Privacy Policy

1. Introduction

Pinnlo ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you:

• Access or use the Pinnlo platform (our SaaS product), or
• Visit our website or any related sub-domains (e.g. app.pinnlo.com).

This policy complies with the UK General Data Protection Regulation (UK GDPR), EU GDPR, and California Consumer Privacy Act (CCPA).

2. Who We Are

Pinnlo is operated by RPS Studio Ltd, a company registered in England and Wales (Company No. 16700907). We act as:

• Data Controller for account registration and platform access; and
• Data Processor for any client-owned content handled under contract and governed by our Data Processing Agreement (DPA).

📧 Contact: info@pinnlo.com

3. Data We Collect

A. Information You Provide

• Name and email address when creating or being invited to a Pinnlo account.
• Support communications (e.g. emails or chat messages you send to us).

B. Information Generated by You

Workspace content (e.g. strategies, notes, uploaded text) created within Pinnlo. This content belongs to your organisation and is processed only under their direction. We do not use this data for training AI models or marketing.

C. Automatically Collected Technical Data

• Usage data: features used, session length, interaction patterns.
• Device and log data: IP address, browser type, error logs (for security and performance).

No payment or financial information is collected.

4. How We Use Your Data

We use personal data only to:

• Provide and secure access to the Pinnlo platform.
• Maintain platform stability and prevent fraud or abuse.
• Respond to support requests and communicate about your account.
• Comply with legal or regulatory obligations.

We never sell personal data and do not use it for advertising.

5. Lawful Bases for Processing

6. Data Sharing

We share data only with trusted sub-processors essential to delivering our services.

All sub-processors are bound by data-protection agreements equivalent to our DPA.

7. Data Retention

8. International Transfers

When data is transferred outside the UK or EEA, we use:

• Standard Contractual Clauses (SCCs) or the UK Addendum, and
• Encryption and access-control measures to protect it.

9. Data Security

We implement strong technical and organisational controls, including:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Supabase Row-Level Security (RLS) and JWT-based authentication
• Role-based access control and least-privilege principles
• Automated patching and threat monitoring

10. Your Rights

Depending on your location, you may have the right to:

• Access, rectify, or delete your data
• Restrict or object to processing
• Port your data to another provider
• Lodge a complaint with your local Data Protection Authority

Requests can be sent to info@pinnlo.com. We verify identity before responding and typically reply within 30 days.

11. Cookies

Pinnlo uses only essential cookies for authentication and session management. No tracking or marketing cookies are used. You may disable cookies through your browser settings.

12. Children's Data

Pinnlo is intended for professional use and not for individuals under 16. We do not knowingly collect data from children.

13. Changes to This Policy

We may update this policy to reflect changes in law or our services. Material updates will be notified via email or in-app announcement before taking effect.

14. Contact Information