Pyro
Privacy Policy
What changed in 1.6
- AI reading now happens inside the EU. Invoices are read by Google's
Gemini on Google Cloud's Vertex AI, through Google's EU endpoint, under Google Cloud's data processing terms (section 4). Firms no longer have AI keys of their own.
- A cost record for each AI call — which firm, client and document it was
for, the kind of call, the tokens used and its cost in euros — kept 400 days (sections 3.4 and 9). Each request to Vertex AI carries two billing labels: your firm's random ID number (not its name) and the kind of call (section 4).
- The exact list of cookies and browser storage Pyro uses (section 7).
The short version
Pyro reads invoices for accounting firms and turns them into draft entries in their accounting software — Xero or Zoho Books. To do that we handle two very different kinds of information, and we treat them differently:
- Information about you — your email address, your firm, what you do in the
app. We decide how this is used, so this policy governs it.
- The invoices you upload — we only handle these because your firm told us
to. Your firm decides what happens to them, not us. Those are covered by our Data Processing Agreement instead.
We do not sell your data. We do not use it for advertising. We do not run any analytics or tracking on our website. We do not let any AI provider train on your invoices. One AI provider reads them — Google, inside the EU — and nobody else.
1. Who we are
Pyro is operated by Trevor St. John, an individual trading as "Pyro".
Based in: Malta — postal address available on request Email: support@pyroplatform.com
For anything in this policy, that email reaches a real person.
2. The two roles we play
This matters, so it's worth one clear paragraph.
Where we are the "controller" — we decide why and how information is used. This covers your user account, the details you give us when you ask to set up a firm, our billing records, and our security logs. This policy covers that.
Where we are the "processor" — we handle information purely on your firm's instructions and for its purposes. This covers everything inside the invoices and accounting documents you upload, and everything we read from your Xero or Zoho Books organisation. Our DPA covers that, not this policy. If you are a supplier or customer whose details appear on an invoice someone uploaded to Pyro, the accounting firm — not Pyro — is who you should contact.
3. What we collect, and why
3.1 When you sign in
Pyro has no password system. You sign in with your Xero or Zoho Books account, and that service tells us your email address. We check that the answer really came from Xero or Zoho before we trust it. That's it — we never see or store a password. This is true for everyone, including Pyro's own administrators: nobody signs in to Pyro with a password.
| What | Why | Legal basis |
|---|---|---|
| Email address | To identify your account and let you in | Performance of a contract |
| Your role and firm membership | To show you the right things and enforce permissions | Performance of a contract |
| The IP address you signed in from | Written to our security log with each sign-in, to detect and investigate misuse | Legal obligation (GDPR security duty); legitimate interest in security |
3.2 When you ask us to set up a firm
The form on our website collects:
| What | Why | Legal basis |
|---|---|---|
| Firm name, your name, email, phone (optional) | To contact you and set up the account | Steps taken at your request before a contract |
| Rough number of clients and monthly invoices, and which accounting software you use | To prepare your account | Steps taken at your request before a contract |
3.3 If you fill in one of our research surveys
If you complete a survey we've sent you, we collect your name, firm, email, phone and your answers. Legal basis: our legitimate interest in understanding what accounting firms need. You can ask us to delete this at any time and we will.
3.4 While you use Pyro
| What | Why | Legal basis |
|---|---|---|
| An audit log: each action taken on each invoice and client, and who took it | So your firm has an audit trail, and so we can investigate problems | Performance of a contract; our legitimate interest in a reliable service |
| A security log: sign-ins (with the IP address), failed sign-ins, Xero and Zoho Books connections, changes made by Pyro's administrators, and Pyro support access to your firm | To detect and investigate misuse | Legal obligation (GDPR security duty); legitimate interest in security |
| Usage and cost records for billing | To bill you accurately and show you what you've spent | Performance of a contract |
| A cost record for each AI call: the firm, client and document it was for, the kind of call (for example reading or coding), the number of tokens used, and what it cost us in euros. No invoice content | To know what reading costs for each firm, so we can price the service fairly and spot problems | Legitimate interest in running the service at a sustainable cost |
We also use your IP address briefly — for minutes, at most an hour — to limit how many requests one address can make, so nobody can hammer the service. Those counters are cleared automatically once their time window has passed.
3.5 Payments
Payments go through Stripe. Stripe collects your card details directly on its own hosted checkout — we never see or store your card number. We keep your Stripe customer reference and the amounts charged.
3.6 Emails we send
We send a small number of emails through Resend, an email delivery service: payment receipts to your firm, a notice to your firm owner when Pyro support opens your firm (section 10), and alerts to ourselves when something in Pyro needs attention. Resend sees the recipient's address and the email's contents. We send no marketing email.
