Privacy notice

Last updated 6 November 2026.

This notice explains what personal data WFL collects when you use the Pivot website (www.pivotapp.uk), the Pivot help centre (help.pivotapp.uk) and the Pivot app (app.pivotapp.uk), why we collect it, and what your rights are.

Who we are

Pivot is run by Windfall Logistics Limited (WFL), a company registered in England and Wales with company number 06173302. Our registered office is Windfall House D1, The Courtyard, Alban Park, St. Albans, Hertfordshire, AL4 0LA. We are the data controller for the personal data described in this notice.

Questions about this notice or your data: finance@wfl.co.uk.

The website and help centre

The website and the help centre are static pages. They have no sign-up, no forms and no analytics. The font is served from the site itself, so your browser does not contact any other company to show a page.

Both sites are hosted on Microsoft Azure Static Web Apps. We don't keep access logs for them. Like any web host, Microsoft receives your IP address and the pages you request so that it can serve them and protect the service.

Searching the help centre runs in your browser. What you type is not sent to us.

If you email us, we keep your email address and your message so that we can reply, and to keep a record of the conversation. Our lawful basis is our legitimate interest in answering you. Emails are held in our Microsoft 365 mailbox, and we keep them for up to six years as part of our business records.

The Pivot app

Pivot is a business tool. Your organisation (a brand, or a company that works with a brand) agrees with WFL to use it, and WFL gives named people at that organisation access. This section covers the personal data involved in that.

Signing in

Sign-in is handled by Auth0 (a product of Okta, Inc.) at auth.pivotapp.uk. When you sign up, Auth0 holds your email address, your name, your password (we never see it) and whether your email address has been verified. Our Auth0 tenant is hosted in Auth0's United Kingdom region.

You sign in with your email address and a password; there is no sign-in with a Google or Microsoft account. If you forget your password, Auth0 emails you a link to set a new one.

Auth0 keeps a log of sign-ins, failed sign-in attempts and changes to your account, with your IP address and browser, for up to 30 days. We use it to protect accounts from misuse and to help if you have trouble signing in.

Your account

When you first sign in, Pivot creates an account record. It holds:

• your email address, your name and your Auth0 user ID;
• whether your email address is verified;
• the organisation and brands you can see, your roles, and whether you are a client or a member of WFL staff;
• whether your account has been approved, when, and by whom at WFL;
• any free trial dates;
• whether the account is locked;
• when the account was created, when you last signed in, and when you last used the app;
• your preferences, such as chart settings and saved views.

A new account can see nothing until WFL approves it. When you sign up, our team is told by email (to a WFL mailbox on Microsoft 365) and by Telegram that a new account is waiting, including your name and email address.

We use this data to run your access to Pivot, to keep it secure and to support you. Our lawful basis is our legitimate interest in providing Pivot to your organisation under its agreement with us. Where you are the customer yourself, the basis is performing our contract with you.

Invitations and trial requests

If someone at WFL invites you to Pivot, we store your name and email address, who sent the invitation and when, and whether you have signed up. The invitation email comes from WFL.

If you ask for a free trial inside the app, we record your name, email address and any message you add, and our team is told by email and Telegram. Nothing is granted automatically.

Emails we send

We send a welcome email when your account is approved, and an invitation email if we invite you. These are sent from a WFL mailbox on Microsoft 365. We do not send marketing email.

How you use Pivot

We record when you last signed in and when you last used the app (updated about every five minutes while you use it), and a count of your requests per day. The daily counts are deleted after 30 days. We use this to see which accounts are active and to support you.

The app also uses Google Analytics 4. It sends Google the pages you visit, your internal Pivot user ID (not your email address), whether you are a client or staff, and the name of the brand you are viewing. Google sets its own cookies for this (see our cookies page). We use it only to see how Pivot is used so that we can improve it, never for advertising. Our lawful basis is our legitimate interest in improving Pivot. Google may process this data in the United States, under the UK Extension to the EU–US Data Privacy Framework.

You can opt out of Google Analytics withGoogle's opt-out browser add-on, or by blocking cookies for pivotapp.uk in your browser. The app works the same either way.

The AI Agent

The AI Agent answers questions about your data in plain English. Each question you ask is sent to a Microsoft Azure AI service, set up for us in Azure's UK South region, to be answered. To answer quickly, Microsoft may process a question in another Azure region; it does not use your questions to train its models. We keep each question with your name, user ID and brand, and the answer, so that we can check answers and track costs.

API keys

Some users can create API keys to read their data from their own tools. We store the key's name, when it was created and expires, when it was last used, and a count of requests per day. We never store the key itself, only a hash of it.

Your organisation's sales data is business data

The sales, stock and forecast figures in Pivot come from retailer supplier portals. They describe products, stores and weeks, not people. The same applies to sales files your organisation uploads. This is business data belonging to your organisation, and it is not personal data about you. It is held under the agreement between your organisation and WFL, not this notice.

Where your data is stored and who we share it with

The app's database and its server run on Microsoft Azure in the UK South region. The background services that collect retailer reports and send our emails run on servers in the UK.

We use these companies to run Pivot. Each one only processes data on our instructions:

• Our technology partner: the company that builds and runs Pivot for us under contract. It manages the systems listed here, operates the UK servers that run the background services, and can see account data when it needs to support you or fix a problem.
• Microsoft Azure: hosting, the database, file storage, messaging between our services and the AI service behind the AI Agent.
• Auth0 (Okta): sign-in and account passwords, in its UK region.
• Google: Google Analytics in the app.
• Microsoft 365: the WFL mailbox that sends welcome and invitation emails, and receives our internal alerts when a new account signs up or asks for a trial.
• Telegram: a messaging app that carries the same internal alerts (your name and email address) to our team. Telegram may store messages outside the UK.

When the app loads, your browser also fetches its font from fonts.cdnfonts.com and connects to primefaces.org, the maker of our user-interface components. Those sites see your IP address, as any website you visit does, but receive nothing else from us.

We do not sell personal data, and we do not share it with anyone else unless the law requires it.

How long we keep it

• Daily usage counts: 30 days.
• Your account record, invitations, trial requests and AI Agent questions: while you have access to Pivot. When your access ends, we keep them for up to 12 months in case your organisation restores it, then delete them, including your Auth0 account. You can ask us to delete them sooner.
• Google Analytics: up to 14 months.
• Auth0 sign-in logs: up to 30 days.
• Emails to us: up to six years.
• Server logs: the app's server writes technical logs of requests and errors to Microsoft Azure, which keeps them for 30 days.

Your rights

Under UK data protection law you can ask us:

• for a copy of the personal data we hold about you;
• to correct it;
• to delete it;
• to limit how we use it;
• to give it to you in a form you can take elsewhere;
• to stop using it where we rely on our legitimate interests.

To do any of these, email finance@wfl.co.uk. We will reply within one month. If you are not happy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Changes to this notice

We will update this page when what we do with personal data changes. The date at the top shows the last change.