Data retention & deletion

What stays in Pillar

• Active workspaces: account, company, catalog, order, client, attachment, and team records are retained to provide the service. Pillar currently has no automatic age-based purge of these database records. Edits and order deletion can remove live content; storage limits below apply separately to uploaded files.
• Archived companies: the same database records are retained so an authorized administrator can restore the workspace. Archiving blocks normal workspace access, new invitation acceptance, and public client pages. It revokes support grants but does not erase records or intentionally delete files.
• Support history: permission grants, revocations, administrator identity and reasons, and session and page-view history remain with the workspace after access expires. A one-hour support permission is an access limit, not a one-hour retention period.
• Production sharing: client publication snapshots, generated work-order revisions, and fabricator messages and delivery records stay with their order until it is deleted. Editing an order does not rewrite previously published or sent versions. Archived fabricators remain in the workspace to preserve historical references. Deleting an order or fabricator record cannot remove copies already received by email or kept by the email provider.
• Sign-in and invitation records: access tokens have expiry and use limits, but token expiry does not automatically remove the associated account or invitation record.
• Inquiries and review decisions: forwarded inquiries and imported Gmail messages retain sender, subject, up to 50,000 characters of plain text, attachment names, mailbox and message/thread identifiers, received and processing times, duplicate-detection fingerprints, and processing status. Gmail screening status, reasons, and times stay with the imported messages. Filtering does not delete a message: filtered, uncertain, and unscreened messages remain available through Review filtered emails, where owners and editors can move them to Approvals for review. Maker approval and dismissal decisions retain the reviewer and time. Dismissal removes an item from the pending queue but preserves its history. Inquiry records and historical order-import receipts stay with the workspace until included in a verified deletion request; there is no automatic age-based purge. Deleting an imported order does not remove its receipt. Email bodies are not put in background-job arguments. Gmail screening requests use store: false; this is not a zero-retention guarantee, and deleting Pillar records does not delete provider copies. Provider copies follow their own retention practices.
• Gmail connections: authorization tokens are stored encrypted while the connection is retained. Authorizations granted before studio creation or approval are bound to the owner’s Google identity, remain unavailable to inbox sync until the studio is active, and expire after 30 days. They are removed after use or by scheduled expiry cleanup. Disconnecting a Gmail connection removes Pillar’s saved access and refresh tokens and stops future sync; the mailbox address, authorizing owner, connection metadata, imported messages, review decisions, and linked leads remain. Archiving a company stops sync but preserves the connection record. Removing Google access or deleting source mail does not delete existing Pillar records. Include those records in a verified deletion request when removal is wanted.
• Spreadsheet imports and source evidence: encrypted temporary CSV/XLSX contents, corrections, and interpretations expire after 24 hours after upload by default and are cleared on cancellation, successful import, or expiry cleanup. A confirmed import retains encrypted source evidence separately: source coordinates and original cells, unmapped or unresolved values, reviewed mappings and corrections, links, and accepted, skipped, excluded, header, or separator decisions. Independent clients, production drafts, private historical orders, source identities, source evidence, and import receipts remain with the workspace until included in a verified deletion request; there is no automatic age-based purge of this evidence. The original uploaded file is not retained. When AI interpretation is connected, clearing Pillar’s temporary data does not delete provider copies; store: false is not a zero-retention guarantee.
• Deadline reminders: recipient, deadline, rendered message, processing attempts, and delivery outcome stay with the order until it is deleted. These records prevent duplicate reminders; deleting them cannot recall emailed copies.
• Terms acceptance records: the account, document revision, published operator and contact details, acceptance and verification times, and sign-in context are retained to record which Terms of Service were accepted and which Privacy Policy was presented. These records do not expire with a sign-in link or support session. They are considered as part of an account deletion request, subject to any need to retain evidence for legal obligations or disputes.
• Operational records: technical, security, and email delivery logs follow the relevant service provider’s settings and policies. Pillar does not promise a single fixed deletion deadline for all provider records.

For information about the providers involved, see the privacy policy. Provider retention may differ from the time information remains visible in Pillar.

File storage and backups

Uploaded documents, studio logos, product photos, and bench photos use a persistent disk on Pillar’s Render server, so these files survive ordinary deployments and restarts. This does not guarantee recovery from deletion, corruption, or storage failure. Archiving and restoring a workspace does not restore missing files, including files lost before persistent storage was added. Keep your original files outside Pillar. Render explains its temporary and persistent storage.

Generated work-order PDFs are stored in PostgreSQL with their revisions, separately from uploaded files. Published photo references preserve the selected image against later edits; the image files remain subject to the storage and recovery limits above.

Database persistence and any available backups depend on the hosting configuration and provider practices. These retention practices describe which records Pillar intentionally keeps; they are not a guarantee that deleted or lost information can be recovered.

Request access, correction, or deletion

Email support@pillar.nyc with your studio name, your account email, and what you would like accessed, corrected, or removed. Do not send sign-in links, passwords, or unnecessary copies of sensitive documents.

If you are a client of a studio, contact the studio first. The studio controls the order information it enters and can verify which records and instructions apply. You may also contact us if you need help identifying the appropriate route.

We verify the requester’s identity and authority, clarify the affected records, and coordinate with the studio where appropriate before processing a request. Removing a team member’s access is not the same as deleting that person’s account or earlier contributions. Deleting an order does not delete its studio, team accounts, email import receipt, or separate support and acceptance history. There is currently no self-service account or company deletion button or automatic company deletion process.

We respond and act as required by applicable law. Some information may need to be retained to meet legal obligations, resolve disputes, or protect service security. If a request cannot be fulfilled in full, we will explain the applicable limitation. We do not promise a deletion date before the scope, authority, and relevant retention requirements are verified.

Limits of removal and access revocation

Revoking support permission or archiving a company stops future access through the affected Pillar pages. It cannot recall screenshots, downloads, emails, or copies already made by authorized recipients or people who held a client link. Those copies must be addressed with their holders where applicable.

Deleting information from the live application does not necessarily remove every copy immediately. Provider records follow their own retention and deletion processes. Copies previously exported or downloaded are not erased by deleting the live record.

Keep the workspace focused

Studios should add only information needed to fulfill orders, review team access regularly, and share client links only with intended recipients. Contact us when records are no longer needed and a verified deletion request is appropriate.