• Notifications: If you enable supported push notifications, we process a push token, an app installation identifier, device platform, notification preferences, and account/session identifiers to route updates to your device.
• Session storage: The apps store authentication credentials using iOS Keychain or Android Keystore-backed storage. Preferences and temporary downloaded files may also be stored on your device.

2. How We Use Your Information

2.1 Providing the Service

We use your information to:

• Create and manage your account
• Process subscriptions and payments
• Provide property and contact data you request
• Enable CRM and project management features
• Process and deliver direct mail campaigns
• Store and display your uploaded files and content
• Provide customer support

2.2 Improving the Service

We use information to:

• Analyze usage patterns to improve features
• Debug issues and optimize performance
• Develop new features and services
• Personalize your experience

2.3 Communications

We use your contact information to:

• Send transactional emails (password resets, invitation links, receipts)
• Notify you of important account or Service changes
• Send product updates and announcements (with your consent)
• Respond to your inquiries

2.4 Security and Compliance

We use information to:

• Protect against fraud and unauthorized access
• Enforce our Terms of Service
• Comply with legal obligations
• Maintain audit logs for security purposes

2.5 Analytics

We use analytics services (including PostHog) to understand how users interact with our Service. This helps us improve functionality and user experience. Analytics data includes:

• User identification (user ID, email, name)
• Organization identification
• Feature usage events
• Session information

Pillar owns the intellectual property rights in Usage Data.

3. Information Sharing and Disclosure

3.1 With Your Organization

If you are part of an Organization:

• Organization owners and administrators can view member information
• Team members may see shared projects, contacts, and content
• Activity within the Organization may be visible to other members

3.2 Service Providers

We share information with third-party providers who assist in delivering our Service:

• Supabase - Database, authentication, file storage
• Stripe - Payment processing
• Mapbox - Map visualization
• Regrid - Parcel data
• Zoneomics - Zoning data
• SkipSherpa/Whitepages - Contact lookup
• PCM Integrations - Direct mail
• Resend - Email delivery
• Attio - CRM and demo-request lead management
• PostHog - Analytics
• Customer.io - Account and product communications, using account details and relevant product activity
• Anthropic, OpenAI and OpenRouter - AI research, conversation and file processing; OpenAI also supports image enhancement
• Apple Push Notification service and Google Firebase Cloud Messaging - Delivery of supported mobile push notifications
• Vercel and Hetzner - Application hosting and server-side processing

These providers are contractually obligated to protect your information and use it only for the purposes we specify.

3.3 Legal Requirements

We may disclose information when required by law, including to:

• Comply with legal process (subpoenas, court orders)
• Respond to government requests
• Protect our rights, privacy, safety, or property
• Enforce our Terms of Service

3.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change.

3.5 With Your Consent

We may share information in other circumstances with your explicit consent.

3.6 Aggregated or De-Identified Data

We may share aggregated or de-identified information that cannot reasonably identify you for research, marketing, or other purposes.

4. Data Retention

4.1 Account Data

We will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy, but no more than twelve (12) months after the termination of your account. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

After account termination, we may retain certain information for:

• Legal compliance
• Dispute resolution
• Enforcing agreements
• Legitimate business purposes

4.2 Content and Files

Your uploaded content and files are retained while your account is active. If you request permanent account deletion, we delete associated personal data and content within 30 days, except where retention is required by law. The general account-termination retention period does not override an account-deletion request.

4.3 Usage and Analytics Data

Usage data may be retained in aggregated or anonymized form indefinitely for analytical purposes.

4.4 Audit Logs

Security audit logs are retained indefinitely for compliance and security purposes.

4.5 Third-Party Data

Property and contact data obtained from third-party providers is subject to those providers' retention policies.

5. Data Security

5.1 Security Measures

We implement technical and organizational measures to protect your information, including:

• Encryption of data in transit (HTTPS/TLS)
• Secure authentication with hashed passwords
• Row-Level Security (RLS) at the database level
• Organization-based access controls
• Regular security assessments
• Access logging and monitoring

5.2 Access Controls

• Only authorized personnel can access user data
• Database access is restricted by role
• Super administrator actions are logged for audit purposes

5.3 Your Responsibilities

You are responsible for:

• Maintaining the security of your account credentials
• Reporting any suspected security breaches
• Using secure connections when accessing the Service

5.4 No Guarantee

While we strive to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

6. Your Rights and Choices

6.1 Access and Portability

You can:

• Access your account information through your profile settings
• Export your data by contacting support
• Download files you've uploaded

6.2 Correction

You can update your account information through your profile settings. For other data corrections, contact support.

