Data & Privacy Policy

Account and identity data

Name and email address. A hashed password if you register with email/password. If you sign in via Google, X (Twitter), Twitch, Discord, Facebook, or Twitch OAuth, we receive your provider-assigned user ID and, where provided, your avatar URL. We store these identifiers to link your account to the OAuth provider and to avoid creating duplicate accounts.

If you enable two-factor authentication (2FA), we store an encrypted TOTP secret key and an encrypted list of hashed single-use recovery codes. We also record a timestamp of when 2FA was confirmed and activated. 2FA is entirely optional and these fields are only populated when you choose to set it up. The TOTP secret is encrypted at rest using Laravel's application-level encryption (AES-256-CBC) before being written to the database, and recovery codes are stored as bcrypt hashes — neither is stored or accessible in plain text.

Session and technical data

IP address at registration (signup_ip), IP address and user agent stored in session records, and basic device and browser information. Log data about how you access and use the Services, including timestamps and interaction events. Session data is stored server-side in our database and expires after approximately 120 minutes of inactivity.

Profile and analysis data

Creator and brand profiles you create, including profile labels, platform handles (Instagram, TikTok, YouTube, X, LinkedIn, Twitch, website, etc.), market, niche, follower counts, engagement rates, internal notes, and uploaded or auto-fetched avatars. Analysis inputs you submit (gene-specific fields and optional analyst notes). Structured analysis reports generated by Pinkk — stored as JSON files on our server, not in the database. Profile comparison and workspace intelligence reports.

AI and system usage data

Every AI API call generates an internal usage record tracking the provider, model, token counts, cost, duration, and a masked API key label. These records are used to operate, monitor, and audit our AI infrastructure. They are stored in a separate logs database and pruned on a configurable schedule (default: 90 days).

Payment and billing data

Subscription and payment records received via webhooks from Polar, our payment processor. This includes your Polar customer ID, subscription ID, plan type, billing period dates, transaction amounts, and currency. We store the full webhook payload for audit and debugging purposes. We do not store payment card numbers — those are handled exclusively by Polar and its payment partners.

Credit and transaction data

A ledger of every credit operation — grants (signup bonus, subscription, purchase, admin adjustment, bonus code redemption), deductions (analysis runs), and refunds. Each transaction records the amount, reason, and entitlement source.

Notification and communication preferences

Your email notification preference and unsubscribe token. Your push notification preference and browser push subscription data (endpoint URL, VAPID public key, auth secret, and user agent) for each device you subscribe from. In-app notification history.

Referral data

If you use or share a referral code, we record the referral relationship between accounts, whether a referral bonus was granted, and any automated signals used to detect suspicious referral activity.

Support and contact data

Name, email, company name, and message content from contact form submissions. Your account ID if you were logged in when you submitted the form.

Verification log data

When anyone uses the public report verification feature at /verify, we log the report reference number, the verifier's IP address, and the timestamp. This data is used to detect abuse and is pruned after 30 days.

Publicly available data about third parties

When you submit social media handles or other public identifiers for analysis, Pinkk retrieves and processes publicly available data about those profiles via our AI intelligence services (You.com, Tavily, Twitch Helix API, YouTube Data API, Brandfetch, Logo.dev). This data relates to third parties, not to you directly. You are responsible for ensuring you have a lawful basis to submit such data where required by applicable law.

Providing and maintaining the Services

Creating and managing your account, authenticating you, maintaining secure sessions, generating and storing your analysis reports, and serving your historical data.

Processing payments and managing subscriptions

Handling subscription activations, renewals, cancellations, credit pack purchases, and credit balance management via Polar.

Running AI analysis and generating reports

Processing your analysis inputs through our AI agent system and intelligence services to generate structured intelligence reports. Logging AI usage for cost tracking, auditing, and system reliability.

Communicating with you

Sending transactional emails — welcome messages, purchase confirmations, analysis-complete notifications, and password resets — via Resend. Sending in-app and browser push notifications about your account activity. Responding to support requests.

