Privacy Policy

1. Collection of Personal Data

This website (pinna.im)

The public website does not require an account and does not handle sign-in. When you visit, we may automatically receive limited technical information:

• Device and connection information: device type, operating system, browser type, IP address, time zone
• Usage information: pages viewed, time of access, referral source

We use first-party performance monitoring (Elastic APM) as a functional component of the service — it detects errors and monitors site health. This data is processed on our own infrastructure and is not shared with third parties for advertising. No advertising or third-party tracking cookies are used.

The Pinna application (account.pinna.im)

The Pinna application is an authenticated service. We collect:

• Identity and contact data: email address, authentication credentials
• Usage and account data: the audio jobs you submit, their status and timestamps, API key identifiers, and the email addresses you place on your account's ingress allowlist
• Content data: the audio recordings you submit and the transcripts produced from them
• Technical information: IP address, browser type

Submission content. The audio you submit and the transcripts generated from it are processed to provide the service (diarization and transcription). Audio submitted by email is accepted only from addresses on your account allowlist.

2. Special Category Data

Audio recordings and the transcripts produced from them may contain special category data as defined by GDPR Article 9 — for example, if a recorded conversation reveals health, political, or religious information, or other sensitive content. You are responsible for ensuring you have a lawful basis and any necessary consents to submit recordings of other people. We process this content to provide the service you requested (Article 6(1)(b), contract performance) and apply the same security and access controls described below to any incidental special category data.

3. Payment Data

If and when paid plans are offered, paid transactions are expected to be processed by a third-party Merchant of Record (for example, Paddle), which would act as the seller for paid transactions and handle billing, invoicing, sales tax, and payment processing. In that arrangement we would not collect or store payment card details; we would receive only your email address, subscription status, and transaction identifiers, used solely to manage your plan. Commercial terms are not yet finalized.

4. How We Use Personal Data

• To provide, maintain, and improve the Services (diarization and transcription of your audio)
• To create and administer your account
• To manage the email ingress allowlist and API keys you configure
• To communicate with you about service updates, security notices, and support
• To prevent and investigate fraud, abuse, and violations of our Terms of Service
• To meet legal and compliance obligations

We do not sell, rent, or share your personal data with third parties for marketing purposes. We do not use your audio or transcripts to train third-party AI models.

5. How We Disclose Personal Data

• Infrastructure providers: hosting and processing infrastructure necessary to operate the Services, under data processing agreements.
• Merchant of Record (if/when paid plans launch): email address and subscription data as described above.
• Legal requirements: when required by law, regulation, legal process, or governmental request.
• Safety and rights: when necessary to protect the rights, safety, or property of our users, our company, or the public.
• Business transfers: in a merger, acquisition, or sale of assets, with notice.

6. Your Rights and Choices

Depending on where you live and applicable law, you may have rights to: know what data we process and why; access and portability; correction; deletion (subject to legal obligations); objection; restriction; and withdrawal of consent. To exercise these rights, contact info@pinna.im. We aim to respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

7. Data Transfers

S2 Tikshuv Ltd is based in Israel, which the European Commission has recognized as providing an adequate level of data protection under Article 45 GDPR. Where data is transferred to providers in countries without an adequacy decision, we use appropriate safeguards such as standard contractual clauses.

8. Data Retention and Security

Retention. We retain account data while your account is active. We retain submitted audio and the resulting transcripts for as long as needed to provide the service and as governed by your account settings and applicable legal obligations; the specific retention window is being finalized and will be stated here before launch. You can request deletion as described in Section 6.

Security. We implement appropriate technical and organizational measures, including:

• Encryption of data in transit
• Access controls on stored content; internal access is limited and logged
• For external sign-in providers, your password is handled by the provider — we never see it; for Pinna accounts, passwords are stored as secure hashes

No method of transmission or storage is 100% secure.

9. Cookies

The Pinna application uses minimal, functional cookies (for example, to maintain your session when signed in). The public website does not use advertising or third-party tracking cookies. You can control cookies through your browser settings; disabling them may affect authenticated features.

10. Children

The Services are not directed to, and we do not knowingly collect personal data from, children under the age of 18. If you believe a child has provided personal data, contact info@pinna.im and we will investigate.

11. Changes to This Policy

We may update this Privacy Policy. If we make material changes, we will post a notice on this website and, for account holders, notify by email before the changes take effect. The date at the top indicates the latest revision.

12. Contact

A plain-text version of this policy is available at /privacy.txt.