Privacy Policy

This policy sets out what data Pillr holds, why, who else receives it, how long we keep it and how you can delete it. It covers pillr.org, the Pillr app, the free website audit and the Pillr connector for AI assistants.

1. Who we are

Pillr is provided by PILLR SOFTWARE LTD, a company registered in England and Wales with company number 17330982. Our registered office is Rear Of 17 Plantagenet Road, Barnet, Hertfordshire, England, EN5 5JG. In this policy "Pillr", "we" and "us" mean that company.

We run the website pillr.org, the Pillr app that drafts, schedules and publishes social posts for firms, the free website audit, and the Pillr connector that lets an AI assistant work on your Pillr account.

PILLR SOFTWARE LTD is the data controller for the personal data described in this policy. For anything about this policy or your data, email info@pillr.org.

2. The data we collect

Account and sign-in: your email address and, if you set one, a password. Sign-in is run by Supabase Auth, which holds the password. You can also sign in with a one-time code or link sent to your email. A signed-in session is kept in cookies.

Your firm: the website address you give us and the public pages we read from it. From these we build a brand profile, such as your firm's name, services, tone of voice, colours and logo. If you answer the questions about your practice, we also hold your supervisory bodies, approximate number of clients, the software you use and, only if you choose to give it, your turnover.

Public information about your firm: to describe your firm accurately we may search the public web for its LinkedIn page, for the names and roles of its founders, partners and directors, and for public reviews on sites such as Trustpilot and Google. What we find is added to your brand brain as unconfirmed facts, each with the page it came from, for you to approve or delete.

Your brand brain: facts about your firm, each with its source and any quote it was taken from; rules you set, such as claims that must never be made; and voice samples, which are short pieces of your own writing used to match your tone. They come from your website, from what you type, from notes an assistant sends for you and from sources you connect.

Posts and images: the posts, carousels and images Pillr makes for you, your edits, approvals and rejections, your run history, your schedule, and a record of what was published and where.

Photos: photos you add to your gallery or send through an assistant. Generated images and uploaded photos are stored at web addresses that are long and hard to guess but are not protected by a sign-in, because the social platforms must be able to fetch them. Anyone who has an image's address can open it.

Social accounts: when you connect LinkedIn, Instagram or Facebook you sign in on a page run by Zernio, our publishing provider, and Zernio holds the access. We store the identifiers Zernio gives us, the account's display name and its profile address. Through the connection we send the posts you approve and read performance figures for your posts.

Comments and messages: Zernio passes us the comments and direct messages on your connected accounts so that we can show them to you and draft replies. We do not store their text. We store the replies sent through Pillr, the identifiers of the comments and messages they answer, your reply settings and any reference notes you write to guide replies. If you turn on automatic replies, Pillr sends the drafted reply for you.

Sources you connect: you can connect Gmail, Google Docs, Notion, Slack, Google Calendar, Mailchimp, LinkedIn and X so that Pillr can learn how your firm writes. Composio, our connector provider, holds the connection. Each time a source is synced we read a limited sample. For Gmail that is up to 20 messages from your sent mail only. For Google Docs we look through the list of your recent documents, including ones shared with you, and open up to 16. For Notion we open up to 8 pages, for Slack up to 30 of your own messages, for Google Calendar up to 25 events, for Mailchimp up to 10 campaigns, and for LinkedIn and X your own profile. An AI model picks out facts about your firm and short samples of your writing. We keep those in your brand brain and do not keep the rest of what we read. We do not connect to CRM or client contact systems.

Notes sent through an assistant: an AI assistant you have approved can send Pillr notes for you, such as meeting notes or an email thread, up to 20,000 characters at a time. We store the text as sent, and an AI model picks out facts, voice samples and ideas for posts. We keep the stored text while your account exists.

Email through Gmail: if you have connected Gmail and ask an assistant to draft or send an email, the recipients, subject and body pass through Pillr and Composio to your Gmail account. Pillr does not store them.

Website audit: anyone can run the free audit on a firm's website. We store the website address and the result, your email address if you are signed in or ask for the report by email, and a keyed hash of your IP address, which we use to limit repeat requests. If you ask for a call we store the email address you give. If you ask for a comparison with other firms we store the service and town you chose and public facts about the firms compared.

