Privacy policy

Who is responsible

Pillar is operated by Kevin Bastien, operating as Pillar, based in Brooklyn, New York, United States. For questions or requests, email support@pillar.nyc.

This notice covers Pillar’s website, account services, workspaces, and client status pages. We manage account information and the information needed to operate and protect Pillar. A studio chooses what client and order information it adds, who joins its team, and who receives its client links. We handle that workspace information to provide the service to the studio. The studio is responsible for its own notices, permissions, and instructions concerning that information. If you are a studio’s client, contact the studio first about its use of your information.

Information we collect

• Accounts and business registration: names, email addresses, company name, website, location, team roles, invitations, and approval or archive records. When you choose Continue with Google, Google provides your verified email address, name, and a stable Google account identifier. Pillar stores that identifier to recognize your account on later sign-ins; it does not store your Google password or retain the tokens used only for sign-in. If you grant Gmail permission in the same flow, Pillar keeps the encrypted mailbox credentials described below.
• Orders and client information: client names, shipping addresses, order numbers, products, quantities, specifications, production dates and status, notes, shipping details, tracking numbers, and client updates entered by a studio.
• Files and catalog information: uploaded documents and photos, studio branding, product descriptions, specifications, and public website content imported at a studio’s request.
• Spreadsheet imports: CSV or XLSX sheet names, original headers, source coordinates, raw cell values and types, formula text and available cached values, reviewed mappings, corrections, record links, exclusions, and duplicate decisions. These may contain client contact details, private notes, shipping history, or unresolved source information.
• Production sharing: published client-page versions, fabricator company and contact details, fabricator instructions, generated work-order PDF revisions, and outgoing messages with their recipients, senders, times, and delivery outcomes.
• Inquiry and approval records: forwarded inquiries and connected Gmail inbox messages, including sender names and addresses, subjects, bounded plain-text message content, attachment names, mailbox addresses, message and thread identifiers, received and processing times, duplicate-detection fingerprints, Gmail screening status, reasons and times, and maker approval or dismissal decisions. Historical order-import receipts and their linked orders also remain with the workspace.
• Gmail connections: the connected mailbox address, the authorizing owner, connection and sync status and times, encrypted access and refresh tokens, and sync cursors used to retrieve new inbox messages. When a new studio has not yet been created or approved, an encrypted authorization bound to the owner’s Google identity can be held for up to 30 days. Inbox import starts only after the studio is active; expired authorizations are removed by scheduled cleanup.
• Support and security information: support requests and permission records, administrator identity and stated reason for a support visit, visit times and pages viewed, sign-in and invitation records, and technical logs such as request details, IP addresses, browser information, and errors.
• Terms acceptance: a record linked to your account of the Terms of Service and Privacy Policy revision presented, the published operator and contact details, the acceptance time, the identity verification time, and whether acceptance occurred when starting sign-in or, historically, confirming an email sign-in link. The acceptance record does not include your IP address or browser information.

Information comes from you, your studio and its team, forwarded inquiries, an owner-connected Gmail mailbox and previously imported emails, the public website selected for import, and your browser’s interactions with Pillar. Please include only information needed for the work and avoid putting unnecessary sensitive personal information in emails, notes, uploads, or support reasons.

How we use information

We use information to create and manage accounts, verify Google sign-ins, manage invitation links, screen Gmail messages for likely sales inquiries, review sales inquiries and prepare replies, operate order books, share client updates, import catalog content, answer support requests, prevent abuse, diagnose problems, record terms acceptance, and meet applicable legal obligations. Required account and order fields allow those features to work; optional details and uploads are chosen by the studio. If you do not provide information a feature requires, that feature may not be available.

Pillar does not sell personal information, serve advertising, or use marketing analytics or advertising trackers. We do not share personal information for cross-site targeted advertising. Ordinary Production, Clients, and website imports do not use AI processing. Spreadsheet onboarding uses AI when a provider is connected: selected worksheet contents and field descriptions are sent to interpret clients and production details into a draft. You review the draft before confirming the import. The provider cannot write records or execute actions.

