Privacy Policy
Last updated 4 September 2026
WHO IS RESPONSIBLE FOR YOUR DATA
Pinna is operated by S2 Tikshuv Ltd, which is the data controller for the personal data described in this policy. Where this policy says "we" or "us", that means S2 Tikshuv Ltd.
RETENTION AND DELETION
Your recordings and the transcripts made from them are deleted from our storage automatically, within 7 days of upload. This happens on a schedule, to everything, whether or not you ask and whether or not your account is still open.
There is no button that deletes a single recording sooner, and closing your account does not trigger an early deletion. If you need something removed before the 7 days elapse, contact us and we will handle it as a request rather than as a feature.
What remains after that is a record of the job, and it does not expire. With no deletion period we keep: which account submitted the recording and when, the language and speaker settings you chose, where the file was stored, whether it succeeded or failed, and the email routing used if it arrived by email. We also keep your preferences, your inbox address, and details about any API keys you created, though never the keys themselves in readable form.
Some of that is potentially identifying, and we would rather say so than call it anonymous. The stored location includes the filename you gave the recording, and a filename often names a person. Depending on how your account was created, the identifier we file everything under may itself be your email address.
What we do not keep at all, once the 7 days have passed or in some cases at any point: the audio, the transcript text, the raw email we received including its subject and body, and how long the recording was.
ACCOUNT DELETION
We keep a security and audit record of what happened on your account, separate from your recordings and transcripts. It exists so that unauthorised access, misuse and billing disputes can be investigated after the fact, and it is not removed when other data is removed.
That record is now also copied to a search system, so that it can be looked up when something needs investigating. We do not currently set or publish a period after which the copy is deleted.
This is a change, and we would rather name it than quietly replace the text. An earlier version of this policy told you the record was bounded by the size of the store it lived in and would eventually be displaced. That stopped being true when the copy began, so we are not repeating it.
The record is filed under your account identifier, and that identifier is searchable. Depending on how your account was created, it may be your email address.
WHAT WE PROCESS, AND WHERE IT GOES
When you submit audio, it is stored as an object in our storage, transcribed on a machine we start for that job and shut down afterwards, and the resulting transcript is stored alongside it. The temporary machine is destroyed after every job; that removes its local copy and does not affect the stored copies.
Two submission paths differ and the difference matters. Audio you upload is copied into our storage. Audio submitted through the API as a link may be left at the address you supplied rather than copied to us, in which case we do not hold the recording at all.
Your recordings and transcripts are stored and transcribed in the European Union, in Sweden. Both the storage and the temporary transcription machines run there.
If we send you a transcript by email, that email is sent from a service located in Ireland, also in the European Union. So the honest answer to "where is my data processed" is two EU locations, not one.
Your audio is processed on machines we control in our own cloud account, using models bundled with the software. The software is configured not to contact external AI services, and audio moving to and from storage stays inside the provider's network.
EMAIL SUBMISSION
You may send audio to Pinna by email. When you do, we read the message, keep the audio attachments, and discard the message body, subject and non-audio attachments.
We keep: the address to reply to, the audio itself, and a record that the message was processed. We keep the message identifier for a short period so that a resent message is not transcribed twice.
Email submission is not accepting messages at present. Before matching a sender against your list, we now require evidence that the message genuinely came from the address it claims. The mail relay does not yet supply that evidence, so every message is refused and nothing reaches transcription by this route.
Our receiving mail server keeps short-lived operational logs. They are held in memory rather than written to disk, and they are lost whenever that machine restarts. They can contain your account identifier and the network address a message arrived from. No retention period is set for them and nothing preserves them.
ACCOUNTS AND SIGN-IN
Your account details are held by us, on our own infrastructure. Sign-in is provided by a platform component outside this transcription service, and the account record it keeps can include your email address, phone number, username and plan.
No outside company stores your account. Every part of the chain that holds your account details runs on infrastructure we operate.
One outside company delivers your sign-in code, and does not store your account. Amazon Web Services sends the email carrying your one-time code. To do that it receives the address the code is sent to, the message itself including the code, and the technical record of the delivery. Those messages are sent from within the European Union, in Ireland.