Billing: payments are taken by Stripe. Stripe receives your email address and our internal ID for your account, and holds your card details, invoices and payment history. We do not store your full card number. We store your Stripe customer reference, your plan and its status, your usage against your allowance and a ledger of credits granted and used.

Usage and technical records: a log of actions such as generating, scheduling and publishing; cost records for each AI run, which hold the models used, token counts, cost, any error message and the website and company name, but not the prompts or the text produced; the scores given to drafts; logs of background jobs; and app server logs, which can contain your internal account ID and your firm's website address.

Learning from your use: Pillr records which posts you approve, edit, reject, schedule and publish, the changes you make to drafts and how published posts perform. It uses this to suggest rules, which you can accept or dismiss, and to shape later drafts for your account.

Other people's data: the content you give Pillr, and the comments and messages on your social accounts, can include personal data about other people, such as a client named in a note. We process it to provide the service to you, as this policy describes.

What we record when an AI assistant uses your account is under "AI assistants" below. Cookies and analytics are under "Cookies and analytics".

3. How we use your data

To provide the service: read your website, build and maintain your brand brain, write posts and images, check drafts, and schedule or publish the content you approve.

To show you how your posts perform, and to help you reply to comments and messages.

To let an AI assistant you have approved work on your account.

To learn from how you use Pillr, so that later drafts suit your firm better.

To take payment and manage plans, allowances and credits.

To run the free website audit and its follow-ups.

To send you service emails: sign-in codes and links, password resets, the audit report you asked for, one reminder about a time-limited offer shown with an audit, and, on plans that include it, a monthly website check. Supabase sends these emails for us.

To keep the service secure, prevent abuse, track our costs, fix faults and improve the product.

We do not sell your personal data, and we do not use the content of your posts to train third-party models.

4. Legal basis (UK GDPR)

Contract: we process your account, firm, content, connection and billing data to provide the service you have signed up for.

Legitimate interests: we rely on our legitimate interests in running a secure and reliable service, preventing abuse, tracking our costs and improving the product. We rely on the same basis when we look up public information about a firm, when we audit a public website, when content you give us mentions other people, and when we send the offer reminder described above.

Consent: we ask for your consent before we use analytics cookies or record a session. Connecting a social account, connecting a source and approving an AI assistant are also your choice, and you can undo each one.

Legal obligation: records of payments are kept for the period the law requires.

5. Who we share data with

We share data with the providers below so that Pillr can work. We use each one only for the part of the service described.

Supabase: our database, sign-in service and file storage. It holds almost everything described in this policy.

netcup: hosts the server that runs the Pillr app.

OpenRouter: passes requests to the AI models that write, check and draw. It sends them on to the makers of the models we use, which are currently Anthropic, Google, OpenAI, xAI, Alibaba (Qwen), ByteDance (Seedream) and Perplexity. They receive the content needed for the task: website content, brand facts, drafts and your instructions, notes and connected-source content being read, comments and messages when a reply is drafted, and images being checked.

Firecrawl: reads your website and runs public web searches about your firm.

TinyFish: fetches a link you ask Pillr to read. For the website audit it also searches the web, fetches pages and checks professional registers.

TypeSafe: its Jev model reads website text during the website audit and answers set questions about it.

Zernio: holds your social connections, publishes and schedules your posts, and returns performance figures, comments and messages. It receives your post text and the web addresses of your images.

Composio: holds the connection to each source you connect and to Gmail. What we read from a source, and any email you draft or send, passes through it.

Stripe: takes payment and holds your billing records.

PostHog: product analytics and session recordings, only if you accept analytics cookies.

The social platforms: LinkedIn, Instagram and Facebook receive what you publish to them.

The services you connect: Google, Notion, Slack, Mailchimp, LinkedIn and X hold the content we read with your permission, and Gmail receives the drafts and emails you ask for.

AI assistant providers: if you connect an AI assistant, its provider receives the results of what it asks Pillr for. See "AI assistants" below.