6.3 Account Deletion

To request permanent deletion of your Pillar account and associated personal data, open Account → Profile → Delete account in the app. You can also request deletion without installing or signing in to the app by emailing [email protected] from your account email address with the subject "Pillar account deletion." If you cannot access that email address, contact us for help verifying ownership.

To request deletion of specific personal data without closing your account, email [email protected] from your account email address and identify the data, such as uploaded files, research history, or analytics records. We process requests manually within 30 days and confirm completion, explaining any legal retention exception.

The app records a pending deletion request; it does not immediately erase your account. Our team processes permanent deletion manually within 30 days of your request and confirms completion by email. We may contact you if information is needed to verify ownership. Do not send your password. You may contact us to withdraw a request before deletion is completed; completed permanent deletion cannot be undone.

• We review associated account information, personal content and files, sessions, and notification registrations as part of your request.
• Associated personal data and your personal content shared in workspaces are included in deletion. Records that do not contain your personal data may remain for other workspace members.
• Records needed to comply with law, including applicable billing records, may be retained. We explain any applicable legal retention exception when completing your request.
• Copies independently held by other users or third parties may require a separate request to those parties.

6.4 Communication Preferences

You can:

• Opt out of marketing communications via unsubscribe links
• Update notification preferences in your account settings
• Turn mobile push notifications off in the app or your device settings. Disabling notifications does not delete your Pillar account or workspace content.

Note: You cannot opt out of transactional communications necessary for Service delivery.

6.5 Cookies

You can manage cookie preferences through your browser settings. Disabling cookies may affect Service functionality.

6.6 Do Not Track

We do not currently respond to "Do Not Track" browser signals.

7. State-Specific Privacy Rights

7.1 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know

You may request disclosure of:

• Categories of personal information collected
• Sources of personal information
• Business purposes for collection
• Categories of third parties with whom we share information
• Specific pieces of personal information collected

Right to Delete

You may request deletion of personal information we have collected, subject to certain exceptions.

Right to Correct

You may request correction of inaccurate personal information.

Right to Opt-Out of Sale/Sharing

We do not sell personal information. We do share information with third-party service providers as described in Section 3.

Right to Limit Use of Sensitive Personal Information

You may request that we limit the use and disclosure of sensitive personal information.

Right to Non-Discrimination

We will not discriminate against you for exercising your privacy rights.

Right to Private Action

You have the right to initiate a private cause of action for certain data breaches as provided under CPRA.

Authorized Agents

You may designate an authorized agent to make requests on your behalf.

Categories of Information

In the past 12 months, we have collected:

• Identifiers (name, email, IP address)
• Commercial information (transaction history, subscription data)
• Internet activity (usage data, browsing history within the Service)
• Geolocation data (derived from IP address, map interactions)
• Professional information (job title, organization)

Shine the Light

California Civil Code Section 1798.83 permits California residents to request information about disclosure of personal information to third parties for direct marketing. We do not disclose personal information to third parties for their direct marketing purposes.

7.2 Virginia, Colorado, Connecticut, and Utah Residents

Residents of these states have similar rights including:

• Right to access
• Right to delete
• Right to correct
• Right to data portability
• Right to opt out of targeted advertising

To exercise these rights, contact us using the information in Section 12.

7.3 Nevada Residents

Nevada residents may opt out of the sale of personally identifiable information. We do not currently sell personal information as defined by Nevada law.

8. International Data Transfers

8.1 Data Location

Our hosting and service providers may process information in the United States, Europe, and other countries where they operate. The location depends on the service used. These countries may have different data protection laws from the country where you live.

8.2 EU/EEA Users

If you are located in the European Union or European Economic Area, your personal data may be transferred to the United States where data protection laws may differ. We implement appropriate safeguards for such transfers.

8.3 GDPR Rights

If GDPR applies to you, you have rights including:

• Access
• Rectification
• Erasure
• Restriction of processing
• Data portability
• Objection
• Rights related to automated decision-making

To exercise these rights, contact us at [email protected].

