how we handle your personal data.

If you joined the waitlist, this section explains exactly how we handle your data.

The waitlist is separate from the main Pilar service. It exists to notify prospective users when Pilar becomes available. The disclosures in this section apply to your waitlist data and satisfy our obligations under Article 13 GDPR for that specific processing.

What we collect from the waitlist

• —First name — used to personalise our emails to you
• —Email address — used to send you product updates and launch notifications
• —An optional promotion code, if you received one (for example from your university or from Pilar), which sets the length of your free period and tells us where you heard about Pilar
• —Submission timestamp and the result of a Cloudflare Turnstile check, used to prevent automated bot submissions
• —If you arrive through a link with campaign tags (for example from a post, a newsletter or a partner), the campaign and the page that sent you, used only to know which campaigns bring people to Pilar
• —IP address, retained transiently for abuse prevention only and discarded once the submission is validated

Legal basis

We process your waitlist data on the basis of your consent under Article 6(1)(a) GDPR. By submitting the waitlist form you consent to receive product updates from Pilar until you withdraw that consent. Providing the data is entirely voluntary — you can use Pilar once it launches without ever having joined the waitlist. The campaign and referring page are recorded on the basis of our legitimate interest in knowing which campaigns work (Article 6(1)(f) GDPR). Keeping your promotion code with your account after signup (see “How long we keep it” below) is based on our legitimate interest in knowing which events and partners bring people to Pilar (Article 6(1)(f) GDPR).

How we use it

We do not use waitlist emails for any other purpose. We do not sell them. We do not share them with employers, marketing partners, or any third party outside the subprocessor list below. We do not use them to train third-party AI models.

Who processes your waitlist data

Waitlist data is stored in Supabase (EU data region, encrypted at rest with AES-256), transactional emails are sent via Resend, and bot protection is provided by Cloudflare Turnstile. The full subprocessor list, including data protection safeguards, is on our Trust page. Where a subprocessor is US-headquartered, transfers are governed by European Commission Standard Contractual Clauses and supplementary technical measures consistent with Schrems II guidance.

How long we keep it

Waitlist emails are retained until you either (a) complete signup for a Pilar account once the service becomes available, or (b) unsubscribe — whichever comes first. On signup, we record your free period with your account (whether a promotion code applied, which one, and the date it ends) and delete your waitlist entry. The promotion code stays with your account so that we can see which events and partners bring people to Pilar, and is deleted when your account is deleted. On unsubscribe, your entry is deleted straight away (see below). If Pilar is discontinued before launch, all waitlist data is deleted within 30 days of the discontinuation announcement.

When you unsubscribe, your waitlist entry is deleted straight away. We keep only a record that you unsubscribed and when: a one-way fingerprint of your email address (not the address itself; it cannot be turned back into the address, only matched against an address we are given), as proof that we respected your choice. We keep this record for 3 years, the period during which a complaint about our emails can still be raised, and then delete it. We keep it on the basis of our legitimate interest in being able to show that we respected your choice (Article 6(1)(f) GDPR).

After unsubscribing, you can tell us why by choosing one of a few reasons. This is optional. We store only the reason you chose and the month, never your email address or its fingerprint, and nothing that links your answer to you or to the record of your unsubscribe.

Your rights

• —Unsubscribe at any time — every marketing email includes a one-click unsubscribe link. Unsubscribing stops all marketing emails; we still send the emails needed to run your account (for example your password link, bank connection reminders and free period notices), which never contain advertising
• —Access, correct, delete, restrict, port, or object to processing of your waitlist data — write to [email protected]
• —Withdraw consent at any time (withdrawal does not affect the lawfulness of processing before it was withdrawn)
• —Lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es) or your local supervisory authority

We collect what we need to operate the service. Nothing more.

