Privacy Policy
Version 2026-08-31 · Last updated: 31 August 2026
1. Data Controller
Pinart d.o.o., Mladinska ulica 63, 1000 Ljubljana, Slovenia Email: tina@pinart.si
2. Data We Collect
Depending on how you use the service, we process: – Contact form: first and last name, email, message content (at your initiative). – User account: email and name received from your sign-in provider (e.g. Google) when you log in. – Business data in the app: proposals, contracts, invoices, clients, projects, expenses and tasks you enter while using the service (stored to your account). – Communications: the content of project chat and project mail, if you use those features. – Authorship vault: file name, cryptographic fingerprint (SHA-256), date and work details; and, with the paid vault, the file itself. – Usage data (logged in): the number of visits and active days of your account, the time of your last sign-in and the total time the app is open and active (measured only while the tab is visible; counting stops after five minutes of inactivity) — to monitor and improve the service. This is not anonymous (tied to your account) and is unrelated to the anonymous pricing statistics. – Anonymous pricing statistics: no personal data, cannot be linked to you (see below).
3. Purpose and Legal Basis
We process your data to: (a) respond to inquiries and conduct business communication; (b) provide and operate the platform (account, document storage, communications, vault); (c) bill subscriptions; (d) improve the service. Legal bases: performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR) for platform operation and subscriptions; your consent (Art. 6(1)(a) GDPR) e.g. for updates; legitimate interest (Art. 6(1)(f) GDPR) for security and improvements.
4. Data Retention
We retain your data only for as long as necessary for the purpose of processing, or for as long as your account exists. After account deletion or on your request we delete your data, except where we must retain it by law (e.g. accounting rules for issued invoices).
5. Where Your Data Is Stored
Business data of logged-in users is stored in a cloud database and storage (Supabase, servers in the European Union). Data is tied to your account and protected by database-level access rules, so only you and the people you explicitly share content with can access it.
5a. Subprocessors
We do not sell or rent your data. To operate the service it is processed by the following subprocessors, strictly on our instructions: – Supabase — cloud database and storage (EU) – Vercel — hosting and application delivery – Resend — sending email – Google — sign-in with a Google account (OAuth) and a Google Sheets spreadsheet that records contact-form inquiries and calculator sign-ups (name, email, message) – Cloudflare — receiving and forwarding inbound email on @pinartflow.com addresses – Anthropic — the AI assistant Pupa (only when used; see section 9) – FreeTSA (freetsa.org) — independent time-stamping authority for the vault under RFC 3161 (receives only the 32-byte fingerprint, never the file, its name or the work description) – Stripe — subscription payment processing as the authorised payment provider (Merchant of Record); we neither see nor store card details – PostHog (EU cloud, Frankfurt) — usage measurement on the marketing pages: heatmaps, session recordings and funnels. It runs ONLY with your consent and only on the marketing pages, never inside the app or the calculator; input fields are masked in recordings – AJPES — lookups in the Slovenian business register and published annual reports; we send the registration number of the COMPANY you look up, not your personal data We also share data with third parties where required by law. The current list of subprocessors is available on request at tina@pinart.si.
5b. Authorship Vault
The Authorship vault stores a cryptographic fingerprint (SHA-256) of your work, a date and work details (e.g. file name, tool). The fingerprint is a unique "fingerprint"; the content cannot be reconstructed from it. For an independent timestamp we use FreeTSA (freetsa.org) under the RFC 3161 standard: only the 32-byte fingerprint is sent to the time-stamping authority, which returns a time-stamp token signed with its own certificate. Your file, its name and the work description never reach the authority — it does not learn what you time-stamped, only that this fingerprint was already known at that time. Anyone can verify the token, including without Pinart Flow. We may change the authority (for example to a qualified service under the eIDAS Regulation); the current one is disclosed on request. If you choose the paid cloud vault, the original file (and any source files) is stored in private cloud storage (Supabase, EU) accessible only to you. The vault proves the existence and priority of a work on a given date, not absolute authorship, and is not a substitute for formal rights registration.
5c. Security
We protect your data with technical and organisational measures: encrypted transport (TLS), encryption at rest at our database provider, database-level access control (each user sees only their own data), sign-in through a trusted provider (Google OAuth), and automated daily database backups that allow data to be restored after an incident (Article 32(1)(c) GDPR). No system is completely impenetrable; you are also responsible for protecting access to your account (e.g. your device and login).
6. Google Analytics
This website uses Google Analytics to analyse site traffic. Google Analytics collects anonymous data (device type, country, pages visited). This data is not linked to your personal identity. You may opt out by installing the Google Analytics Opt-out Browser Add-on or by adjusting your browser's cookie settings. On the MARKETING pages we also use PostHog (EU cloud, Frankfurt) to understand usage: click heatmaps, session recordings and funnels. A session recording captures your clicks, scrolling and path through the page; the content of input fields is masked. Both run ONLY with your cookie consent and NEVER inside the app or the calculator — there you enter your own clients' data, and we do not send it anywhere. You can withdraw consent at any time in the cookie settings; recording then stops.
7. Your Rights
Under GDPR you have the right to: – access your personal data – rectify inaccurate data – erasure of your data – restriction of processing – data portability – object to processing Exporting all your data (portability) and closing your account (erasure) are available in My profile in the app; send other requests to tina@pinart.si. You also have the right to lodge a complaint with the Slovenian Information Commissioner (ip-rs.si).
8. Cookies
This website uses functional cookies for operation and analytical cookies (Google Analytics and PostHog). On your first visit you may manage your cookie preferences; without your consent, analytical cookies and session recording are not loaded.
9. Artificial Intelligence (Pupa) and Data Security
Pupa is an optional assistant powered by the Anthropic Claude API. Processing takes place server-side, so the API key is not exposed in the user's browser. Anthropic receives the content entered into Pupa and the limited open-tool or offer context required to provide a response. Anthropic has no direct access to the Pinart Flow database. Do not enter confidential information, trade secrets, or clients' personal data into Pupa. If you do not use Pupa, data is not sent to Anthropic or another external AI provider; the core Pinart Flow tools operate without AI. Anthropic is intended to act as a subprocessor. Under its current terms, commercial API inputs and outputs are not used for model training by default. Retention follows Anthropic's then-current terms. Because data may be processed in the United States, transfers must be governed by a DPA and appropriate Standard Contractual Clauses (SCCs). The current list of subprocessors is available on request at tina@pinart.si. More: https://privacy.anthropic.com/en/collections/10663361-commercial-customers.
10. Changes to This Policy
We may update this Privacy Policy at any time. The date of the last update is shown at the top of this page.