Security, fraud prevention, and abuse detection

Detecting and investigating suspicious activity, including referral fraud, bot activity, and unauthorized access. Enforcing our Terms of Service. Maintaining admin audit logs of all administrative actions.

Operating and improving the platform

Monitoring system health and reliability via BetterStack and Sentry. Aggregating and anonymizing usage data to understand how the product is used and where it can be improved. Running analytics (with your consent) via Google Analytics 4 and Microsoft Clarity.

Legal compliance

Retaining records as required by applicable law, including financial and tax records. Responding to lawful requests from authorities.

Performance of a contract

Processing necessary to provide the Services you sign up for — account creation, authentication, running analyses, managing subscriptions and credits, and sending transactional notifications.

Legitimate interests

Processing necessary for our legitimate business interests, balanced against your rights and interests. This includes: securing our systems and detecting abuse; maintaining AI usage and admin audit logs for operational integrity; fraud and referral abuse detection; improving the platform through aggregated analytics; and retaining payment records for accounting purposes.

A Legitimate Interest Assessment (LIA) has been completed in line with ICO and EDPB guidance in respect of all processing activities conducted under this basis. The LIA is reviewed annually. Parties whose data is processed under legitimate interests may contact [email protected] for further information or to exercise their right to object.

Consent

Optional analytics and session-replay tools (Google Analytics 4, Microsoft Clarity, Sentry session replay) that only load after you accept via the consent banner. You may withdraw consent at any time.

Legal obligation

Processing required to comply with applicable laws, including financial record-keeping and responding to lawful authority requests.

Processing of third-party public profile data (intelligence reports)

Activity: When customers submit social media handles or public profile identifiers for analysis, Pinkk retrieves and processes publicly available data associated with those profiles — including follower counts, engagement metrics, posting frequency, and content categorisation data — to generate intelligence reports for the submitting customer.

Legal Basis: Legitimate interests pursuant to Article 6(1)(f) of the GDPR and equivalent provisions under applicable national law, including POPIA (South Africa).

Legitimate Interests Pursued: Pinkk and its customers have a legitimate interest in receiving accurate, data-driven analytics to support commercial, marketing, and strategic decision-making. This interest has been assessed through a Legitimate Interest Assessment (LIA), which concluded that the nature of the data (publicly available metrics), the limited risk of harm to data subjects, and the professional context of processing do not override data subjects' privacy interests.

Data Subject Rights: Data subjects whose public profile data is processed in this way have the right to object to such processing under Article 21 GDPR. Objections may be submitted to [email protected]. We will respond within one calendar month.

Strictly necessary cookies

A database-backed session cookie keeps you authenticated while you use Pinkk (expires after approximately 120 minutes of inactivity). An optional "remember me" cookie, set when you choose that option at login, keeps you signed in for 90 days. These are strictly necessary to provide the core service and cannot be disabled without breaking authentication.

Local storage (functional)

Your analytics consent preference is stored in localStorage so we can remember whether to load analytics scripts on future visits. This is not a cookie and does not track you across other websites.

Analytics and monitoring tools (consent-based)

The following categories of tool only load after you give consent via the banner. If you decline, none of these tools will load or set cookies.

• Page analytics — tracks page views and general usage patterns. Configured with IP anonymisation enabled.
• Session replay and heatmaps — records anonymised interaction sessions to help us understand usability. Configured to mask sensitive input fields and content.
• Error and performance monitoring — captures application errors and performance traces. Session replay is configured to mask all text and media.

Bot protection

Our contact form uses a third-party bot protection service. It may set cookies or use browser signals to distinguish humans from bots. No personal account data is shared with this service.

Service providers (operators/processors)

We share information with a limited set of trusted service providers, only as necessary to operate Pinkk. Each provider is contractually bound to protect your information and may not use it for their own purposes beyond providing their services to us. See section 8 for the full list.

Public report verification

When you or anyone else uses the public report verification feature at /verify, a limited summary of the report (capped at 400 characters) and up to six quality/risk signals are visible to the verifier. No account data is exposed. You control whether a report is publicly verifiable by its reference number.