9. Links to Other Sites

Our Service may contain links to other sites that are not operated by us. If you click a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

10. Children's Privacy

The Service is not intended for children under 18. We do not knowingly collect personal information from children. If we learn we have collected information from a child, we will delete it promptly. If you believe a child has provided us information, please contact us.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on our website
• Sending an email to your registered email address
• Displaying a notice within the Service

Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

13. Additional Information for Specific Features

13.1 Skip Tracing and Contact Data

When you use skip tracing features:

• We query third-party providers with property information (addresses, owner names)
• Contact information returned may include names, phone numbers, emails, and addresses
• This data is cached in your Organization's workspace
• You are responsible for complying with applicable laws when using this data
• We track credit usage for these lookups

13.2 Direct Mail Campaigns

When you use mail services:

• Recipient names and addresses are shared with our mail fulfillment partner
• Mail designs and content you create are stored and transmitted for printing
• Delivery status information is received and stored
• Undeliverable addresses are tracked

13.3 Map and Location Features

When you use mapping features:

• Your map interactions (pan, zoom, area views) may be logged
• Geographic coordinates of properties you search are processed
• Layer preferences are stored locally and/or in your account
• Satellite imagery may be processed through third-party services
• Map providers receive network requests for the geographic areas displayed, along with technical information such as your IP address. Map performance information may also be collected.
• Using My location changes the displayed map area. That area can be reflected in map requests and, when you use AI research with map context, in the context sent for processing.

13.4 File Uploads

When you upload files:

• Files are stored in secure cloud storage
• File metadata (name, size, type, upload date) is stored
• Geospatial files may be processed to extract geometry and attributes
• Files remain accessible to your Organization members with appropriate permissions

13.5 Analytics and Tracking

We use third-party service providers to monitor and analyze the use of our Service:

PostHog

PostHog is a product analytics platform that helps us understand how users interact with our Service.

• Events tracked include feature usage, navigation, and actions taken
• User identification links events to your account
• Session information helps us understand user journeys
• For more information: https://posthog.com/privacy
• To opt out or request deletion of your analytics data, contact us at [email protected]

Stripe

Stripe provides payment processing and may collect analytics related to billing.

• For more information: https://stripe.com/privacy

We do not currently use advertising or remarketing services. If this changes, we will update this Privacy Policy.

13.6 AI Research and Conversations

AI features process your prompts and relevant conversation history together with context needed to carry out your request. Depending on the task, this can include selected properties, map bounds, workspace records, notes, and files or images you attach. We store conversations and related results so you can return to your research and share it through the Service's access controls.

Our servers and AI providers, including Anthropic, OpenAI and OpenRouter, process this information to generate responses and perform requested research or actions. A different provider may handle a request when a fallback is used. Information included in prompts, attachments, or selected workspace context may contain personal information, so only include material you are authorized to use.

AI processing is subject to the terms and data-handling arrangements applicable to the provider and service used. This policy does not promise zero retention or that every provider processes information under identical terms. Contact us if you need information about processing arrangements before submitting confidential or sensitive material. AI results may be inaccurate and should be checked before you rely on them.

13.7 Mobile Push Notifications

Supported iOS notifications use Apple Push Notification service (APNs). Supported Android notifications use Google Firebase Cloud Messaging (FCM). FCM is a notification delivery service; our use of it does not move your Pillar workspace database or uploaded files from Supabase into Firebase.

The notification provider processes device delivery identifiers and the notification payload. Pillar sends generic notification text rather than the text of your private notes or property research. Payloads may include an account identifier and an internal destination so the app can open the appropriate update after verifying your account.

Push delivery depends on your permission, device settings, network connection, and provider availability. Signing out or disabling notifications removes or disables the applicable Pillar registration; providers may separately retain installation or technical records under their own policies.

13.8 Analytics Across Web and Mobile

The mobile apps do not initialize the web browser's PostHog or Customer.io tracking scripts. However, actions performed in the apps can still generate server-side product events linked to your account, including saved properties, project activity, and feature activation. PostHog helps us understand product use, and Customer.io supports account messages and product communications. Map providers and our servers may also process diagnostic information. Using the mobile apps therefore does not mean that no analytics information is processed.

14. Glossary

• Personal Information: Information that identifies, relates to, or could reasonably be linked to you or your household.
• Service Provider: A third party that processes personal information on our behalf.
• Processing: Any operation performed on personal information, including collection, use, storage, and disclosure.
• Controller: The entity that determines the purposes and means of processing personal information.
• Processor: An entity that processes personal information on behalf of a controller.

This Privacy Policy is designed to be transparent about our data practices. If you have any questions or concerns, please don't hesitate to contact us.