4. The documents you upload
When your firm uploads an invoice, here is exactly what happens:
- The file is stored in our private, encrypted file storage in the EU. It is
not public and has no shareable link.
- If we've already learned that supplier's layout, we read it on our own
servers and the document itself is not sent anywhere.
- Otherwise, the document is sent to Google's Gemini AI to be read, on
Google Cloud inside the EU. Google is the only AI provider that receives your documents.
- To suggest accounts and VAT treatment, the details read from the invoice —
together with the client's chart of accounts and a summary of how its accounts are used — may also be sent to Google's Gemini AI, in the same way.
- The result is shown to a person on your team to review. Nothing is sent to
your accounting software without someone seeing it first, and what is sent is always a draft.
To check a supplier's details, we may also look up a VAT number in the EU's public VIES register, or a company name in the public GLEIF legal-entity register. Only that number or name is sent — nothing else.
We handle these documents as a processor on your firm's instructions. See the DPA for the full detail.
What we send to Google, and what Google does with it
We send only what is needed to read and code the invoice. We do not send our database, your other clients, or anything else about you.
How Google reads them: inside the EU. We read documents through Google Vertex AI, Google Cloud's paid AI service, using Google's EU endpoint (aiplatform.eu.rep.googleapis.com), so the reading is processed inside the European Union. Google handles them under Google Cloud's data processing terms, as our processor, and under those terms does not use them to train its models. Pyro's software only accepts a Google Cloud location inside the EU, and if anything about that EU setup fails, Pyro refuses to send the document rather than send it somewhere else.
The one exception, which is not in use. Pyro's software can also reach Google through the Gemini API (generativelanguage.googleapis.com), but only if the Vertex AI setup above is removed altogether — it is not used today. Even then it would only use Google's paid service, never the free tier, which has weaker data terms: Pyro refuses to send a document on a Google key it has not been told is billed. The Gemini API may process documents outside the EU, under the European Commission's Standard Contractual Clauses. We would tell firm owners by email before ever reading this way.
Billing labels. Each request to Vertex AI carries two labels so that Google's bill can be split by firm: your firm's random ID number in Pyro (not its name) and the kind of call (for example "reading" or "coding"). They contain no names and nothing from your documents.
We want to be precise here: we do not have a "zero retention" arrangement with Google. Google's terms let it keep what it is sent for a limited time, for example to detect abuse, so it would be wrong for us to tell you your invoices are never stored by Google at all. What we can tell you honestly is that Google does not use them to train its models, and reads them inside the EU under its Cloud data processing terms.
Checking our own accuracy
To make sure Pyro reads invoices correctly, we may keep a copy of a sample of invoices your firm has already posted in Xero or Zoho Books, with how each was posted, and re-read them to compare. These copies are kept apart from your uploads, seen only by us and, when we re-read them, by Google as described above — never shared with anyone else, and never used to train any AI model. Ask us and we delete them.
We also count how often each of Pyro's own coding methods turned out right, across all firms. Those are counts only — no invoice content, no names, no amounts — and they decide how confident Pyro is allowed to be.
5. Your accounting software: Xero and Zoho Books
Xero and Zoho Books are your own accounting systems, not ours. When your firm connects one, you authorise us as follows.
Xero. Pyro asks Xero for exactly these permissions, and no others:
| Permission | What Pyro does with it |
|---|---|
offline_access | Keeps the connection working without asking you to sign in to Xero every time |
accounting.invoices | Reads invoices and bills, and creates draft bills, sales invoices and credit notes |
accounting.contacts | Reads your contacts (suppliers and customers) |
accounting.settings | Reads the chart of accounts, tax rates and organisation settings — and adds a new account to the chart, only when someone on your team asks Pyro to |
accounting.attachments | Attaches the source document to the draft |
When a draft names a supplier or customer who isn't in your contacts yet, Xero creates that contact itself as part of saving the draft.
Zoho Books. Pyro reads organisations, the chart of accounts, taxes, contacts (vendors and customers), and posted bills and invoices; creates contacts and draft bills and sales invoices; and attaches the source document. It asks for no delete or payment permissions.
In both, we read the chart of accounts, tax rates and contacts so we can code invoices correctly. We may also copy a sample of invoices and bills you have already posted, with their attachments, to check our accuracy, as described in "Checking our own accuracy" above.
Everything we send is a draft. Pyro never approves, authorises, pays, voids or deletes anything in your accounts. When you disconnect an organisation, Pyro removes its own connection to it.
With Zoho Books, one sign-in can reach several organisations; you choose which of them to connect, and only those become clients in Pyro. Your Zoho Books data stays in the Zoho data centre your organisation uses, under your own agreement with Zoho.
We store the tokens that keep each connection alive. They are encrypted before they are written to our database, so they are not readable from the database alone.