Identity data

• —Name and email address (required for account creation)
• —Employer name (required to associate you with the correct workspace)
• —Optional profile information you choose to add (role, tenure, other demographic information relevant to peer benchmarking)
• —Your free period (which offer applies and the date it ends) and, if you joined the waitlist with one, your promotion code (see Section 02)

Financial data (only if you choose to add it)

• —Bank accounts you choose to connect through our regulated open banking partner, Powens (see Section 07 for how this data flows): for each shared account, its name with the last four digits of the account number, its type and currency, its balances and its booked transactions (date, amount, your bank's description and the transaction type), plus the status of each connection and the date until which your bank access is valid
• —A copy of each delivery from Powens, kept so it can be processed again if needed. Deliveries can include full account numbers and earlier transactions that the app does not display
• —Account balances, holdings and transactions from bank statement files you upload. Once you have a complete month in Pilar, transactions in a file dated after it are not stored: you upload them with the full export once that month closes (see our Terms, Section 02)
• —Transaction descriptions and categorisations, including the category suggested by our AI provider for a transaction, the cleaned-up version of its description that was used, and how confident we are in that category (see Section 07)
• —Assets you record (property, pension, other investments)
• —Stated financial goals and plans

Behavioural data

• —Course chapters started, completed, and time spent
• —Wellbeing score progression over time
• —NPS ratings you submit

Technical data

• —Session logs (login times, device type, general location)
• —Application error logs (for debugging)
• —IP addresses (retained for security purposes only)
• —The steps of each bank connection attempt (connection screen opened, sent to Powens, returned, first data received), with the error and the connection identifier Powens returns, used to detect and fix connection problems and to report them to Powens
• —A record of the service emails we send you about your bank connections and your account

We do not sell your personal data to anyone. We do not use your data to train third-party AI models, and our AI provider does not keep the text we send it or use it to train its models. We do not share your data with your employer at an individual level.

Automatic categorisation only sorts your transactions so you can see your spending and saving. It is not advice, and no decision with legal or similarly significant effects on you is made by automated means.

Your employer never sees your individual financial data or personal Pilar activity.

This separation is architectural, not policy-based. See our Trust page for the full technical detail.

Under GDPR Article 6, we process your personal data on the following legal bases:

• —Consent (Article 6(1)(a)): for optional data you choose to add (financial accounts, including bank accounts you connect through Powens, and demographic information) and for waitlist processing (see Section 02). You give consent for a bank connection when you connect it, and withdraw it by disconnecting the bank
• —Contract performance (Article 6(1)(b)): for essential data needed to provide the service (identity, account credentials), for sorting your transactions into categories, including by our AI provider, and for service emails about your bank connections and your account
• —Legal obligation (Article 6(1)(c)): for tax, accounting, and regulatory record-keeping, and for the record that an account deletion was carried out
• —Legitimate interest (Article 6(1)(f)): for security monitoring, service improvement, fraud prevention, monitoring the steps of bank connections to detect and fix connection problems and report them to Powens, keeping the Powens identifiers of a deleted account (see Section 08), keeping the shared list of merchant categories and checking how often users change them (see Section 07), keeping a record of waitlist unsubscribes for 3 years as proof that we respected them (see Section 02), keeping the promotion code you signed up with to see which events and partners bring people to Pilar (see Section 02), and holding the demos booked with us and following up on them (see Section 08)

Where processing is based on consent, you may withdraw that consent at any time through your account settings or by writing to [email protected]. Withdrawal does not affect the lawfulness of processing before withdrawal.

Open banking data

When you connect a bank account through Pilar, we work with Powens SAS, a French Payment Institution regulated by the Autorité de Contrôle Prudentiel et de Résolution (ACPR, CIB number 16948, SIREN 749 867 206), which operates the secure PSD2 connection to your bank.

Powens acts as an independent Data Controller of the banking data it collects on your behalf. When you initiate a bank connection you are redirected to the Powens Webview and enter into a direct relationship with Powens, subject to their Terms of Use (https://www.powens.com/terms-and-conditions-of-sale/) and their End-User Privacy Policy (https://www.powens.com/privacy-policy-of-end-user-personal-data/).

Banking data collected via Powens is stored encrypted on Powens' servers in the European Union (France) and transmitted to Pilar so we can provide the services described in Section 04. Pilar and Powens each act as independent Data Controllers of this data within our respective scopes: Powens for the collection and aggregation from your bank; Pilar for the display, categorisation, and analysis of the data within our product.

Pilar does not send Powens your name, email address or any other identity details. When you choose to continue to Powens, Pilar creates an anonymous Powens user for you, even if you then cancel. When you delete your Pilar account, Pilar instructs Powens to delete that user and its connections.

You may disconnect a bank at any time from the bank account's details in Pilar. Disconnecting deletes the connection at Powens and stops all synchronisation; the history already delivered to Pilar stays in your account. See Section 08 for retention rules that apply on disconnection.

