Privacy Policy & transparency
Processing activities, legal bases, retention periods, and sub-processors are documented in our Privacy Policy.
View Privacy Policy →GDPR compliance.Built in, not bolted on.
mypinio is designed for organizations that handle personal data responsibly. Full GDPR compliance, self-service data subject rights, automated deletion, and transparent sub-processor management — by design, not as an afterthought.
GDPR CompliantEU database hostingSelf-Service RightsFull Audit TrailAutomated Deletion
DATA SUBJECT RIGHTS
Your users' rights, built into the platform.
Right of access
Community members download a copy of their personal data in the Privacy Center of the community app. Everyone else sends a request with our contact form — we answer in writing.
Right to erasure
Community members delete their account in the Privacy Center of the community app — all account data is permanently removed. Everyone else requests deletion with our contact form. Deletion records are retained as legal proof.
Data portability
Your data in a machine-readable format: community members download it in the Privacy Center of the community app; everyone else requests it with our contact form.
Right to rectification
Users can update their profile data directly in account settings. No support ticket needed — immediate self-service correction of personal information.
Right to restriction
You can request a restriction of processing at any time — with our contact form or by e-mail to [email protected].
Right to object
You can object to processing based on legitimate interests at any time. Cookie consent can be withdrawn instantly via the "Cookie settings" link in the website footer.
IMPLEMENTATION
GDPR compliance at every layer.
Cookie consent management
Four-category consent system (necessary, analytics, marketing, preferences). Non-essential cookies disabled by default. No Google Analytics, no Meta Pixel, no third-party tracking. Consent revocable at any time.
PII protection
Personal data stored with access restriction and encrypted in transit (TLS). API keys stored as SHA-256 hashes only. Community passwords hashed with scrypt. Session cookies use httpOnly, Secure, and SameSite flags.
Workspace data isolation
Every database query is scoped to the workspace level. Cross-workspace data access is impossible by design. Prisma middleware enforces scoping as a safety net — unscoped queries throw errors in development.
Immutable audit logging
Every security-relevant action is logged: data exports, deletions, API key operations, role changes, member management. Audit logs contain only resource IDs and action types — never content or PII.
Data retention policies
Concrete retention periods: 30 days for sessions, 90 days for payment events. Automated cleanup via daily and weekly cron jobs.
Data minimization
IP addresses stored in full only for fraud, duplicate and quality checks on survey participation; website analytics use the country only. Error reports PII-scrubbed before transmission to Sentry. AI prompts minimized — no emails, names, or payment data sent to Anthropic. Survey respondents anonymous by default.
Transparent sub-processor management.
We work with 7 sub-processors, each with a Data Processing Agreement in place. All sub-processors, their data scope, and storage locations are documented in our Privacy Policy. An up-to-date sub-processor list is available on request.
FOR YOUR CUSTOMERS
Help your customers trust you.
Participants from partners
Participants who reach a survey through a partner link or a publisher's survey wall are identified by a session and device signals only. We receive no name and no e-mail address from the partner.
Community member privacy
Community members manage their data themselves in the Privacy Center of the community app: download a copy or delete the account permanently — the account data is removed; only a record of the deletion request is kept as proof.
Data Processing Agreement
We provide a DPA for business customers, covering our role as data processor under Art. 28 GDPR. Available on request at [email protected].
Questions about GDPR compliance?
We're happy to discuss our compliance approach, provide our DPA, or walk through specific requirements for your organization.
FAQ