Privacy Policy

This Privacy Policy explains what personal information PivotHero collects, why we collect it, how long we keep it, and the rights you have over it. We wrote it to be genuinely readable rather than a wall of boilerplate — if anything here is unclear, contact us at support@getpivothero.com and we'll explain it in plain language.

What personal information does PivotHero collect?

When you create an account, we collect your name, email address, country, and a securely hashed version of your password (we never store or have access to your actual password). When you subscribe to PivotHero Pro, our payment processor Stripe handles your card details directly — we only receive a payment confirmation, invoice number, and amount; we never see or store your full card number. When you upload a spreadsheet, we process the file to generate your pivot table, charts, and summary. When you contact support or submit feedback, we keep the content of that message so we can respond to it.

Is my uploaded spreadsheet data safe and secure?

Yes. Files are transmitted over an encrypted (HTTPS) connection, and the folder they're stored in is configured to block direct public access and to prevent any uploaded file from being executed as code. Passwords are hashed with Argon2id, one of the strongest password-hashing algorithms available, rather than stored as plain text. Access to the underlying database and server is restricted to authorized administrators only.

How long does PivotHero keep my uploaded files and reports?

Uploaded files and the reports generated from them are kept for as long as your account is active, so Pro subscribers can reopen past reports without re-uploading. If you delete your account, your files, generated reports, and personal information are scheduled for permanent deletion. If you'd like a specific file or report removed sooner, contact support and we'll action it manually.

Does PivotHero sell my personal data to third parties?

No. We do not sell, rent, or trade your personal data or the contents of your spreadsheets to anyone, for any purpose, under any circumstances. This has always been our policy and it will not change without prominent notice and, where required by law, your prior consent.

Which third-party services does PivotHero share data with?

A small number of specialist providers process limited data on our behalf, strictly to run the service: Stripe processes payments and never shares your full card details with us; our email delivery provider sends account-related messages when email features are enabled; our hosting provider stores the application and database; and, if enabled on your account, Google Analytics and Google AdSense may use cookies for site analytics and advertising, as described below. None of these providers are permitted to use your data for their own independent purposes.

Is PivotHero GDPR compliant for businesses in the EU and UK?

PivotHero is built with GDPR principles in mind: we collect only the data needed to run the service, we don't sell personal data, and if you're located in the EU, EEA, or UK you have the right to access, correct, export, or delete your personal data — email support@getpivothero.com and we will action the request. If you believe we're not meeting an obligation under GDPR or another applicable data protection law, contact us directly so we can resolve it — you also retain the right to lodge a complaint with your local data protection authority.

What cookies does PivotHero use, and can I control them?

PivotHero uses essential cookies to keep you logged in, remember your session, and protect against cross-site request forgery — the service won't function correctly without these. If configured on your account, we may also use optional analytics cookies (Google Analytics) to understand how the site is used, and advertising cookies (Google AdSense) to serve relevant ads. You can manage non-essential cookie preferences through your browser settings; see our Cookie Policy for details.

How do I access, export, or delete my personal data?

Email support@getpivothero.com from the address on your account and tell us what you'd like — a copy of your personal data, correction of something inaccurate, or full account deletion. We verify the request is genuinely coming from you, then action it, typically within a few business days. Deletion removes your personal information and uploaded files and cannot be undone, so we recommend requesting an export first if you want to keep anything.

Does PivotHero use my data to train AI models?

No. The AI recommendations in PivotHero (which columns to use as rows, values, or filters) run against your file at the moment you generate a report — your spreadsheet data is not used to train, fine-tune, or improve any machine learning model, ours or a third party's, and it is not retained for that purpose.

How does PivotHero protect my data from breaches?

We apply layered security practices: encrypted connections, hashed passwords, parameterized database queries to prevent SQL injection, cross-site request forgery (CSRF) protection on every form, rate limiting on sensitive actions like login and password reset, and security response headers on every page. No system is completely immune to risk, but if a breach affecting your personal data ever occurred, we would notify affected users and, where legally required, the relevant regulator without undue delay.

Does PivotHero collect data from children?

PivotHero is a business reporting tool intended for use by adults and organizations, not children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

Will my data be transferred outside my country?

Because we use internationally-operating service providers (such as our payment processor and hosting infrastructure), your data may be processed in a country other than the one you're located in. Where this involves a transfer out of the EU, EEA, or UK, we rely on the safeguards those providers offer, such as Standard Contractual Clauses, to ensure your data continues to receive an appropriate level of protection.

How will I know if this policy changes?

If we make a material change to how we handle your personal data, we'll update the date on this page and, for significant changes, notify account holders by email or an in-app notice. We encourage checking this page periodically if you have ongoing concerns about privacy.

Who do I contact with privacy questions?

Email support@getpivothero.com for any question about this policy, your personal data, or how PivotHero handles your spreadsheet uploads. We aim to respond to privacy-related requests within 2 business days.