Where applicable law requires a legal basis for processing we control, we rely on performing our agreement with you for account and service features, our legitimate interests in operating and protecting the service and resolving support issues where those interests are not overridden by your rights, and compliance with legal obligations. For workspace content processed on a studio’s instructions, the studio is responsible for determining its legal basis. Accepting the Terms of Service and acknowledging this notice is not consent to every use of personal information.

Google data and Limited Use

Pillar handles information obtained through Google APIs under the Google API Services User Data Policy, including its Limited Use requirements. We use Gmail data to provide the features described in this notice. We do not sell that data, use it for advertising, or permit it to train general-purpose AI models. Staff and contractors may read identifiable Google data only with your documented agreement to access specific data, when necessary for security, or when required by law.

Who can see workspace information

Authorized studio team members can view the workspace according to their roles. Owners manage settings and team access; owners and editors can change orders. Viewers can read orders, including internal notes and files. Pillar administrators can see the company registration and account details needed to manage the service, including company and team member names, email addresses, roles, website, and approval or archive status.

Members can forward email inquiries to the configured inbox for review in their workspace. Continue with Google lets a studio owner sign in and authorize Gmail in one flow. Team invitation sign-in requests identity access only. Owners can also connect or reconnect Gmail from Settings → Email using Google authorization. Declining Gmail permission does not prevent an otherwise verified Google sign-in. Signing in does not replace an existing different studio mailbox. Pillar requests permission to read Gmail messages and send email on your behalf. Sending requires your explicit review and confirmation in Sales. Gmail-connected Sales replies send from the connected mailbox and are saved in Gmail Sent, with matching replies grouped into the original conversation. Pillar imports incoming Inbox messages from the past 30 days, then checks for new inbox messages every five minutes while connected. This includes inbox mail that is not a sales inquiry. Pillar saves up to 50,000 characters of plain text and attachment names; it does not save email attachments or follow links. Pillar uses OpenAI to screen the connected mailbox address, sender, subject, and bounded plain-text message content for customers seeking to buy from the studio. Only likely sales inquiries automatically enter Sales → Approvals. Other messages, uncertain results, and messages that could not be screened remain available through Review filtered emails. Owners and editors can use Move to Approvals to override screening, then choose which messages become leads or join an existing Sales conversation. Screening does not send emails or create leads or orders. Approving or dismissing an inquiry records that decision without replying or creating an order. Automatic email order import remains retired, and previously queued imports are not processed.

Owners and editors can preview CSV and XLSX clients, production drafts, and completed order history before confirming an import. Temporary spreadsheet contents and interpretations are encrypted, become unavailable after 24 hours after upload by default, and are cleared on cancellation, successful import, or expiry cleanup. After a confirmed import, encrypted source evidence remains with the workspace: original cells and coordinates, unmapped or unresolved values, reviewed interpretations and corrections, and accepted, linked, skipped, excluded, header, or separator decisions. This retained evidence supports review and duplicate detection; it is separate from the temporary upload. Imported order history remains private. Production drafts require separate approval to enter operational workflows. Importing does not create client publications, send emails, start work orders, or move inventory.

Sales stores the lead and business/contact details entered by the studio, saved follow-up wording, editable drafts, and confirmed outgoing messages with their recipients, senders, times, and delivery outcomes. When an owner or editor chooses Draft reply with the default reply wording for a lead with linked Gmail inquiries, Pillar uses OpenAI to identify details supplied by that customer and prepare an editable acknowledgment. Customer budgets and requested dates remain requests; the draft does not confirm prices, availability, production lead times, or delivery dates. Existing drafts, custom templates, follow-up drafts, quotes, and invoices do not use this processing. An owner or editor reviews and explicitly sends each Sales email. Replies linked to Gmail inquiries send through the original connected mailbox and are saved in Gmail Sent. Other Sales messages send through Resend from the studio’s Pillar address, with replies directed to the connected Gmail mailbox or the studio’s contact email. Incoming Gmail replies go through the same screening and review process described above. Pillar does not modify, archive, or delete existing mail in the source mailbox. When a maker marks a lead Deposit paid, its details fill the new order and client record.

