Software terms, and how we handle your customers' data

The software costs nothing. Section 5 is the one to read: when you run it, we hold your customers' personal data, and that makes us your processor and you the controller.

Effective: 2026-08-24  ·  Last updated: 2026-09-22  ·  Status: published for review, not in force

Where this stands

Published for review. Not in force. No page asks you to accept these terms, and running the software today does not sign you up to them. Section 5 in particular describes a relationship that already exists in fact and that no document has covered until now, which is exactly why it is written down before anybody is asked to agree to anything.

1. What the software is

Two shapes, and you choose.

• Storefront. Your own online store at your own address: your products, your prices, your delivery scheduling, your customers ordering and paying you directly.
• Complete. All of that plus the operations side: orders, dispatch, drivers, stock, estimates, reporting, accounting sync.

You can also take only a piece. Most yards want the delivery scheduling and the customer notifications and nothing else, and that is a perfectly good way to use it.

Each yard that runs it gets its own separate instance: its own server process, its own database, its own address. Your data is never pooled with another yard's.

2. It is free, and here is what that does and does not mean

The software costs nothing. Nothing to licence it, nothing monthly, nothing per user, nothing to get started, nothing for support, and no charge that appears later once you depend on it.

The only fee that exists anywhere in this business is a percentage of an order a buyer places and pays through Pilebase marketplace checkout: 2%, or 2.5% if you run Complete. That is in the yard agreement, section 4. Nothing about running this software is billed, whether or not you take marketplace orders at all.

What free does entitle you to:

• Every feature. There is no paid tier holding something back.
• Your data, in full, whenever you want it (section 3).
• A person who answers. Not a promise of a response time, but a real address that reaches somebody.
• Notice before anything changes. If we ever needed to charge for this, or to stop offering it, you would get at least 90 days and a working export, not an email on the day.

What free does not entitle you to, and we would rather be blunt than sued:

• There is no uptime promise. No service level agreement, no guaranteed availability, no credits for downtime. This runs on one server operated by one person. It has been reliable and we work at keeping it that way, and it is not a promise we can make and we are not going to make it.
• There is no guaranteed response time for a fault, though in practice you will hear back the same day.
• There is no promise of any particular feature continuing to exist, though section 2's notice period applies to anything you actually rely on.
• The software is provided as it is. To the extent the law allows, we disclaim all warranties, express and implied, including fitness for a particular purpose.

Run your business on the assumption that this could be unavailable for a day. Keep the phone number, keep the paper backup for the delivery run, and take an export now and then. That is honest advice, and it is the same advice we would give about software you paid for.

3. The data in it is yours

Everything you or your customers put into your instance belongs to you. Your products, your prices, your customer list, your order history, your photographs, your settings. We claim no ownership of any of it and no licence to use it beyond running the service for you.

Export. One click, in the owner's settings, produces a single file with everything: the business settings, the products, the customers, the vehicles, the orders and their items, the status history, the drivers, the payments, the stock movements and the estimates. Passwords and login tokens are stripped, because they protect logins rather than business records. You can do this at any time, as often as you like, without asking us.

If you leave. Your export stays available for at least 30 days after you tell us you are going. Ask and we will produce one for you.

Deletion. Tell us to delete your instance and we delete it: the database, the uploaded files and the subdomain. Backups are the honest exception: a copy sits in our nightly archives until it ages out, which is 30 days for the copies on the server. We do not go into backups to pull records out, and we do not restore a deleted instance from one.

Your subdomain stops resolving when you leave, and we do not hand it to anybody else.

4. Using it

• You decide what your instance does. Your products, your prices, your delivery rules, your notification settings, your staff accounts.
• You are responsible for your staff accounts and for who you let in.
• Do not use it to break the law, to send messages people did not agree to receive, or to attack the service.
• Do not resell it or run it as a service for other businesses without asking us.
• Text messages and automated calls are heavily regulated. If your instance sends them, you are the sender, and getting the consent right is yours. We will tell you what we know, and we are not your lawyer.

5. Your customers' personal data, and why this section exists

Read this one. It describes a relationship that is real the moment you run the software and that no earlier Pilebase document has ever set out.

5.1 Who is who

When a yard runs Pilebase software, the people in it are your customers, not ours. They walked into your yard or ordered from your store. Most of them have never heard of us.

• You are the controller. You decide what is collected about them and why. You choose the settings, the notifications, the fields, the retention.
• We are the processor. We host it and we act on your instructions. We do not decide what your instance collects and we do not decide what it is for.

This is a different relationship from the marketplace. On pilebase.io, a buyer is our customer and we are the controller, and our privacy policy covers that. Here, we are working for you.

5.2 What we process, and why

Categories of people: your customers, and your staff who hold logins.

Categories of data: name, email address, phone number, delivery addresses, delivery pins and saved drop spots (a point on a map a customer chose for one of their addresses), vehicle descriptions, order and estimate history, payment records, review text, notification subscriptions, login credentials as hashes, and whatever else you choose to put in the free text fields.

Why: to run the software you asked us to run. To send the messages your instance is configured to send. To keep it available and backed up. For nothing else.

