PingsYou Privacy Policy

§1. Controller

The controller of the personal data of Users of pingsyou.com and the PingsYou Dashboard, and of people who contact us, is Katarzyna Górecka, ul. Nowogrodzka 31, 00-511 Warsaw, Poland, tax ID (NIP): 7412060624 ("we").

For all matters concerning personal data write to admin (at) pingsyou.com or to the postal address above. We have not appointed a data protection officer - we are not required to - privacy matters are handled directly by the owner of the business.

Capitalised terms (Customer, User, Contact, Account, Dashboard) have the meaning given in the Terms of Service.

§2. What data we process and why

• Account: name, email address, password (only as a cryptographic hash), Google account identifier when signing in with Google, company name and details, settings, team roles. Purpose: creating and running the Account, providing the Service, contacting you about the Account.
• Payments: invoice details (company, address, tax ID), payment and Plan history. Card details are processed only by Stripe. Purpose: billing, issuing invoices, tax and accounting obligations.
• Logs and security: IP address, browser and device type, sign-in dates, the Account operation log (including operations through the MCP Connector and the API). Purpose: security, abuse detection, troubleshooting, accountability.
• Cookies and site statistics: described in §9.
• Contact: data from the contact form and correspondence (name, email, company, message). Purpose: replying and conducting the conversation, including sales conversations.
• Service messages: the User's email address. Purpose: notifications about limits, payments, security and changes to the Terms. We send product news only to those who allowed it, with the option to unsubscribe at any time.

Providing data is voluntary, but an Account cannot be created without an email address, and a paid Plan cannot be bought without invoice details.

§3. Legal bases

• Article 6(1)(b) GDPR - performance of the agreement (the Terms): Account, Service, payment handling, service messages;
• Article 6(1)(c) GDPR - legal obligation: invoices and accounting records, responding to requests from competent authorities;
• Article 6(1)(f) GDPR - our legitimate interest: security and abuse prevention, logs, establishing and defending claims, replying to messages, contact with people representing Customers, marketing our own services to Customers;
• Article 6(1)(a) GDPR - consent: site statistics (analytics cookies) and the product newsletter; you can withdraw consent at any time without affecting the lawfulness of prior processing.

§4. Recipients and sub-processors

We do not sell data. We share it only with entities that help us provide the Service, under data processing agreements, and only to the necessary extent:

• Twilio Inc. (SendGrid), USA - email delivery (including sign-in and notifications);
• Amazon Web Services EMEA SARL (Amazon SES), EU region - email delivery;
• Anthropic PBC, USA - AI models performing AI Generations;
• OpenAI, L.L.C., USA - only when the Customer connects the Account to ChatGPT through the MCP Connector;
• Stripe Payments Europe Ltd., Ireland - payments and invoices;
• Google Ireland Ltd., Ireland - sign-in with a Google account, when the User chooses it;
• a hosting and database provider with a data centre in the European Union - data storage.

Data may also be received by our accounting office and legal advisers (to the necessary extent, under confidentiality) and by public authorities where required by law.

§5. Transfers outside the EEA

We store data in the European Union. Some sub-processors (Twilio/SendGrid, Anthropic, OpenAI) are based in the USA, so data may be transferred there. This takes place on the basis of the European Commission decision on the EU-US Data Privacy Framework (for certified entities) or standard contractual clauses adopted by the European Commission, together with supplementary safeguards (encryption in transit, data minimisation).

You can obtain a copy of the safeguards applied by writing to admin (at) pingsyou.com.

§6. How long we keep data

• Account data - for the term of the agreement and 30 days after termination (for export), then we delete it, including from backups within their cycle (up to 30 days);
• invoices and billing data - 5 years from the end of the calendar year in which the tax payment deadline passed;
• technical logs - up to 90 days; security logs and the Account operation log - up to 12 months;
• correspondence and contact form data - up to 2 years from the last message, or until claims become time-barred if the correspondence concerns them;
• data processed on the basis of consent - until it is withdrawn; data processed on the basis of legitimate interest - until an effective objection.

§7. Your rights

You have the right to:

• access your data and receive a copy;
• rectification of inaccurate data;
• erasure ("right to be forgotten") where there is no basis for further processing;
• restriction of processing;
• portability of data processed on the basis of the agreement or consent;
• object to processing based on legitimate interest, including marketing - in which case we stop without further assessment;
• withdraw consent at any time;
• lodge a complaint with the President of the Personal Data Protection Office (§12).

To exercise your rights, write to admin (at) pingsyou.com. We reply within one month. You can also change or export most Account data yourself in the Dashboard.

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. The Reputation Guardian (pausing sending when bounce or complaint thresholds are exceeded) is a technical rule protecting deliverability - you can appeal its decision and a human reviews the case.

§8. Customers' contacts data (PingsYou as a processor)

The data of people the Customer sends emails to (Contacts) is entered and controlled by the Customer - the Customer is its controller and is responsible for the legal basis for processing it and for informing those people. We process it only on behalf of the Customer, under the data processing agreement that is part of the Terms of Service (§13).

Within the Service, emails may contain an invisible pixel and link redirects that let the Customer see opens and clicks. We filter out automatic opens (e.g. Apple Mail Privacy Protection and anti-virus scanners). Every marketing email has an unsubscribe link, and unsubscribes are honoured automatically.

If you received an email from a business using PingsYou and want to exercise your rights, contact that business (the sender) directly. You can also write to us - we will pass the request on to the relevant Customer.

§9. Cookies

Cookies are small files saved by your browser. On pingsyou.com and in the Dashboard we use two categories:

• Necessary - always on, because the site and sign-in do not work without them: py_session (the signed-in User's session, until sign-out or session expiry), py_lang (the remembered site language, 1 year) and pingsyou_cookie_consent (your choice in the cookie banner, 365 days). Basis: Article 6(1)(b) and (f) GDPR and Polish electronic communications law.
• Statistics (with consent) - help us understand how the site is used (e.g. number of visits, popular pages), in aggregated form. We enable them only after your consent in the banner. Basis: Article 6(1)(a) GDPR.

We do not use advertising or profiling cookies and do not share cookie data with ad networks.

On your first visit, the banner asks for consent to statistics. We store your choice in the browser under the key pingsyou_cookie_consent for 365 days, after which we ask again. You can change or withdraw your consent at any time by clicking "Cookie settings" in the site footer. You can also delete or block cookies in your browser settings - blocking the necessary ones will prevent signing in.

§10. Security

• encrypted connections (HTTPS/TLS) on the site, in the Dashboard, the API and the MCP Connector;
• passwords stored only as cryptographic hashes, passwordless sign-in (one-time link, Google);
• separation of Account data, the principle of least privilege, an operation log;
• backups and servers in the European Union;
• API tokens and MCP connections that the Customer can revoke at any time;
• User approval before every send prepared by AI.

If you notice a security vulnerability, write to admin (at) pingsyou.com - we will treat it as a priority.

§11. Changes to this policy

We update this policy when the law, the Service or our sub-processors change. Each version has a number and an effective date at the top of the document. We notify Users of material changes in advance by email or in the Dashboard.

§12. Contact and complaints to the supervisory authority

Questions about personal data: admin (at) pingsyou.com, the Contact form, or in writing: Katarzyna Górecka, ul. Nowogrodzka 31, 00-511 Warsaw, Poland.

If you believe we process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl), or with the supervisory authority in your EU country of residence. We encourage you to write to us first - most matters can be cleared up quickly.