Privacy policy

1. Who is responsible

The controller for this website and the Pinlight app is Kaumon Aung, Kurfürstendamm 154B, 10709 Berlin, Germany. Email: hello@pinlight.ai.

2. Hosting

The website and app run on Vercel (Vercel Inc., USA). When you open a page, Vercel processes your IP address and technical request data to deliver it and to protect the service. These logs are kept for a short time only. From your IP address Vercel also tells us your country, which Pinlight uses only to show prices in EUR in Europe and in USD elsewhere. The country is not stored.

The database and server functions run on Convex (Convex, Inc., USA) in the EU region eu-west-1 (Ireland).

Legal basis: Art. 6(1)(f) GDPR, our interest in a secure, working service.

3. The free check

For a free check you enter a website address, a city and a country. Pinlight reads that website's homepage and robots.txt, asks AI engines questions about the business and stores the result. Your IP address is used to enforce the limit of 3 checks a day and for the bot check; it is stored only as a hash with a key that changes every day, never in full.

A check is kept for 30 days and then deleted, unless someone confirmed tips emails for it (section 5).

Legal basis: Art. 6(1)(b) GDPR for the check you asked for, and Art. 6(1)(f) GDPR, our interest in preventing abuse.

4. Cloudflare Turnstile

Before a free check runs, Cloudflare Turnstile (Cloudflare, Inc., USA) checks that the request comes from a person. Cloudflare processes your IP address and information about your browser for this. It sets no cookies for advertising. Cloudflare is certified under the EU-US Data Privacy Framework.

Legal basis: Art. 6(1)(f) GDPR, our interest in protecting the free check from automated misuse, which costs us money for every check.

5. The report email and tips

If you ask for the full report, we store your email address with the check and send you one email with a link to the report. Without the tips box ticked, the address is used for nothing else and is deleted with the check after 30 days. Legal basis: Art. 6(1)(b) GDPR.

If you tick the tips box, we first send a confirmation email. Only after you confirm do we send occasional tips on getting recommended by AI. We store the text you agreed to, its version, and the times of the request and the confirmation as proof. Legal basis: your consent, Art. 6(1)(a) GDPR.

You can withdraw your consent at any time with the link in every tips email and in the confirmation email. Your address is then deleted at once.

6. Your account

For an account we store your email address, your name, your password as a hash (never in plain text), your sessions and your interface language. We also store what you enter about your business: website, market, profile, facts such as opening hours, address and prices, competitors, questions, tasks and drafts. Most of this is about the business; where a business carries its owner's name, some of it can also relate to you as a person.

Legal basis: Art. 6(1)(b) GDPR. We keep the data while your account exists. In the settings you can export it as a file and delete your account. When an owner deletes their account, the organization's businesses and everything under them are deleted too; billing records are kept as section 10 describes.

7. Team members and invitations

An owner or admin can invite people to their organization by email. We store the invited address, the role and who sent the invitation, and send one invitation email. An invitation expires after 7 days. Members of an organization see its businesses and each other's names and email addresses.

Legal basis: Art. 6(1)(b) GDPR for the inviting organization, and Art. 6(1)(f) GDPR for the invited person, our and the organization's interest in working on the business together.

8. AI engines and search data

To check what AI says, Pinlight sends questions about your business, and for profiles and drafts the public text of your website, to AI providers through OpenRouter (OpenRouter, Inc., USA), which passes them to the model providers: OpenAI, Google, Perplexity and Anthropic (all USA). Google results come from DataForSEO (DataForSEO OÜ, Estonia). When a website can't be read directly, for example because it blocks automated visits, its public pages are fetched through Firecrawl (SideGuide Technologies, Inc., USA). These requests contain information about the business, never your email address, password or payment data.

Legal basis: Art. 6(1)(b) GDPR, because these requests are the service you use.

9. Emails

Pinlight sends the emails your account and plan need: confirming your address, resetting your password, invitations, the weekly plan, a note when a check is done, and notices about your trial and payments. You can turn off the weekly plan email in the settings.

Emails are sent through Resend (Resend, Inc., USA) in its EU region from mail.pinlight.ai. Resend reports whether an email was delivered or bounced. We don't track opens or clicks.

10. Trial, subscriptions and payments

The trial and subscriptions are handled by Stripe (Stripe Payments Europe, Ltd., Ireland). You enter card or bank details only at Stripe; they never reach Pinlight. Stripe also collects your billing address and, if you give one, your VAT ID, to calculate tax and issue invoices. Pinlight stores the plan, its status and dates, and Stripe's references for your customer record and subscription.

Stripe also processes some data under its own responsibility, for example to prevent fraud and to meet its legal duties. Its privacy policy is at stripe.com/privacy.

Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for invoices and billing records, which German tax and commercial law requires us to keep for up to 10 years (section 147 AO, section 257 HGB), also after an account is deleted.

11. Writing to us

When you write to hello@pinlight.ai, we use your message and address to answer you. Cloudflare Email Routing (Cloudflare, Inc., USA) forwards the message to our mailbox at Gmail (Google Ireland Limited, Ireland). Google may also process it in the USA; Google LLC is certified under the EU-US Data Privacy Framework. We delete the correspondence when it is no longer needed, unless the law requires us to keep it.

Legal basis: Art. 6(1)(b) GDPR when it is about a contract or your account, otherwise Art. 6(1)(f) GDPR, our interest in answering you.

12. Cookies and storage in your browser

Pinlight uses only necessary cookies: the session cookie when you are signed in and a cookie for your language. For the current visit only, your browser keeps a running free check and the address you just signed up with. On your device, Pinlight also remembers the website, city and country from a free check, so setting up Pinlight can fill them in, the plan you picked on the pricing card until you start the trial, and when a week's finish animation has played, so it doesn't play again. None of this is used for tracking or sent to anyone else. There are no analytics or advertising cookies.

13. Transfers outside the EU

Some providers are based in the USA. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the EU standard contractual clauses.

14. Required data and automated decisions

You don't have to give us any data. Without an email address there is no account, and without a website address there is no check.

Pinlight makes no decisions about you based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). Scores and plans describe how AI engines talk about a business.

15. Your rights

You have the right to access, rectification, erasure, restriction of processing and data portability. You can withdraw consent at any time for the future. Write to hello@pinlight.ai.

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We then stop, unless we have compelling legitimate grounds that override your interests.

You can also complain to a data protection supervisory authority. The one responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59-61, 10555 Berlin.

16. Changes

We update this policy when Pinlight or the providers it uses change. The date at the top shows when it last changed.