Duration: as long as you use the service, plus the wind down in section 3.

5.3 What we will do

• Act only on your instructions, meaning your configuration and what you ask us in writing, unless a law requires otherwise, in which case we will tell you unless the law forbids it.
• Keep it confidential, and only let people work on it who need to. Today that is one person.
• Keep it separate. Your instance has its own database. Your data is never pooled with another yard's, never merged into the marketplace's listings, and never used to build anything we sell.
• Never sell it, and never use it to market to your customers. Your customer list is not ours to use, and we will not send your customers anything that is not a message your instance generated.
• Take reasonable security measures: passwords hashed with scrypt, session and link tokens stored as hashes, database files readable only by the account that runs the service, nightly backups, and outbound request filtering on anything a user supplies.
• Help you answer your customers. If one of your customers asks you for a copy of their data or asks you to delete it, we will give you the tools or do it by hand. Their request goes to you, because you are the one they dealt with.
• Tell you about a breach without undue delay after we become aware of one affecting your data, with what we know at the time, and keep telling you as we learn more. You decide what your customers are told, because they are yours.
• Delete or return it when you leave, as section 3 says.
• Let you check. On reasonable notice we will answer your questions about how this works in writing, and give you what you need to satisfy yourself.

5.4 Who else touches it, and this is the full list

We use other companies to run the service. You are agreeing to these when you use the software. We will tell you at least 30 days before adding one, and you can end the agreement if you object.

• DigitalOcean, United States, which hosts the server.
• Backblaze, United States, which stores the nightly backups. Backblaze encrypts what it stores. We do not add our own encryption before uploading, and we would rather say so than let the word "encrypted" carry more than it should.
• Resend, United States, which delivers email. This is the one worth understanding: we send your customers' messages from our sending address, showing your business name. Your customer sees your name in their inbox and never learns ours. That means we are in the sending path for messages you originated, to people we have no relationship with, which is precisely why this section exists.
• Twilio, United States, for text messages and calls, only if your instance is configured to send them. It is not by default and no credentials exist unless you add them.
• Stripe, Inc., United States, for card payments. A card your own customer pays is charged on your own Stripe account, and so is a marketplace checkout, because you are the seller and the merchant of record either way. Card data goes to Stripe, not to us.
• Intuit QuickBooks, United States, if you connect it for accounting.
• Google, United States, for a driving distance on a delivery quote, if a mapping key is configured. Zone based pricing needs none of this, so an instance can run indefinitely without a mapping account at all.
• MapTiler AG, Switzerland, for map and satellite images and address lookup, if a map is configured. These requests go from the viewer's browser straight to MapTiler, so MapTiler receives the viewer's IP address, the area of the map being shown and any address typed into a lookup. Nothing is sent to MapTiler from our servers, and no map or satellite image is stored.
• Anthropic, United States, where the software reads an unstructured file you hand it: a price sheet, a spreadsheet of delivery history, a photographed document. This happens when you upload something, not in the background, and the material is read, proposed from, and dropped rather than kept.

Nobody else. No advertising network, no data broker, no analytics company. None of that runs on any Pilebase surface: no tracker, no analytics script, no pixel, nothing that watches a person from one page to the next. What Pilebase keeps for itself is a daily tally of how often a yard page, a material comparison, a search, a price question or an order happened, on Pilebase's own servers, with no identifier of any kind in it: no cookie, no address, no session, no account and no row about a person. Those totals are about the marketplace, not about your instance: nothing new is collected inside your instance to produce them.

5.5 What we need from you

• Have a privacy policy of your own and tell your customers what you collect and why. We can point you at what your instance actually holds; we cannot write your policy.
• Have a lawful basis for the messages your instance sends, especially text messages and automated calls. You are the sender.
• Do not put anything in the software that you have no right to put there, and do not put special categories of data in it: no health information, no government identity numbers, no financial account numbers beyond what the payment integration handles itself. The software is not built for that and we do not want it.
• Deal with your own customers' requests. They dealt with you.

5.6 If your customer is in a state with a privacy law

Some states give consumers rights to see, correct, delete or take away their personal data. Those obligations sit with you as the controller. We will help you meet them with the export and deletion tools, and by doing anything by hand that the tools do not cover. We will not respond to your customer directly unless you ask us to; we will point them back to you.

6. Ending it

You can stop using the software at any time. Tell us, take your export, and that is that.

We can end this with 30 days' notice, or immediately for a material breach or if we believe the software is being used to break the law.

Either way, section 3 governs your data: export available for at least 30 days, deletion on request, backups age out.

7. The rest

Changes. At least 30 days' notice for anything that materially affects you, including a new sub-processor.

Liability. The limits in the yard agreement, section 10, apply to these terms as well, in both directions. A liability cap measured as a multiple of fees paid would be zero here, because the software is free, and a zero cap is not a serious term. So the cap is a fixed floor instead: the greater of one thousand dollars or the fees we took from you in the twelve months before the claim.

Law and venue. Colorado law, Colorado courts.

Contact

Email info@pilebase.io.

Yard documents: Yard agreement · Software terms · Portal acceptable use · All Pilebase policies