Legal
Privacy policy
Last updated 2 Nov 2026
The short version
- We keep only what Pinwel needs to work: your account, your sign-ins and the work your team records.
- Your data is stored in the EU (Frankfurt). We never sell it or use it for advertising.
- Your location is recorded only while you turn on "My location" with the map open, and kept 30 days.
- We use no tracking or advertising cookies, only the ones that keep you signed in and remember your settings.
- You can see, correct, export or delete your data. Email us.
Who we are
Pinwel is run by:
- Name
- [Full legal name]
- NIF
- [NIF]
- Address
- [Street, postcode, city], Spain
- info@pinwel.com
Your team's work. What your team records in its workspaces (layouts, pins, messages, photos, locations) we handle for your organization: it decides how that data is used, so ask it first. Our duties to it are in the Terms. For everything else, this policy applies.
What we keep and why
- Data
- Demo requests: name, email, company, message
- Why
- To answer you and arrange a demo
- Legal basis
- Steps you ask for before a contract (art. 6(1)(b))
- Kept for
- 12 months after our last contact
- Data
- Account: name, email, password (stored hashed), profile photo
- Why
- To let you sign in and use Pinwel
- Legal basis
- The contract with your organization (art. 6(1)(b)) and our legitimate interest in providing it (art. 6(1)(f))
- Kept for
- Until your account is deleted
- Data
- Sign-in data: IP address, browser, sign-in codes
- Why
- To keep accounts safe and stop abuse
- Legal basis
- Legitimate interest in security (art. 6(1)(f))
- Kept for
- Codes 5 minutes; the rest 30 days
- Data
- Support requests and our replies
- Why
- To help you
- Legal basis
- The contract (art. 6(1)(b))
- Kept for
- Until your account is deleted
- Data
- Your acceptance of the Terms (version and time)
- Why
- To show what you agreed to
- Legal basis
- Legitimate interest (art. 6(1)(f))
- Kept for
- Until your account is deleted
Where it comes from. Your organization's admin gives us your name and email when they invite you. Everything else comes from you or your use of Pinwel.
Do you have to give it? An account needs your name and email; without them you can't use Pinwel. Everything else is up to you.
We make no automated decisions about you and build no profiles.
Your location
- Only when you turn on My location, and only while the map is open. Your browser asks your permission first.
- About every 30 seconds Pinwel saves where you are, to show which object you're at and the route you took.
- People in your workspace see your last location for 12 hours. Its managers and your organization's admin also see your route and time at each object.
- Points and visits are deleted after 30 days.
- Photos you add lose their GPS and camera details when we save them.
Who else sees it
Inside your organization, people see each other's names, photos and the work they share. Our staff see your data only to support you or keep Pinwel running, and every account they open shows a banner while they do.
These providers handle data for us, under contracts that bind them to our instructions:
- Provider
- Vercel
- What for
- Hosting the app
- Where
- EU (Frankfurt); a US company
- Provider
- Neon
- What for
- Database and file storage
- Where
- EU (Frankfurt); a US company
- Provider
- Resend
- What for
- Sending our emails
- Where
- US
- Provider
- Stripe
- What for
- Billing: SEPA Direct Debit mandates, bank details, invoices and VAT. We never see the full bank account number
- Where
- EU (Ireland); a US company
- Provider
- Microsoft Azure
- What for
- AI action suggestions, only from the text you type into them
- Where
- US
- Provider
- Esri
- What for
- Satellite map images: your browser loads them directly, so Esri sees your IP address and the map area
- Where
- US
We never sell your data, and we share it with authorities only when the law requires it.
Transfers outside the EU
Where a provider is in the US or can access data from there, the transfer is covered by the EU-US Data Privacy Framework (the European Commission's adequacy decision of 10 July 2023) or by the Commission's standard contractual clauses. Email us for a copy of the safeguards.
Your rights
You can ask us to:
- show you the data we hold about you, or give it to you in a common format to take elsewhere
- correct it, or delete it
- limit how we use it, or stop using it where we rely on legitimate interest
Email info@pinwel.com. We answer within one month. You can also delete your account yourself, under Account.
If you think we got it wrong, you can complain to Spain's data protection authority, the AEPD (C/ Jorge Juan 6, 28001 Madrid), or the authority where you live.
Changes
When this policy changes in a way that matters, we'll tell you by email or when you next sign in, and update the date above.
Questions? Email info@pinwel.com. We answer within a month.