Opening a company’s private order workspace through the administrator support preview requires permission from its owner. Existing grants record the owner’s reason and expire after one hour. Support grant controls are no longer available in Settings. The administrator records a separate reason, uses their own identity, and can only read through the preview. This includes orders, internal notes and files, catalog, settings, and team details. Permission and visit history records include start and end times and pages viewed. Expiry or revocation blocks further preview requests; it cannot recall information already viewed, copied, or downloaded.

This support permission controls access through Pillar’s interface. Authorized personnel and service providers may still need operational access to infrastructure or data to maintain the service, investigate security issues, recover from failures, or comply with law. Access to identifiable Google data is limited to the circumstances in our Google data and Limited Use section; support permission or an operational role does not authorize reading unrelated Google data. We do not promise that infrastructure access is impossible.

Client status links work without signing in. Anyone who has a link can view the information on that client page, including the client name, order and production details, tracking information, and shared photos. These links have no automatic expiry. A recipient can forward the link or copy what it shows. Studios should share links only with intended recipients. Owners and editors choose which columns appear on client pages. For ordinary order columns, fields marked Internal or hidden from the grid are not shown; saving a column as Client-facing makes its saved values visible. Shipping has separate per-order sharing controls: after an order is Shipped, shared carrier, tracking number, and ship date appear regardless of grid visibility. Full delivery addresses stay internal. City/region appears only when the studio opts in to sharing those separate fields. Internal order files remain private. Archiving the company disables its client pages; deleting an order removes its client page.

A private client link is available when a production row is created. Client pages show the latest saved customer-facing details and photos; unsaved edits are not shown. Saving changes updates the client page without sending an email. Studio branding and contact information update when saved in Settings.

Owners and editors can explicitly email a work-order PDF and message to an assigned fabricator after reviewing the recipient and document. The PDF includes the client name, production specifications, and fabricator instructions. Pillar keeps the exact document and delivery record with the order. Internal notes, prices, shipping addresses, and client links are excluded from the generated PDF, but users should review any free-text instructions and messages before sending. Pillar cannot recall emailed copies.

Pillar automatically prepares draft work orders at the deposit stage and emails approaching-deadline reminders to the workspace’s configured email or its owner. These reminders include order identification, product, client, and due-date information. Draft creation and maker approval alone do not email a fabricator.

Service providers and data location

We use service providers to run Pillar. Information may be processed in countries other than your own, whose privacy laws may differ.