Companies House: when a company is looked up, the search goes to Companies House, the UK public register. We do not store the results.

We may also have to disclose data where the law requires it.

6. AI assistants

On paid plans an AI assistant, such as ChatGPT or Claude, can work on your Pillr account through the Pillr connector. You sign in to Pillr and approve the assistant on a consent screen. Supabase, our sign-in provider, holds the record of that approval.

What an approved assistant can see: your projects, posts and run results, your schedule, your post performance figures, your usage against your plan, your brand profile and the facts in your brand brain, posts waiting for your approval, suggestions for what to post next, the sources you have connected, and public Companies House records.

What it can do when you ask it to: create a project from a website address; generate, refine and delete posts; create a post from a link or a photo; schedule, publish, reschedule and cancel posts; approve or reject posts waiting for approval; add facts, voice samples and notes to your brand brain; connect, sync and disconnect sources; and draft, change and send emails through your connected Gmail. Anything it generates or publishes counts against your plan as if you had done it yourself.

Not every assistant is offered all of these. The Pillr app for ChatGPT is offered a smaller set.

What the assistant's provider receives: the result of each request the assistant makes, for example post text, brand facts, your schedule or performance figures, is returned to the assistant and so to its provider, such as OpenAI for ChatGPT or Anthropic for Claude. How that provider uses it is governed by its own terms and privacy policy, not this one.

What we receive from the assistant: only what it sends with a request, such as a website address, the text of a note or a photo. We do not receive or ask for the rest of your conversation with the assistant.

What we log: for each request we record your internal account ID, the name of the tool used, the kind of request, whether it worked, any error code, how long it took and the time. This log does not hold what the assistant sent or what Pillr returned. Longer jobs, such as generating posts, also keep a short record of what was asked for, their progress and their outcome, so that the assistant can check on them.

Pillr tells the assistant to confirm with you before it schedules or publishes a post or sends an email. The assistant, not Pillr, carries out that check.

To stop an assistant using your account, remove the Pillr connector in that assistant's settings. Deleting your Pillr account removes every assistant's access.

7. Where your data is processed

Our database and file storage are provided by Supabase and run in the Amazon Web Services Seoul region (ap-northeast-2), in the Republic of Korea. The UK has an adequacy decision covering the Republic of Korea.

The server that runs the Pillr app is hosted by netcup in Nuremberg, Germany. PostHog stores analytics in the EU, in Frankfurt, Germany. The UK treats the EU as providing adequate protection for personal data.

Our other providers, including OpenRouter, the model makers, Firecrawl, TinyFish, TypeSafe, Zernio, Composio and Stripe, may process data in other countries, including the United States. Email info@pillr.org if you want to know more about a particular provider.

8. How long we keep your data

Run history: each generation run is kept in your history for 7 days on the Basic and Professional plans and for accounts without a plan, 14 days on the Business plan, and until you delete it on the Firm plan. The period is set when the run is made. An automatic job removes runs once their period has passed.

Everything else we hold about your account, as described above, is kept while your account exists, until you delete it in the app or until your account is deleted. We have not yet set automatic deletion periods for these records. When we do, we will list each period here and change the date at the top of this page.

Generated images: the images used by a project's current posts are removed when you delete that project. Other images are kept while your account exists.

Facts and voice samples stay in your brand brain until you delete them, the project or your account.

Website audits not saved to an account, requests for a call and comparisons with other firms are kept until you ask us to delete them. Email info@pillr.org and we will.

Billing records at Stripe: Stripe keeps your customer record, invoices and payment history for the period the law requires, including after your account is deleted.

Analytics at PostHog: PostHog keeps events and recordings for the retention period that applies to our PostHog project.

Sign-in logs at Supabase: Supabase keeps its own logs of sign-in activity, which can include your email address and IP address, for a period that Supabase sets.

The older database: before 26 July 2026 Pillr ran on an earlier database, which we still hold at Supabase, in the same Seoul region, as a fallback copy. The live service does not use it. It holds the data of accounts that existed before that date. We will delete it when it is no longer needed as a fallback. Until then, when we delete your account we also remove your data from that copy.

