1. Controller and scope
For the hosted Pinar service, the data controller is Djalma Júnior, an individual in Brazil. Privacy contact: [email protected]. Data protection officer: Djalma Júnior, through the same contact. This Policy does not govern local-only data that never leaves your device; you control that data locally. When you use AI in the local app, it sends each request directly to the endpoint you configure (a model on your computer or a provider of your choice); that content does not pass through Pinar, and that provider's terms apply.
When your use of Pinar includes third-party data — what appears on the pages you capture and collaborator comments — you are the controller of that data and are responsible for having a legal basis and for informing the data subjects, including when you use the AI features of Pinar Cloud described in Section 4. Pinar acts as a processor of that data. When we process that data for our own purposes, such as security, fraud and abuse prevention, and legal compliance, we act as controller.
2. Data we process
Depending on your use, we process: account email and authentication records; policy-acceptance evidence; billing identifiers and plan status received from Stripe (not full card details); device and extension identifiers; IP address, request, security, and diagnostic logs; projects, collections, page URLs and titles, screenshots, annotations, comments, selectors, and sharing metadata you submit; storage and AI-credit usage; and prompts, inputs, outputs, model usage, and error details when you invoke an AI feature.
When your plan includes the AI assistant in Pinar Cloud, we also process: your messages and its answers, stored as conversation history; the proposals it prepares for you to confirm; the project, collection, session, pin, and comment data its tools read to answer you, which may include content other people shared with you; descriptions and visible text that AI extracts from session screenshots, and search representations (embeddings) of each pin's text (page title and URL, element, description, and comments), used to search your pins and created only while the assistant answers your messages; the title, URL, and pin comments of a new capture, when you turn on “Choose the collection automatically”; and usage records with the model, tokens, and cost of each request.
Avoid capturing secrets or unnecessary sensitive personal data. A screenshot may contain information about you or third parties, and you are responsible for having an appropriate basis to submit it.
Cookies and local storage. Pinar Cloud uses only what the service needs: a session cookie that keeps you signed in for up to 30 days and is removed when you sign out, a cookie that remembers the language you chose, and your browser's local storage for interface preferences: the language, the theme, the project and collection you last selected, the history view, and whether the assistant panel is open. Pinar uses no advertising or analytics cookies. Cloudflare, which sits in front of pinar.dev, may set cookies needed to protect the service.
3. Purposes and legal bases
We process data to provide accounts and contracted features; authenticate users; store and share content at your direction; process billing and entitlements; operate AI features, including the Pinar Cloud assistant, the search of your pins, and, when you turn it on, the automatic choice of a new capture's collection; prevent fraud and abuse; secure and troubleshoot the service; comply with law; establish or defend legal claims; and communicate service or policy changes. Under the LGPD, the applicable bases may include contract performance, compliance with legal obligations, legitimate interests subject to safeguards, regular exercise of rights, fraud prevention, and consent where specifically requested. The description of screenshots and the indexing of pins for search are done to run the AI features you use.
4. Sharing and international transfers
We share data only as needed with the providers listed in the Service Providers and Subprocessors page, with professional advisers under confidentiality, in a corporate transaction subject to appropriate protections, or with authorities when legally required. Cloud infrastructure, payment processing, and AI features may involve processing outside Brazil; the hosted service runs on servers in Germany. That page lists each provider, its purpose, and where it typically processes data.
AI in Pinar Cloud. To answer in the assistant, search your pins, and choose a new capture's collection, Pinar Cloud sends the content each request needs to the AI providers accessed through the Vercel AI Gateway (Vercel Inc., United States). The gateway routes each request to a provider that serves the model Pinar configured. That content may include your messages and the conversation history; the data the assistant's tools read; the screenshot of each session with pins, to describe the pins for search, even when “Include screenshot in agent copy” is off; the text of pins, for search; the voice recorded on a pin, to transcribe it; and the title, URL, and pin comments of a new capture, when “Choose the collection automatically” is on, and the content each session needs to generate its written reproduction steps. Pinar indexes your pins for search only while the assistant answers one of your messages, never in the background; the automatic collection choice uses the index that already exists. Vercel and the AI providers act as processors of Pinar and, for third-party data that you control, as subprocessors, and may process that content outside Brazil. For your own account data, the transfer is necessary to run the features you invoke under your contract with Pinar (Article 33, IX, combined with Article 7, V, of the LGPD). For third-party data in your content, it is up to you, as controller, to have a legal basis for using it with these features. Pinar does not request zero data retention, so the providers may retain the data from each request for the periods in their own terms. See Vercel's terms and privacy policy at https://vercel.com/legal.
5. Retention and deletion
Retention depends on plan, content type, legal duties, security needs, and account status. The current periods and recovery windows are described in the Data Retention Policy. AI assistant conversations in Pinar Cloud are kept until you delete them and become eligible for automatic deletion 90 days after their last message; the search data derived from a session is deleted with it. Backups and fraud, billing, tax, security, and legal records may remain for a limited period after deletion when required or reasonably necessary.
6. Security
We use measures designed for the nature of the service, including scoped tokens, access controls, origin validation, rate limits, encrypted transport, isolated production resources, and restricted provider access. No online system is completely secure. Contact us promptly if you believe your account or data was compromised. If a security incident may cause relevant risk or harm to the data subjects, we will notify the ANPD and the affected data subjects, as required by law.
7. Your rights
Subject to applicable law, you may request confirmation and access; correction; information about sharing; portability where regulated; anonymization, blocking, or deletion of unnecessary or unlawfully processed data; deletion of consent-based data subject to legal exceptions; information about consent choices; withdrawal of consent; and review of a decision based solely on automated processing that affects your interests. We may verify your identity before acting. Requests are free and may be sent to [email protected]. We will respond within the LGPD time limits. If you appear in content a customer sent to Pinar (for example, in a screenshot) and are not a user of the service, direct your request to the person who sent the content, who is the controller of that data. If you contact us, we will forward the request to the customer when we can identify them.
8. Children, changes, and complaints
Pinar is not directed to children. Do not submit a child's personal data without the authority and safeguards required by law. We will publish material changes and request renewed acceptance when legally or contractually necessary. You may also lodge a complaint with Brazil's National Data Protection Authority (ANPD) or another competent authority.