This page explains what personal information we collect, why we need it, who can see it and how you can control it. We collect very little and never sell it. Your data is stored safely in Europe.
1. Introduction
Welcome to Pinitto. This policy explains what information we collect, how we use it and your rights over it.
The company responsible for your information is Mnemoly Community S.R.L., located at Spl. Peneș Curcanu, Nr. 4-5, Timișoara, Timiș County, Romania.
If you administer a community, also see our Data Processing Agreement.
2. What information do we collect
We only collect the information necessary to provide our service.
- When you create an account, we collect your email address
- When you use Pinitto, we collect the content you generate, such as the discussions you start, comments, announcements and details about items you list for borrowing. We also optionally collect your display name and phone number if you choose to provide them. We collect basic technical information, like your IP address, to keep the service secure and functional, and from your IP we can infer a generic location (city and country)
- When you become a paying customer, you complete the transaction through our reseller, Paddle.com. Paddle collects your billing and payment information directly. Pinitto does not receive or store your full credit card details
3. How and why we use your information
We use your information for a few key reasons, all related to running the service.
- To run the Pinitto platform, your email address is how you sign in, and the content you create populates your community space
- To communicate with you, we use your email to send service notifications, updates and the community digest
- To keep Pinitto secure and to bill your community, we record which parts of it you use and when. That record rate-limits features like contacting another member and counts the active members your community is billed for
- For billing and account administration, we manage your subscription
We use no analytics or tracking tools, and the activity record described above has no other purpose. Pinitto does not make automated decisions, profile users or perform any processing with legal or similarly significant effects on data subjects.
4. Who we share your information with
Inside your community, the other members can see the display name you chose and anything you post. If your community has enabled member identifiers, your identifier (for example a flat number) is shown next to your name.
If you ask to join a community, the email address you give is shown to that community's moderators while they decide, so they can judge whether you belong there. Once you are a member it is no longer shown to them.
We do not sell your data. We only share it with a few trusted third-party services (sub-processors) that help us run Pinitto.
- Amazon Web Services (AWS) hosts our infrastructure (Lambda for compute, RDS PostgreSQL for the database, S3 for file storage, SES for transactional email and KMS for encryption keys). All your data is stored in their data centres in Frankfurt, Germany
- Hetzner Online GmbH hosts our self-hosted geocoding (Photon) and routing (GraphHopper) infrastructure on servers in Germany. Address queries are processed here when you perform a location or route lookup
- Heinlein Hosting GmbH operates mailbox.org, which hosts our contact mailbox on servers in Germany. If you write to us by email, including to exercise your data protection rights, your message and your email address are processed there
- Paddle.com Market Ltd. is our Merchant of Record. They handle payments and the checkout process for subscriptions. When you upgrade, your payment and billing information is provided directly to Paddle, and the transaction is subject to their privacy policy
- Cloudflare provides the Turnstile service that protects our sign-in and contact pages from spam and bots. The legal basis for this processing is our legitimate interest in ensuring the security of our platform (Art. 6(1)(f) GDPR). To provide this service, Cloudflare processes technical data such as your IP address, user-agent header and browser information. This data is transferred to Cloudflare, Inc., a US-based company, and the transfer is secured by Cloudflare's certification under the EU-U.S. Data Privacy Framework. You can verify their certification on the Data Privacy Framework list. For more details, see Cloudflare's Privacy Policy and the Turnstile Privacy Policy
Sensitive fields are encrypted at the database level using per-community keys managed by AWS KMS. Even if our database were accessed without authorisation, content would remain unreadable without the community's specific encryption key.
5. How long we keep your information
We keep your personal information as long as your account is active. When you delete your account, we permanently delete your personal information from our active systems. Specific retention periods are as follows.
- A sign-up that is never confirmed is deleted within four days, together with the email address it holds
- Activity logs used for billing are retained for 24 months
- Invoices and financial records are retained for 10 years, as required by Romanian tax law
- Encrypted community content (posts, discussions, wiki entries, mobility activities and item listings) is deleted when the community deletes the resource or when the account is deleted
- Files uploaded to a community (wiki attachments and post images) are deleted when the file, the page or post holding it, or the community itself is deleted
6. Your rights over your information (GDPR)
As a user in the EU, you have the following rights under GDPR.
- The right to access a copy of your personal data
- The right to correct any incorrect information
- The right to erasure ("right to be forgotten")
- The right to restrict data processing
- The right to data portability, receiving your data in a structured, machine-readable format
- The right to object to processing based on our legitimate interests
- The right to withdraw consent at any time, where processing is based on consent
- The right to lodge a complaint with the Romanian supervisory authority, ANSPDCP (dataprotection.ro), or your local EU data protection authority
You can exercise most of these rights directly from your account settings. For any other requests, contact us via our contact page.
7. Children and minors
Pinitto is intended for adults coordinating community life. You must be 16 or older to use Pinitto, whether you register directly or join through an invitation. We do not knowingly process personal data of users under 16, and any account found to belong to one will be deleted. When a community organiser (for example a housing association or a school) invites members on behalf of their organisation, the organiser is responsible for verifying that each invited member meets our age requirement before sending the invitation.
8. How to contact us
If you have questions about this Privacy Policy, contact us via our contact page.