9. Deleting your account

To delete your account, email info@pillr.org from the email address on the account. If you cannot use that address, tell us and we will agree another way to confirm it is you. We delete the account within one month of confirming your request.

What we do: we cancel your Pillr plan, cancel posts still waiting to be published, disconnect your social accounts at Zernio and the sources you connected at Composio, and delete your sign-in and the data this policy describes from our database and file storage. Every AI assistant loses access.

At Stripe: Stripe keeps your customer record, invoices and payment history for the period the law requires.

At PostHog: we ask PostHog to delete your analytics profile with its events and recordings.

On the social platforms: posts already published stay on LinkedIn, Instagram and Facebook. Delete them there if you want them gone.

Deleting your account does not refund the unused part of a billing period or unused credits.

10. Your choices and your rights

In the app you can: approve, edit or delete facts in your brand brain, and delete voice samples; delete a gallery photo, which also removes the file; delete a project, with its posts, run history, brand brain and the images its current posts use; delete runs from your history on the Firm plan; disconnect a social account or a connected source; cancel your plan; and accept or decline analytics cookies. To delete your account, email info@pillr.org. You can also ask an assistant to delete draft posts, and remove the Pillr connector from an assistant.

Disconnecting a source does not remove the facts and voice samples already learned from it. Delete those in your brand brain.

Under UK data protection law you have the right to ask for a copy of your data, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable form, and to withdraw a consent you have given.

There is no self-service export in the app. To ask for a copy of your data, or to use any other right, email info@pillr.org.

If you are unhappy with how we have handled your data, please tell us first at info@pillr.org. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.

11. Security

Connections to pillr.org are encrypted in transit.

Database rules limit each signed-in account to its own data, and our servers apply the same limit to what they do for you.

We do not hold your card details, or the access to your social accounts and connected sources. Stripe, Zernio and Composio hold those.

An AI assistant can use your account only after you approve it while signed in. Deleting an account needs a fresh confirmation with a code sent to your email address.

Stored images are the exception to sign-in protection: as explained above, anyone who has an image's address can open it.

No system is perfectly secure. If you think your account has been used without your permission, email info@pillr.org.

12. Cookies and analytics

Cookies we set without asking, because the service needs them or they only remember a setting: the Supabase session cookies, whose names start with sb-, keep you signed in. pillr_consent remembers your cookie choice for 1 year. pillr_audit_mine remembers for 30 days which website audits this browser asked for. Inside the app, pillr_firm (until you close the browser), pillr_styles and pillr_tz (1 year each) remember the firm you last viewed, your style choices and your time zone, so that pages load correctly.

Our own analytics, only if you accept: pillr_vid (1 year) and pillr_sid (30 minutes) identify your browser and your visit. With them we record page visits, referrers, campaign tags, country, device type, browser and operating system, and events such as sign-up, generation, onboarding and demo clicks, linked to your account when you are signed in. We work out the country from your IP address and do not store the IP address.

PostHog, only if you accept: we also load PostHog, which sets its own cookie and uses browser storage. It records page views, clicks, scrolling, errors on the page and a recording of your session, so that we can see where the product is hard to use. In recordings all text and everything you type are masked. Images on the page are not masked, and a click event can include the label of the button or link you clicked. PostHog identifies a signed-in user by our internal account ID, not by name or email address. Like any service your browser contacts, PostHog sees your IP address.

If you decline, neither kind of analytics runs, and the service works the same.

To change your choice, clear this site's cookies and stored data in your browser. The banner will then ask you again.

The app also keeps a few display settings, such as theme and text size, in your browser's own storage. They stay on your device.

We do not use advertising cookies.

13. If you are not a Pillr customer

A firm that uses Pillr may give us content that mentions you, or we may read public information about you. Examples are your name on the firm's website or in a public review, a note or email the firm gives us, or a comment or message you send to the firm's social account. We process that data to provide the service to the firm, as this policy describes.

If you ran the website audit without an account, what we hold and for how long is set out above.

You have the same rights as a customer. To use them, email info@pillr.org.

14. Changes to this policy

We may update this policy from time to time. When we do, we will change the date at the top of this page.