Automatic categorisation by an AI provider

Pilar sorts your transactions into categories (for example groceries, rent or salary). Your own changes and rules always come first, then transfers between your own accounts and Pilar's rules, then the category Pilar already gave the same transaction or the same merchant. Only a transaction that none of these recognises is sent to our AI provider, Mistral AI SAS (Paris, France), which acts as our subprocessor. Pilar uses Mistral's European Union endpoint, so the data is processed in the EU and is not transferred outside it.

Mistral does not keep the text we send after returning its answer (zero data retention) and does not use it to train its models. Its answer can only be one of Pilar's fixed list of categories.

Mistral never receives your name, email address, user identifier, account names, exact amounts, dates, your other transactions, or your rules and changes. A transaction whose description has nothing left to read once personal details are removed is never sent: it gets a default category for you to review.

Pilar's confidence in each category is measured on a test set of transactions, not taken from the model. Transactions with low confidence are listed for you to review, and you can change any category.

Shared merchant categories: when at least three different Pilar users have transactions with the same merchant, and the model has identified it as a business with sufficient confidence, Pilar stores that merchant's cleaned-up name with its category so it can be reused for other users without asking the model again. Names containing a person, an account number, an email address or a phone number are never stored. This shared list contains no user identifier and no user's own changes, and it cannot be linked back to you. Pilar also counts, without recording who, how often users change a shared category, and stops using it if users change it too often.

Subprocessors

We use subprocessors to operate the service. Full list, roles, and country of operation are published on our Trust page, including our EU-hosted database and backend (Supabase, Railway), our frontend host (Vercel), our edge network (Cloudflare), our transactional email provider (Resend), our error-monitoring provider (Sentry), our scheduling provider (Cal.com), our open banking partner (Powens, independent controller) and our AI categorisation provider (Mistral, EU endpoint).

Where a subprocessor is US-headquartered or routes traffic through non-EEA edge locations, transfers are governed by European Commission Standard Contractual Clauses (Decision 2021/914) and, where applicable, EU-US Data Privacy Framework certification, together with supplementary technical measures consistent with Schrems II guidance. Powens stores banking data in the European Union (France); Mistral processes AI requests through its European Union endpoint; our application database is hosted in the EU (Frankfurt).

Vercel Web Analytics

withpilar.com and app.withpilar.com use Vercel Web Analytics for aggregate, cookieless page-view statistics. No cookie is set, no cross-site identifier is assigned, and no raw IP is retained — only anonymised aggregate counts (page, country at country level, device type). Vercel Web Analytics is provided by Vercel Inc. (US company) and is covered by the Standard Contractual Clauses described above. We do not use Vercel Speed Insights or any other analytics product that would require consent under ePrivacy Article 5(3).

We do not sell your data. We do not share your individual data with your employer, marketing partners, or any third party outside our subprocessor list (which includes our AI provider, described above) and the independent partners (like Powens) described above.

We may disclose your data if required by law (court order, criminal investigation), in which case we will notify you unless legally prevented from doing so.

While your account is active

Personal profile and financial data are retained for as long as you have an active account.

When you deactivate

If your employer contract ends or you leave the organisation, your personal data is automatically anonymised 90 days after deactivation unless you migrate to a personal subscription or object to anonymisation.

If you delete your account

You can delete your account in the app (Setup → About you → Delete my account) or by writing to [email protected]. After a request in the app you receive a warning email and have 24 hours to cancel with “Keep my account”; the deletion then runs automatically, normally within two days. A request by email is carried out straight away, once we have confirmed it comes from you. Either way, the deletion is always completed within 30 days. It removes your Powens user and bank connections at Powens, your uploaded files, all your data in Pilar and your login. You will receive email confirmation with a reference number.

We keep a record that the deletion was carried out: a random identifier that no longer matches anyone, the steps completed and their dates and, if you had connected a bank, the identifiers of the anonymous Powens user and connections we asked Powens to delete, so that we can prove the deletion and resolve any question about it with Powens. It contains no name, email address or financial data. We keep it for 5 years after the deletion, the period during which it may be needed as proof, then delete it.

When a free period ends

If your free period ends and you do not subscribe, Pilar stops updating your connected bank accounts, and your account stays available to read for 3 more months. If you have not subscribed by then, your account is deleted as described above. We email you 14 days before your free period ends, on the day it ends, and 7 days before the deletion.

