Privacy Policy

1. Introduction

Pile AI respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you use our service.

2. Information We Collect

Account Information

• Email address (from Replit authentication)
• Name and profile information (from Replit)
• Account creation date and authentication tokens

Query Data

• Questions you submit to the AI
• AI-generated responses
• Query timestamps and metadata
• Optional feedback ratings you provide

Payment Information

• Payment card details (securely handled by Stripe - we never see your full card number)
• Billing address
• Purchase history and subscription status
• Stripe customer ID for subscription management

Usage Data

• Query count and frequency
• Feature usage patterns
• Browser type and device information
• IP address and approximate location

3. How We Use Your Information

We use your data to:

• Provide AI-powered responses to your questions
• Process payments and manage subscriptions
• Track query limits for your subscription tier
• Improve our AI models and service quality
• Send important service updates and billing notifications
• Detect and prevent fraud or abuse
• Comply with legal obligations

4. Google Drive Integration (Admin Only)

The service owner connects their Google Drive account to curate the knowledge base:

• Only the service owner's Google Drive is connected (not end users)
• We access only the specified "Clips" folder with read-only permissions
• Documents are processed to create AI embeddings for semantic search
• Original documents remain in Google Drive and are not modified
• Document content is stored securely in our database for query processing
• We use Google's OAuth 2.0 for secure authentication

End users (people asking questions) do not connect their Google Drive accounts and cannot access the source documents directly.

5. Data Storage and Security

Where We Store Data

• Database: PostgreSQL hosted on Neon (serverless cloud database)
• Authentication: Managed by Replit's secure authentication system
• Payments: Processed and stored by Stripe (PCI-compliant)
• Application: Hosted on Replit infrastructure

Security Measures

• HTTPS encryption for all data in transit
• Encrypted database connections
• Secure session management with HTTP-only cookies
• API keys and secrets stored in Replit's secure Secrets manager
• Regular security updates and monitoring
• Limited access to production data (admin only)

6. Third-Party Services

We use the following third-party services that may access your data:

Replit (Authentication & Hosting)

• Handles user authentication and profile information
• Hosts the application infrastructure
• Privacy Policy: https://replit.com/site/privacy

Stripe (Payment Processing)

• Processes all payments securely
• Stores payment card details (we never see full card numbers)
• Manages subscriptions and billing
• Privacy Policy: https://stripe.com/privacy

OpenAI (AI Processing)

• Generates AI responses to your questions
• Creates embeddings for semantic search
• Your queries are sent to OpenAI's API but not used to train their models (per our agreement)
• Privacy Policy: https://openai.com/privacy

Google Drive API (Admin Only)

• Syncs documents from the owner's "Clips" folder
• Read-only access to specified folder
• Privacy Policy: https://policies.google.com/privacy

Neon (Database Hosting)

• Serverless PostgreSQL database provider
• Stores user data, queries, and document content
• Privacy Policy: https://neon.tech/privacy-policy

7. Data Retention

• Account data: Retained as long as your account is active
• Query history: Retained indefinitely for service improvement (can be deleted on request)
• Payment records: Retained for 7 years for tax and legal compliance
• Deleted accounts: Data is permanently removed within 30 days

8. Your Rights

You have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your account and data
• Export your query history
• Opt out of marketing communications (we don't send marketing emails by default)
• Withdraw consent for data processing (may affect service availability)

To exercise these rights, reach out through the support contact listed in Section 13 (Contact Us) below.

9. Cookies and Tracking

We use minimal cookies:

• Session cookies: Required for authentication (HTTP-only, secure)
• LocalStorage: Saves draft queries to prevent data loss (stored locally in your browser)
• Anonymous visit counting: We count page visits using a random, short-lived ID kept only in your browser's session storage (cleared when you close the tab). This is first-party and privacy-preserving — no cookies, no IP address, and no personal data are stored with it.
• No third-party advertising or tracking cookies

10. Children's Privacy

Pile AI is not intended for users under 13 years of age. We do not knowingly collect data from children. If you believe a child has provided us with personal information, please contact us immediately.

11. International Data Transfers

Your data may be transferred to and processed in countries outside your residence. We ensure appropriate safeguards are in place through our service providers' compliance with international data protection standards (GDPR, CCPA, etc.).

12. Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be communicated via email. The "Last updated" date at the top indicates the most recent revision.

13. Contact Us

For questions about this Privacy Policy or our data practices, or to request access, correction, or deletion of your data, please use the contact options available on our website or reach out to the service owner directly through your account.

Summary

We collect minimal data necessary to provide the service, process payments, and improve quality. Your queries and responses are stored securely. Payment details are handled by Stripe (we never see full card numbers). The service owner's Google Drive is connected to curate the knowledge base, but end users don't connect their own Google accounts. We don't sell your data or use it for advertising.