Privacy Policy

Last updated: September 2026

Phillote is committed to protecting your privacy. This policy explains what we collect, why, how we protect it, and what your rights are.

1. Data we collect

• Account data: name, email, phone (optional), preferred language and currency.
• Client code: a permanent identifier (e.g. PH-100003) generated automatically to identify your account on invoices and messages.
• Request data: project details, files and images you upload, and messages exchanged with us.
• Payment data: we never store your card number or security code. A licensed payment provider processes the transaction and returns only the status, amount, currency and a transaction reference.
• Invoices: we keep a copy of every issued invoice (name, email, client code, service description, amount) to meet accounting and tax obligations.
• Usage & security data: IP address, browser type, sign-in times and an audit log of administrative actions, used to detect abuse and protect accounts.
• Notifications: if you allow browser notifications we store only your device subscription identifier. You can turn this off at any time from the notifications page or your browser settings.

2. How we use your data

• To deliver the services you request and communicate about them.
• To send notifications about your requests, payments and invoices.
• To issue invoices and meet legal and accounting obligations.
• To improve service quality and user experience.
• To prevent fraud and keep the platform secure.

We do not use your data for advertising and we do not sell it to anyone.

3. Sharing with third parties

We share only the minimum necessary with: our payment provider to process transactions, our hosting provider to run the site, and our email provider to send system messages. These parties are contractually bound to use the data only for that purpose. We may also disclose data where required by law or a court order.

4. Storage & security

• Passwords are hashed with bcrypt and cannot be read, even by our team.
• All traffic is encrypted over HTTPS.
• Access to client data is limited to authorised team members, and every administrative action is written to an audit log.
• Encrypted backups are taken regularly.

5. Retention

We keep your account data for as long as the account exists. When an account is deleted, its data and files are removed within 30 days, except invoices and payment records which we are legally required to keep for longer.

6. Your rights

• Access and correct your personal data from your account settings.
• Request a copy of your data, or deletion of your account, by emailing us below.
• Withdraw consent for notifications at any time.
• Object to any processing you consider unjustified.

7. Cookies

On your first visit a banner lets you choose what you allow. Nothing outside the essential category loads before you consent, and you can change your choice at any time from the “Cookie settings” link at the bottom of every page.

Essential — cannot be switched off. The site does not work without them:

• token and adminToken — keep you signed in so you are not asked for your password on every page.
• lang and cur — your preferred language and currency.
• ph_consent — your choice in this banner, kept for 180 days.

Analytics — optional. They tell us how many people visit, which pages get read and where errors happen, in aggregate. If you allow them we may use Google Analytics and Microsoft Clarity.

Advertising — optional. They measure how our ads perform and stop the same ad being shown to you repeatedly. If you allow them we may use the Snapchat, Meta or TikTok pixel. We never sell your data.

Our own visitor counter. We run a first-party counter on our own server that counts visits with no cookie at all and without storing your IP address. It records the page, the language, the device type and the country inferred from your device’s time zone, tied to a hashed key that changes every day and cannot be traced back to you. This data is deleted after one year, and the signal is not sent at all if you reject the analytics category.

You can always block cookies in your browser settings, but blocking the essential category will stop you signing in or completing a request.

8. Children’s privacy

The service is intended for people aged 18 and over. We do not knowingly collect data from anyone younger, and will delete it immediately if we become aware of it.

9. Contact us

For any privacy question, or to exercise any of your rights, email us at: support@phillote.com.