• Render: hosts Pillar and its PostgreSQL database in Virginia, United States. It processes application data, locally stored uploads, and operational logs to provide hosting. This location does not mean all provider operations occur only in Virginia. See Render’s privacy information.
• Resend: delivers non-Gmail Sales, fabricator work-order, and due-date reminder emails, receiving addresses, message contents, attached work-order PDFs where applicable, and delivery information. When receiving is configured, Resend also receives forwarded inquiries, including their addresses, subject, body, headers, and attachments; Pillar retrieves message text for maker review. Team invitation links are shared by the studio. Pillar can also use a configured SMTP provider for deadline reminders. Email sign-in links are no longer issued or accepted. See Resend’s privacy policy.
• Google: verifies your identity when you choose Continue with Google and provides the account information described above. The same Google consent flow can also grant Gmail read and send access for an owner’s mailbox. Google shows these permissions for you to approve; identity-only consent can still sign you in. Gmail credentials are applied only to a studio you own, and a pending studio cannot import inbox messages. Google receives authorization and Gmail API requests; Pillar receives the mailbox information and messages described above. The encrypted authorization tokens let Pillar continue syncing without asking for the mailbox password. See Google’s privacy policy.
• Gmail screening provider: Pillar sends the connected mailbox address, sender, subject, and up to 24,000 bytes of plain-text content from each imported Gmail message to OpenAI, along with the studio’s name and description, to distinguish customers buying from the studio from the mailbox holder buying from suppliers. This can include private or unrelated inbox content. Requests use store: false, which disables response storage but is not a guarantee of zero provider retention. Provider copies remain subject to the applicable settings and OpenAI’s API data controls.
• Sales reply drafting provider: when Draft reply uses the default reply wording, Pillar sends message references, subjects, and up to 24,000 bytes of plain-text content in total from at most four related Gmail messages to OpenAI. The selected messages are the original inquiry and recent received messages linked to that lead, recipient, mailbox, and conversation. Pillar checks that extracted details appear in the selected messages before including them in the draft and adds the contact’s name and studio’s sign-off locally. This processing creates only a draft for review and does not send email. Requests use store: false, which disables response storage but is not a guarantee of zero provider retention. Provider copies remain subject to the applicable settings and OpenAI’s API data controls.
• Historical OpenAI processing: former catalog cleanup and email-import features sent public website text or forwarded email subjects and bodies to OpenAI. These features are no longer active. Previous API requests used store: false; this was not a promise of zero retention. Historical content and technical information may remain subject to OpenAI’s API data controls.
• Spreadsheet interpretation provider: the built-in OpenAI adapter uses configured API credentials and can be disabled by the operator. Its default model is gpt-6.1-sol. Guided imports send all populated cells of selected worksheets, their names and dimensions, the studio display name, and supported-field descriptions. These cells may include client contacts, shipping details and private notes. The full request, including its response schema, is limited to 220,000 bytes by default. Already-open manual import forms may instead use limited source samples and workspace client candidates for suggestions. Requests use store: false, which disables response storage but is not a guarantee of zero provider retention. OpenAI may retain abuse-monitoring logs for up to 30 days by default, subject to applicable settings and exceptions. Organization-specific controls and other provider processing may differ. See OpenAI’s API data controls.

Website imports contact the selected public website and its image hosts, which can receive Pillar’s server request details. An import review may also display images directly from the source website, exposing your browser’s IP address and browser information to that host. Saved client-page images are served through Pillar. External websites you visit through links have their own privacy practices.

We may also disclose information when necessary to comply with applicable law or protect the service and people from abuse. We do not authorize service providers to use Pillar customer information for our advertising.

Cookies and security

Pillar uses essential session cookies and security tokens to keep you signed in, remember the active session, and protect forms. It does not use optional advertising or marketing analytics cookies. Blocking essential cookies may prevent sign-in and other features from working.

Pillar does not track your browsing across other websites for advertising. Browser “Do Not Track” signals do not change the essential session and security processing described here.

Pillar uses encrypted connections, account and role checks, and restricted support previews. No service can guarantee absolute security. Protect your Google account and keep client links private, remove team access when it is no longer needed, and report suspected unauthorized access to the contact above.

Retention and your choices

Pillar retains active and archived workspace records to provide the service and allow restoration; it does not automatically purge old workspaces. Archiving is not deletion. Uploaded files use persistent storage that survives ordinary deployments and restarts, but retention is not a guarantee of recovery from deletion, corruption, or storage failure. Keep your own copies. Our data retention and deletion notice explains record retention, storage limits, and removal requests.

You can remove Pillar’s access in your Google Account connections. Revoking access stops further sync; imported emails, review history, leads, and connection metadata remain with the workspace. Revoking access or deleting a message in Gmail does not delete a copy already imported into Pillar. Contact us about a verified deletion request for retained records.

You can update your name and connect Google sign-in in Settings → Profile. Google is the only sign-in method; email sign-in links and password login are unavailable. Studio owners manage company details and team access; owners and editors can correct or delete orders. Depending on applicable law, you may also have rights to access, correct, delete, or obtain a copy of personal information, or to object to or restrict certain uses. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Send requests to support@pillar.nyc. We may need to verify your identity and authority before acting. If the information belongs to a studio’s order workspace, we may coordinate with that studio. You may also raise a concern with the privacy regulator responsible for your location.

Business use

Pillar is designed for studios and their authorized team members to manage business orders and share progress with clients. It does not ask for or verify users’ ages. If you believe information about a child has been submitted inappropriately, contact us so we can review the situation and any removal request.

Changes to this notice

We will update this page when Pillar’s practices change and show the revision date above. We will communicate material changes when required by applicable law.