Private share links

Subscribers can generate token-gated share links for individual reports. Anyone with the link can view the report without logging in. The token is the credential — treat it like a password. You can revoke share links at any time from your account.

Business transfers

If Pinkk is involved in a merger, acquisition, financing, or sale of all or part of our business, personal information may be transferred as part of that transaction. We will notify you via email or in-app notice before your information becomes subject to a materially different privacy policy.

Legal requirements and safety

We may disclose information if required to do so by law, regulation, or enforceable governmental request, or where we reasonably believe disclosure is necessary to: enforce our Terms of Service; protect the rights, property, or safety of Pinkk, our users, or the public; or prevent or investigate fraud, security incidents, or illegal activity.

Responsible party

Pinkk acts as the responsible party for personal information processed in connection with the Services. Contact details are in section 23.

Lawful grounds for processing

We process personal information on the following grounds under POPIA: (a) the data subject's consent; (b) necessity for the performance of a contract; (c) compliance with a legal obligation; (d) the legitimate interests of Pinkk or a third party, where those interests are not overridden by your rights.

Your rights under POPIA

As a data subject under POPIA, you have the right to: be notified that your personal information is being collected; access your personal information; request correction or deletion of your personal information; object to the processing of your personal information; and submit a complaint to the Information Regulator.

Information Regulator

If you believe we have processed your personal information in violation of POPIA, you may lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.

Cross-border transfers

Where we transfer personal information outside South Africa, we do so only to countries or recipients that provide an adequate level of protection, or under appropriate safeguards as required by section 72 of POPIA.

Data controller

Pinkk acts as the data controller for personal data processed in connection with the Services. Contact details are in section 23.

Legal bases

See section 4 for the legal bases we rely on. Where we rely on legitimate interests, you have the right to object to that processing.

Your rights under GDPR / UK GDPR

You have the rights described in section 11, including the right to access, rectification, erasure, restriction, portability, and objection. You also have the right not to be subject to solely automated decision-making that produces legal or similarly significant effects, and to request human review of such decisions.

Supervisory authority

EEA residents may lodge a complaint with their national data protection authority. UK residents may contact the Information Commissioner's Office (ICO) at ico.org.uk.

International transfers

Transfers of personal data outside the EEA or UK are made under the EU Standard Contractual Clauses or the UK International Data Transfer Agreement, as applicable. See section 10 for more detail.

We do not sell or share your personal information

Pinkk does not sell your personal information for monetary consideration. We do not share your personal information with third parties for cross-context behavioural advertising or targeted advertising purposes. We do not use your personal information to build advertising profiles. If this ever changes, we will update this Policy before it takes effect and provide a clear opt-out mechanism.

Your rights under CCPA/CPRA (California residents)

Under the California Consumer Privacy Act (as amended by the CPRA), California residents may have the right to:

• Know — request disclosure of the categories and specific pieces of personal information we collect, use, disclose, and sell or share.
• Delete — request deletion of personal information we hold about you, subject to certain exceptions.
• Correct — request correction of inaccurate personal information.
• Opt out of sale or sharing — as noted above, Pinkk does not sell or share personal information for advertising purposes. No opt-out mechanism is currently required, but you may contact us to confirm this in writing.
• Limit use of sensitive personal information — we do not collect sensitive personal information as defined under the CPRA beyond what is strictly necessary to operate the Services.
• Non-discrimination — we will not discriminate against you for exercising any of these rights.

Automated decision-making technology (ADMT) — California

Pinkk's AI-powered report generation constitutes Automated Decision-Making Technology (ADMT) within the meaning of California's privacy regulations effective January 2026. We have documented our ADMT practices as follows:

• Nature of outputs — all analysis outputs are informational and advisory only. They do not constitute binding decisions about any individual's access to services, credit, employment, housing, insurance, or legal rights.
• Confidence ratings and cautious framing — outputs include confidence scores and use evidence-based language ("may indicate", "suggests", "could be") to make their probabilistic nature explicit at the point of delivery.
• No automated consequential actions — Pinkk does not use ADMT to take automated actions that produce legal or similarly significant effects on individuals without human review.
• Human review — if you believe a Pinkk analysis output has been used as the basis for a significant decision that affects you, you may request human review of that output, express your point of view, or contest the outcome. Submit requests to [email protected] with the subject line "ADMT Review Request".
• Customer responsibility — Pinkk's customers remain solely responsible for any downstream decisions they make based on our reports. We do not control how customers use outputs after delivery.