Inactive accounts

If you do not sign in to Pilar for 23 months, we email you to ask whether you want to keep your account. If you do not sign in within the following 30 days, your account is deleted as described above.

Waitlist data

See Section 02 for retention rules that apply specifically to waitlist email addresses, including the record that you unsubscribed (kept 3 years).

Demo bookings

If you book a demo with us through our booking page (run for us by Cal.com), we receive your name, email address, the meeting time, your time zone and any notes you add. We use them to hold the meeting and to follow up on it, on the basis of our legitimate interest in answering your request (Article 6(1)(f) GDPR). We delete them 2 years after the meeting date, including for meetings that were cancelled.

Bank connections via Powens

While a bank connection is active, banking data is held by Powens for the duration of your consent (renewable every 180 days under PSD2). If your consent is not renewed, Pilar stops receiving updates, but the connection remains with Powens until you reconnect it, disconnect it or delete your Pilar account. If you disconnect a bank, the connection is deleted at Powens, and Powens retains the associated data for a maximum of 30 days before permanent destruction, in accordance with our contract with Powens. If you delete your Pilar account, Pilar instructs Powens to delete your Powens user and its connections.

Banking data already delivered to Pilar, including the copies of Powens deliveries, stays in your Pilar account after you disconnect a bank, with the accounts marked inactive, so that your past net worth remains correct. It is deleted when you delete your account.

Automatic categorisation

The categories suggested by our AI provider, with the cleaned-up descriptions used and Pilar's confidence in them, stay in your Pilar account with your transactions and are deleted when you delete your account. Mistral does not keep the text we send. The shared list of merchant categories (see Section 07) is not linked to any user, so it is not deleted with your account.

Anonymised aggregate data

May be retained indefinitely for product improvement and academic research. Anonymised data cannot be linked back to you.

Under GDPR, you have the right to:

• —Access the personal data we hold about you
• —Correct inaccurate or incomplete data, including changing any category of a transaction directly in the app
• —Delete your data ("right to be forgotten")
• —Restrict or object to certain processing
• —Receive your data in a portable format
• —Withdraw consent where processing is based on it
• —Lodge a complaint with a data protection authority

To exercise any of these rights, contact [email protected]. We respond within 30 days.

Data access and portability (Article 15 and Article 20)

To request a copy of the personal data we hold about you, email [email protected] with the subject line "Data access request" from the email address linked to your Pilar account. Within 30 days we will send you a one-time download link to a password-protected archive (JSON + CSV, machine-readable) containing: your profile, your accounts and their history, your transactions, your manual balances, your uploaded-file list, your category rules and overrides, your feedback, your bank-connection metadata (Powens connection ids, states and timings, never your bank credentials), your email preferences, and the dates of any erasure or restriction requests. Your banking data obtained through Powens may also be requested directly from Powens, who acts as independent controller for that data (see Section 07).

A self-serve export from within Pilar is planned for early 2027. Until then the manual flow above applies and carries the same 30-day commitment. Deletion remains available directly in the app at any time (Setup → About you → Delete my account); see Section 08 for how deletion works.

You may also lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es).

Because Powens acts as an independent Data Controller for banking data collected via PSD2, your rights over data held by Powens may also be exercised directly with Powens, per their own Privacy Policy.

All personal data is encrypted at rest (AES-256) and in transit (TLS). The access tokens that let Pilar receive your banking data from Powens carry an additional layer of encryption, with the key kept outside the database.

Banking data collected via Powens is encrypted at rest on Powens' infrastructure (France, EU) and transmitted to Pilar over encrypted TLS channels. Pilar accepts banking data from Powens only when it carries a valid Powens signature and comes from Powens' own network addresses. Powens' own security certifications and controls are described on our Trust page.

Full technical details on encryption, authentication, incident response, and security audits are on our Trust page.

If a personal-data breach ever affects your data, we will notify you and the Spanish Data Protection Agency (AEPD) in accordance with GDPR Articles 33 and 34. The full procedure, timelines, and your rights in that situation are set out in our Breach Notification Policy at withpilar.com/legal/breach-notification.

We may update this policy to reflect changes in our practices or legal requirements. Material changes will be notified to you by email at least 30 days before they take effect.

The current version of this policy is always available at withpilar.com/legal/privacy. The date at the top indicates when the policy was last updated.