6. Who else handles your information
These are the only third parties involved:
| Who | What they do | Where |
|---|---|---|
| Supabase | Our database and file storage | Paris, France (EU) |
| Vercel | Runs our application | Paris, France (EU) region; US company |
| AI reading of invoices (Gemini on Google Cloud Vertex AI) | Inside the EU (Google's EU endpoint). The Gemini API, which is not used today, could process outside the EU under Standard Contractual Clauses (section 4) | |
| Stripe | Payments | United States / Ireland |
| Resend | Sends receipts, support notices and our own alert emails | United States |
| GitHub | Keeps our encrypted nightly database backups for 14 days | United States |
That's the complete list. There is nobody else. No other AI provider receives your documents or anything read from them.
About the backups. Every night a copy of our database is encrypted before it is handed to GitHub, so what GitHub stores is an encrypted file. The passphrase is kept as an encrypted secret that only the backup job can use — never stored alongside the backups, and not viewable by anyone through GitHub once set. Each backup is deleted after 14 days.
Xero and Zoho Books are not on this list on purpose: they are your firm's own accounting systems. We send drafts to them because your firm tells us to, and your agreement with Xero or Zoho governs what they do with your data. The EU VIES and GLEIF registers (section 4) are public lookups, not services that handle your data for us.
7. Cookies, analytics and tracking
We do not use any analytics or tracking. No Google Analytics, no Facebook pixel, no advertising cookies, no session recording, no third-party trackers of any kind. We're not being modest — there genuinely aren't any.
The only cookies keep you signed in. Pyro sets exactly three cookies, all of them our own:
| Cookie | What it does | How long it lasts |
|---|---|---|
__Host-pyro_at | Holds your signed-in session (the sign-in token) | As long as that token — one hour by default — or until you sign out |
__Host-pyro_rt | Renews your session so you are not signed out every hour | 30 days, or until you sign out; each renewal replaces it |
__Host-pyro_oauth | Links the two halves of one sign-in, or one Xero or Zoho Books connection, so nobody can hijack it | 10 minutes, and removed as soon as that sign-in or connection finishes |
Our hosting provider, Vercel, runs a security check against automated attacks. If it ever needs to check that a visitor is a real browser, it may set its own short-lived security cookie (for example _vcrcs). It is set by Vercel, not by Pyro's code, is used only for that check, and is also strictly necessary.
All three of Pyro's own cookies are strictly necessary to provide the service you asked for. They are readable only by our server (not by scripts on the page), sent only over a secure connection and only to Pyro's own site, and never used to follow you anywhere. Under EU ePrivacy rules, strictly necessary cookies do not need your consent, which is why Pyro shows no cookie banner: there is nothing optional to accept or refuse.
What your browser remembers for you. Pyro also keeps a few settings in your browser's own storage, on your device. We don't receive them, and they are purely for convenience:
| Where | What is remembered |
|---|---|
| Our website | Your light or dark theme, and whether you were looking at the Xero or Zoho Books version of the pages |
| The legal pages | Your light or dark theme |
| The app | Your light or dark theme; which sign-in button you used (Xero or Zoho Books); the tab and client you were last on, so a reload brings you back; and that you've seen the welcome tour |
| The app, for Pyro's administrators only | Ticks on the firm-setup checklist, by firm name |
| The app, until you close the tab | The tab to return to after connecting Xero or Zoho Books, and the reason, if you were signed out because your firm was removed |
Clearing your browser's site data removes all of it.
No third-party requests, either. Our fonts are served from our own domain rather than from Google Fonts, so simply loading a Pyro page does not reveal your IP address to Google or anyone else. Everything the page needs comes from us. The one exception is uploading: the app sends each file you upload straight to our file storage at Supabase (section 6).
8. Where your information goes
Your account data and your uploaded documents are stored in the European Union (Paris, France), and our application runs in the same region. AI reading of your documents is processed inside the EU too (section 4), so it does not take them out of the EU.
Your information can leave the EU in these situations:
- Hosting — Vercel runs our application in Paris, but Vercel is a US
company.
- Payments — Stripe.
- Email — Resend, for the few emails described in section 3.6.
- Backups — GitHub, which holds only encrypted backups (section 6).
These transfers are covered by the Standard Contractual Clauses approved by the European Commission, in each provider's data processing terms. We can provide evidence on request. If AI reading ever had to move to the Gemini API (section 4), that would be a transfer too, and we would tell firm owners first.
9. How long we keep things
Your firm decides how long uploaded files are kept. A new firm starts with 90 days: after that, we automatically delete the original files you uploaded. A job runs daily to do it. The extracted figures and coding stay, because that's your accounting data, and the same file is already attached to the draft in your accounting software.