We have conducted an internal risk assessment for our ADMT processing activities and will update this documentation as California's ADMT regulations and guidance develop.

Other US state residents

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and other states with applicable consumer privacy laws have similar rights to access, correct, delete, and port personal information, and to opt out of certain processing activities. We extend the same rights available under GDPR and POPIA to residents of those states — including the right to access, correct, delete, and port your personal information — on a reasonable-efforts basis, regardless of whether we currently meet the mandatory applicability thresholds under those state laws. Submit requests to [email protected] with the subject line "US Privacy Rights Request".

Shine the Light (California)

California Civil Code § 1798.83 permits California residents to request information about personal information disclosed to third parties for their direct marketing purposes. Pinkk does not disclose personal information to third parties for their direct marketing purposes.

Global Privacy Control (GPC)

Several US state privacy laws require businesses to honour the Global Privacy Control (GPC) browser signal as an opt-out of sale or sharing. Because Pinkk does not sell or share personal information for advertising, GPC signals do not currently trigger any additional processing change. We monitor developments in GPC requirements and will implement technical support if and when our processing activities make this necessary.

Australia — Privacy Act 1988 and Australian Privacy Principles

Australia's Privacy Act 1988 and the Australian Privacy Principles (APPs) govern how organisations handle personal information about Australian residents. The Act currently applies to businesses with annual turnover exceeding AU$3 million, and to organisations that trade in personal information — Pinkk does not meet either threshold at this time. Nonetheless, we voluntarily apply the following practices consistent with the APPs to all Australian users:

• Collection and notification — we collect only the personal information reasonably necessary to provide the Services and notify you of the purposes at the time of collection (this Policy).
• Use and disclosure — we use personal information only for the primary purpose for which it was collected, or secondary purposes you would reasonably expect, or as otherwise disclosed in this Policy.
• Data quality and security — we take reasonable steps to ensure personal information is accurate, up to date, and protected from misuse, interference, loss, and unauthorised access. See section 12 for security measures.
• Access and correction — you may request access to or correction of your personal information using the contact details in section 23. We will respond within 30 days.
• Cross-border disclosure — some of our service providers are located outside Australia, primarily in the EU and US. We take reasonable steps to ensure overseas recipients handle your information in a manner consistent with the APPs.
• Notifiable data breaches — although we are currently below the mandatory threshold, we commit to notifying affected Australian users of any data breach that is likely to result in serious harm, consistent with the Notifiable Data Breaches (NDB) scheme.

If you have a complaint about how we handle your personal information, contact us at [email protected]. If you are not satisfied with our response, you may escalate to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Canada — PIPEDA and Quebec Law 25

Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) governs how private-sector organisations collect, use, and disclose personal information in the course of commercial activity. Quebec's Law 25 (Act 25), in effect since September 2023, imposes additional GDPR-like obligations on organisations that handle personal information of Quebec residents, including data minimisation, privacy impact assessments for high-risk processing, and a 72-hour breach notification requirement to Quebec's Commission d'accès à l'information (CAI).

Our practices under PIPEDA and Quebec Law 25:

• Consent — we rely on your informed consent (provided at account creation) for collection and use of your personal information, or on other lawful grounds where consent is not required (such as contractual necessity or legal obligation).
• Limiting collection and use — we collect only what is necessary for the identified purposes described in this Policy and do not use it for other purposes without further consent.
• Individual access — you have the right to access personal information we hold about you, to challenge its accuracy, and to request correction. Requests can be submitted to [email protected].
• Cross-border transfers — personal information may be transferred to and processed in countries outside Canada, including South Africa (our primary operating jurisdiction) and the EU. We ensure contractual protections are in place with all overseas service providers.
• Breach notification — in the event of a breach of security safeguards involving personal information that creates a real risk of significant harm to a Canadian resident, we will notify the affected individual and the Office of the Privacy Commissioner of Canada (OPC), and — for Quebec residents — the CAI, within the required timeframes.
• De-identification (Quebec) — where we use personal information for analytics or service improvement purposes, we take steps to de-identify or anonymise that information before use where reasonably practicable.

