Privacy policy

1. Who is responsible

Pillar Delta PC, Athens, Greece, registration number 180002501000, a private company under Greek law. For everything in this policy, write to info@pillardelta.ai.

2. Visiting the website

Our web server keeps the usual access log: your IP address, the page requested, the time, the browser type. We use it to keep the site running and to spot abuse; it is not used for profiling and not combined with other data. Logs are kept for at most 30 days. There are no analytics scripts, no advertising trackers and no third-party embeds on this site.

The site sets no tracking cookies. The customer app keeps your access key in your browser's session storage while you are signed in, so that you stay signed in as you move between views; it is removed when you sign out or close the tab. A single value in local storage remembers that you have seen the cookie notice. Neither is used for anything else.

3. The request form

When you ask for an offer, we store what you enter: your company or organisation, your e-mail address, the package you chose, your answers to the questions on the form and your message, plus the time and the IP address the request came from. We use this to answer you and to prepare the inventory and the quote. Legal basis: taking steps at your request before a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Art. 6(1)(f)).

Two e-mails are sent: one to us with your request, one to you as an acknowledgement. Requests are kept for 12 months after the last contact, or for the duration of the contract if one follows, then deleted.

4. Customers, access keys and jobs

A customer receives an access key instead of a password. The key opens the jobs delivered to that customer: the processing report, the decision record, the verification and the inventory. We keep, per job, the customer name, the contact e-mail the key was sent to, the key's usage, and an audit log of what was changed and when. Legal basis: performance of the contract (Art. 6(1)(b)).

Job data is kept for the duration of the contract and 12 months after it ends, unless the customer asks for earlier deletion or the law requires longer retention of invoices and contract records (7 years).

5. The documents we process for customers

This is the core of the service and where personal data is most likely to appear: names in newsletters, contact columns in spreadsheets, signatures on minutes. We process such documents only as a processor, on the customer's instructions, under a data processing agreement that is part of every contract. In particular:

• Inventory before anything else. Every collection is counted and typed first; columns and fields that look like personal data are identified and reported to the customer before any conversion runs.
• Nothing decided silently. Whether personal data stays in the knowledge base, which version of a document counts and what stays internal are questions put to the customer and answered by a named person on a date. The answers are applied from that record.
• Nothing invented. The pipeline cleans and structures text; it does not summarise, reword or fill gaps. What the source says is what the knowledge base says.
• Processing in the EU. Conversion runs on our server in Finland (section 7) or, with CODEBLACK ON SITE, on the customer's own server with the network switched off, in which case no document leaves the customer.
• Embeddings only by decision. If the customer asks for a vector index, the text of the knowledge base is sent to an external embedding provider named in the data processing agreement. This is a documented choice the customer makes in the intake questionnaire; it never happens by default and is refused in on-site mode.
• Deletion. Source documents and intermediate files are deleted after delivery unless the customer has ordered ongoing refreshes; then they are kept for as long as that subscription runs.

6. What we never do

We do not sell or rent personal data. We do not use customer documents to train models, ours or anyone else's. We do not profile visitors. We do not send marketing e-mail to addresses collected through the request form unless you ask for it.

7. Where data is stored and who helps us

Our own servers, Finland (EU)	Processing and storage run on our own dedicated servers in a data centre in Finland, inside the European Union. Backups are encrypted before they leave the server and stay in the EU.

Providers that assist us with hosting, e-mail (mailboxes and delivery) or, at a customer's request, embeddings are bound by data processing agreements; the list is part of every customer contract and available on request. No other third party receives personal data from us, except where the law obliges us to hand it over.

8. Your rights

You can ask us for access to the personal data we hold about you, for correction, for deletion, for restriction of processing, for a copy in a portable format, and you can object to processing based on our legitimate interest. Write to info@pillardelta.ai; we answer within one month. If you think we handle your data unlawfully, you can complain to the data protection authority of your country; for us that is the Hellenic Data Protection Authority (dpa.gr) in Athens.

If your data is in a document a customer gave us to process, the customer is the one to ask; we support them in answering you, as the data processing agreement requires.

9. Security

Connections to the site and the app are encrypted (TLS). The customer console is not reachable from the internet. Access keys are random and revocable; every change to keys and jobs is logged. Backups are encrypted before they leave the server. Processing on our server runs in an isolated environment; processing on site runs in a sealed container whose attestation lists every file read and written.

10. Changes

When this policy changes, the date at the top changes with it. Material changes that affect customers are announced to them directly.