We don't set a period for you beyond that starting point. A firm owner can change it in Billing & wallet to any number of days from 30 upwards, or clear it to keep files until you delete them. You know your own record-keeping obligations and we don't, and quietly deleting a firm's invoices on an assumption would be far worse than keeping them. The shortest period we accept is 30 days. Firms that joined before the 90-day starting point keep whatever they had chosen.
| What | How long |
|---|---|
| Original uploaded files | Your firm's retention period — 90 days unless your firm changes it (minimum 30), or until you delete them if your firm clears it |
| Extracted figures and coding | Until you delete the client, or your firm's account is closed |
| Copies of posted invoices kept to check our accuracy | Until you ask us to delete them, you delete the client, or your firm's account is closed |
| Audit log (who did what) | 13 months, then deleted automatically |
| Security log, including sign-in IP addresses | 13 months, then deleted automatically |
| Cost records for each AI call (section 3.4) | 400 days, then deleted automatically |
| Encrypted database backups | 14 days |
| A closed firm's data | Deleted 30 days after its subscription ends (the logs and cost records above age out on their own schedule) |
| Billing records (held with Stripe) | As long as Maltese tax law requires |
| Survey responses | Until you ask us to delete them |
You can also delete a client from inside the app at any time. That deletion is real, not a flag: it removes everything we hold for that client — its documents, files, extracted data, learned coding, history and contacts — except the audit log entries recording what was done, which age out with the rest of the audit log after 13 months; your firm's billing record of what each invoice cost, which stays with your firm's account; and the cost records of AI calls, which hold only ID numbers and figures and are deleted after 400 days.
10. Who at Pyro can see your information
Pyro is run by one person, who is also Pyro's administrator.
- The admin overview. Pyro's administrators can see account-level details
across firms — firm names, members' email addresses and roles, client names and whether they're connected, and usage, AI cost and billing figures — to run and support the service. Every change an administrator makes is written to the security log, naming the administrator.
- Support access to your firm's documents only with your permission. Pyro
support can open your firm's documents and data only while your firm owner has allowed it. The owner switches it on for 24 hours at a time and can revoke it at any moment, which stops it at once. The owner is emailed when a support session starts, and every session and everything opened in it appears in your firm's own support access log.
11. How we protect your information
- Everything is encrypted in transit (TLS) and at rest (AES-256).
- Xero and Zoho Books connection tokens get a second layer of encryption
(AES-256-GCM) before they're stored, so they aren't readable from the database alone.
- Sign-in is handled by Xero or Zoho. We store no passwords, and nobody —
including Pyro's administrators — signs in with one.
- Your session is kept in secure cookies that scripts on the page cannot read.
- Our database rejects all access except from the application's own privileged
credential, which lives only in our hosting platform's environment settings — never in our source code.
- Separation between firms, and between users and their assigned clients, is
enforced on every single request.
- Security-relevant events are written to a log the application only ever adds
to; entries are removed only by the automatic 13-month clean-up.
What we don't claim. We are a small operation and we'd rather say so than imply otherwise. Pyro does not hold ISO 27001 certification, has not completed a SOC 2 audit, and has not had an independent penetration test. No system is perfectly secure, and we won't pretend ours is.
If something goes wrong. If a breach affects your firm's data, we tell your firm within 48 hours of becoming aware of it.
12. Your rights
Under the GDPR you can ask us to:
- See the personal data we hold about you
- Correct anything wrong
- Delete it ("right to be forgotten")
- Restrict how we use it
- Give you a copy in a portable format
- Object to processing based on our legitimate interests
- Withdraw consent, where we relied on consent
Email support@pyroplatform.com. We'll respond within one month. There's no charge unless a request is clearly excessive or repetitive, and we'd tell you before charging anything.
If your details appeared on someone's invoice: we hold that information for an accounting firm, not for ourselves. Please contact that firm. If you're not sure who they are, write to us and we'll pass your request to them.
13. Complaints
If we've got something wrong, tell us first — we'd like the chance to fix it.
You also have the right to complain to the Maltese data protection authority:
Office of the Information and Data Protection Commissioner (IDPC) Floor 2, Airways House, High Street, Sliema SLM 1549, Malta https://idpc.org.mt
If you live in another EU country, you can complain to your local authority instead.
14. Children
Pyro is a business tool for accounting professionals. It is not intended for anyone under 18, and we don't knowingly collect children's data. If you think a child has given us information, tell us and we'll delete it.
15. Automated decision-making
Pyro uses AI to suggest how an invoice should be coded. It does not make decisions about people. Every suggestion is reviewed by a person on your team before anything is posted. There is no automated decision-making that produces legal effects for any individual.
16. Changes to this policy
If we change this policy we'll update the version number and the date at the top. For significant changes affecting your rights, we'll email firm owners. Previous versions are kept and available on request.
17. Contact
Trevor St. John, trading as Pyro Malta · postal address available on request support@pyroplatform.com
Privacy Policy v1.6 — last updated 16 October 2026.