To exercise your rights or make a complaint, contact us at [email protected]. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca, or — for Quebec residents — the Commission d'accès à l'information at cai.quebec.ca.

Data controller

Pinkk acts as the data controller (responsable del archivo, registro, base o banco de datos) for personal data processed in connection with the Services. Contact details are in section 23.

Your rights under LPDP

Argentine residents have the following rights in relation to their personal data:

• Access (derecho de acceso) — you may request, free of charge, a full copy of the personal data we hold about you at any time, or at least every six months.
• Rectification (derecho de rectificación) — you may request correction of inaccurate, incomplete, or outdated personal data. We will respond within five business days of receiving your request.
• Deletion (derecho de supresión) — you may request deletion of personal data that is no longer necessary, was processed unlawfully, or where you withdraw consent, subject to legal retention obligations.
• Confidentiality (derecho de confidencialidad) — you have the right to request that your personal data not be disclosed to third parties for direct marketing or commercial purposes without your consent.

To exercise these rights, contact us at [email protected]. We aim to respond within the timeframes required by applicable law.

Cross-border transfers

Personal data may be transferred to and processed in countries outside Argentina. Our primary infrastructure is hosted in the EU (AWS eu-west-2, London), which provides an adequate level of protection. For transfers to other destinations, we implement appropriate contractual safeguards consistent with LPDP requirements.

Supervisory authority

If you are not satisfied with our response to a request or complaint, you may contact the Agencia de Acceso a la Información Pública (AAIP) at argentina.gob.ar/aaip.

Data controller

Pinkk acts as the controlador (data controller) for personal data processed in connection with the Services. Contact details are in section 23.

Legal bases for processing (LGPD)

The LGPD requires that all processing of personal data have a lawful basis. We rely on the following bases under Article 7 of the LGPD:

• Consent (consentimento) — for optional analytics and session-replay tools, as described in section 5.
• Performance of a contract (execução de contrato) — for account creation, authentication, running analyses, managing subscriptions and credits, and sending transactional notifications.
• Legitimate interests (legítimo interesse) — for fraud prevention, security, AI usage logging, and operational auditing, balanced against your rights and interests.
• Legal obligation (obrigação legal ou regulatória) — for financial record-keeping and responding to lawful authority requests.

Your rights under LGPD

In addition to the rights in section 11, Brazilian residents have the following rights under Articles 17–22 of the LGPD:

• Confirmation of processing — the right to know whether we hold and process your personal data.
• Access — the right to access the personal data we hold about you.
• Correction — the right to request correction of incomplete, inaccurate, or outdated personal data.
• Anonymisation, blocking, or deletion — the right to request anonymisation, blocking, or deletion of unnecessary or excessive personal data, or data processed in non-compliance with the LGPD.
• Portability — the right to request portability of your personal data to another service provider, subject to regulatory guidance.
• Information about sharing — the right to be informed about public and private entities with whom we share your personal data.
• Withdrawal of consent — the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.
• Review of automated decisions — the right to request review of decisions made solely on the basis of automated processing that affect your interests.

To exercise these rights, contact us at [email protected]. We aim to respond within 15 days, consistent with LGPD timeframes.

International transfers

Personal data of Brazilian residents may be transferred to and processed in countries outside Brazil, including South Africa (our primary operating jurisdiction) and the EU (our primary hosting region). For transfers to countries that do not provide an adequate level of protection equivalent to the LGPD, we rely on standard contractual clauses or other safeguards permitted under Article 33 of the LGPD.

Supervisory authority

If you are not satisfied with our response to a request or complaint, you may contact the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.