You can sign in with a one-time code sent to your email address, or by signing in with Google or with Microsoft. If you choose Google or Microsoft, that company handles the sign-in and receives your identity as part of it, under its own privacy policy. If you sign in with a one-time code, neither of them is involved.
If we add another sign-in provider we will name it here.
WHO ELSE RECEIVES YOUR DATA
Object storage, the temporary transcription machines, and the outbound mail service are all operated by Amazon Web Services, in the EU locations named above.
The systems that hold your account record, your job records, the work queue and short-lived operational state all run on machines we operate ourselves, inside that same Amazon infrastructure. No separate company runs them, and none receives your data through them.
Separately, we collect technical information about how the service performs, and that goes somewhere else. When you use the web pages, your browser sends those measurements. When you use the service another way, our own systems send them. They record which pages and requests were made, how long they took and whether they failed, and the network address your browser connected from. Until recently, where a request involved an email address, such as adding a sender to your allowed list, that address could appear in these measurements. We changed that, and new measurements no longer record it. Measurements collected before the change still contain some of these addresses, and we have not yet removed them.
These measurements are held on servers we own and run ourselves, on our own hardware, rather than at a cloud provider.
Our payment provider is the seller of record. That means it collects your card details, billing address and contact details directly from you, on its own pages. It holds that payment information. We never receive it and never see it.
Separately, when your payment status changes, the provider notifies the platform, which looks up your account record to update your plan. That lookup reads your account record here. It does not send anything from that record to the payment provider.
When you email us, Google receives that email. Mail sent to a pinna.im address, including the contact address on this page, is delivered to a Google Workspace mailbox. So anything you put in a message to us, including a request to see or delete your information, passes through Google before it reaches us.
The audio you submit to the service does not go that way. Recordings sent to the service's own submission address arrive on a machine we run ourselves, and no other company handles them.
DATA STORED ON YOUR DEVICE
Signing in puts a small amount of data in your browser's own storage, on your device. It stays there rather than being sent to us as content.
While you are signing in we store short-lived values that let us confirm the sign-in finished the way it started, together with the page you were on so you can be returned to it. These are cleared as the sign-in completes.
Once you are signed in your browser keeps a sign-in token so you are not asked to sign in again on every page. Clearing your browser's storage for this site removes it and signs you out.
We do not use advertising or tracking cookies, and we do not share this storage with anyone.
YOUR RIGHTS OVER YOUR DATA
You can ask us for a copy of the information we hold about you, and we will provide it. There is no button for this today, so please contact us and we will handle it as a request.
You can ask us to correct information that is wrong.
You can ask us to delete your information, and we will handle it as a request. There is no button for this either, and closing your account does not by itself remove what we hold.
Your recordings and transcripts go within 7 days whether or not you ask, on the schedule described above.
Some records will remain after a deletion request, and we would rather tell you which than imply otherwise. The job record described above, and the security and audit record of what happened on your account, are not removed by a deletion request today. They remain because no deletion request reaches them, not because we have decided to keep them for a period. The audit record is also copied to a search system, as described above.
If you want your information restricted, or provided to you in a portable form, contact us and we will handle that as a request too.
CHANGES TO THIS POLICY
If we change this policy we will publish the updated version here. Where a change materially affects how we handle your information, we will say what changed rather than only replacing the text.
HOW WE PROTECT YOUR INFORMATION
Everything you send us travels over an encrypted connection, and our certificates are renewed automatically. A failure to renew stops the service rather than falling back to an unprotected connection.
Access to your data requires a valid sign-in, and that is enforced before any request reaches the application. A request without a valid session is refused at the edge. The identity attached to your requests is set by our own systems and cannot be supplied or altered by a browser.
Your recordings and transcripts are removed automatically within 7 days, which limits how long there is anything to protect.
API keys are never stored in a form that can be read back, including by us.
Your recordings and transcripts are not kept on the machines that process them. They are held in the storage service named above, and the machine's own disk carries no copy of them.
We do not claim more than this. We hold no security certification today, and where a protection is not described above you should not assume it.