Our global baseline

Regardless of where you are located, all users of the Services benefit from the same baseline data protection practices described throughout this Policy — including the rights in section 11, the security measures in section 12, the retention schedules in section 9, and our commitment not to sell or share personal information for advertising. This baseline is informed by the GDPR, which represents one of the most comprehensive privacy frameworks in the world. If your local law gives you rights that go beyond this baseline, contact us and we will respond in good faith.

Jurisdictions we monitor

Several other countries have enacted or are developing privacy laws that may affect how we operate as we grow. We monitor the following frameworks and will add dedicated sections to this Policy as our user base and obligations evolve:

• India — Digital Personal Data Protection Act (DPDP, 2023/2025): applies to online processing of personal data of Indian residents. Introduces data fiduciary obligations, consent requirements, and breach notification duties.
• Japan — Act on the Protection of Personal Information (APPI, amended 2022): applies to businesses that systematically handle personal information of Japanese residents, including cross-border transfer rules.
• Switzerland — revised Federal Act on Data Protection (nFADP, 2023): broadly equivalent to the GDPR, applying to processing of Swiss residents' data by organisations that target Switzerland.
• New Zealand — Privacy Act 2020: applies to any organisation that collects or holds personal information about New Zealand individuals and carries on business in New Zealand.

Threshold and applicability

Most of the laws listed above apply only when a business actively targets residents of that country, processes their data at scale, or exceeds a revenue or volume threshold. As a South African B2B SaaS platform at early stage, we do not currently meet the applicability thresholds for most of these laws. However, we apply our global baseline voluntarily to all users regardless of origin, and we will update this Policy — and implement any required additional measures — as our user base grows or as applicable legal guidance develops.

What to do if your jurisdiction is not listed

If you are located in a country not specifically addressed in this Policy and you have a question, request, or complaint relating to your personal information, please contact us at [email protected]. We will:

• acknowledge your request promptly;
• consider the rights available to you under your local law to the best of our knowledge;
• apply our global baseline protections regardless of whether your local law technically applies to us; and
• direct you to your local data protection authority if we cannot satisfy your request ourselves.

Who we are and what we do

Pinkk is a B2B social media intelligence platform. Our customers — typically marketing agencies, brand teams, and researchers — submit public social media profile identifiers (such as usernames or handles) for analysis. We retrieve publicly available data associated with those profiles and generate structured intelligence reports for the submitting customer. We act as an independent data controller for this processing activity.

Legal basis

We process publicly available profile data on the basis of legitimate interests pursuant to Article 6(1)(f) GDPR and equivalent provisions under applicable national law, including POPIA. A Legitimate Interest Assessment (LIA) has been completed and is available on request. The LIA concluded that the processing of publicly available metrics does not materially override data subjects' privacy interests given the nature of the data, the professional B2B context, and the safeguards in place.

Categories of data processed

We process only publicly available profile metrics, which may include: follower counts, engagement rates, posting frequency, and content categories. We do not process special category data (such as health, political opinions, or biometric data), and we do not make credit, employment, or legally significant decisions about individuals.

Sources

Data is retrieved from publicly available sources, including public profiles on platforms such as Instagram, YouTube, TikTok, and Twitch, and via third-party data intelligence services. We do not access private account data, private messages, or data that requires platform authentication.

Your rights

As a data subject, you have the following rights in relation to data processed about you:

• Right to Object (Article 21 GDPR) — you may object to the processing of your data on legitimate interest grounds. We will review your objection and respond within 30 days.
• Right of Access (Article 15 GDPR) — you may request confirmation of whether we hold data about you and, if so, a copy of that data.
• Right to Erasure (Article 17 GDPR) — you may request deletion of personal data we hold about you, subject to applicable legal grounds.

How to exercise your rights

Submit your request to [email protected] or use the data removal form on our website. We will acknowledge and respond within 30 days of receipt.

Right to lodge a complaint

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority. If you are unsure which authority applies to your location, contact us at [email protected] and we will help identify the appropriate body.