Privacy policy

Your account data. We decide why and how the details you give us to open and run your account are used. For this data we are the Data Fiduciary under the DPDP Act.

Your workspace data. Your business decides whom it messages and what it sends. For the contacts, conversations and files in your workspace, your business is the Data Fiduciary. We process that data on its behalf, only to run the service and following its instructions in the app.

If you received a message from a business that uses Pinnaki, that business decides how your data is used, so contact it first: it can answer your request and remove you from its lists. You can also stop its marketing messages by replying with its opt-out keyword, or by turning off marketing messages from it in WhatsApp.

• Account: your name and work email, your phone number if you add it, and the company details you give at sign-up (company name, size, industry and website).
• Sign-in and security: your password, stored only as a bcrypt hash, and the IP address of your latest sign-in, which we use to email you when your account is signed in from a new address.
• Workspace content: the contacts you import or receive with their attributes and tags, the messages sent and received, media and files, templates, campaigns, flows, saved replies, and the documents you add to an AI agent’s knowledge base.
• Connected accounts: the IDs and access tokens of the WhatsApp, Instagram, Messenger, Telegram, Google, store and other accounts you connect.
• Billing: your wallet balance, top-ups, charges, invoices and billing email. Top-ups are paid on Razorpay; we receive the result of the payment, not your card or bank details.
• Activity: who in your team assigned, transferred or resolved a chat, and the delivery status of each message, used for your reports.

We use personal data to:

• provide the service: send and receive messages, run campaigns, flows and AI features, keep Live Chat in step with each channel, and show reports;
• bill for it: charge the wallet, renew plans and issue invoices;
• contact you about your account: email verification, password resets, sign-in alerts, renewal reminders and low-balance alerts;
• keep the service secure and prevent abuse, for example by limiting how fast requests can be made;
• meet legal duties, such as keeping tax records.

We never sell, rent or monetise your data or your contacts, we do not use them to show you advertising, and we do not use your workspace content to train AI models.

When you create an account, you consent to us processing your account data for the purposes in section 4. You can withdraw that consent at any time by deleting your workspace (section 8); withdrawing does not affect processing that happened before.

Some data we keep because the law requires it, such as billing and tax records (section 7). The DPDP Act allows this without consent.

If you use Pinnaki to message people, you are responsible for having a lawful basis to do so, usually their opt-in consent, as our terms of service require.

Data passes through these services, only as far as each one needs to do its part:

• Meta Platforms, to send and receive WhatsApp, Instagram and Messenger messages and, when you connect them, for catalogues, ads and conversion events;
• Telegram, to send and receive messages through your bot;
• Razorpay, to take wallet top-ups;
• Google, when you connect Google Sheets, Google Contacts or Google Ads;
• the AI provider in use (Google Gemini, OpenAI or Anthropic), when AI features run, either with your workspace’s own key or with ours;
• the stores and tools you connect yourself, such as Shopify, WooCommerce, Shiprocket, Petpooja or your own webhooks, which receive the data you choose to send them;
• our email delivery, hosting and file storage providers, which will be listed here once confirmed.

We disclose data to public authorities only when the law requires it. Some of these providers process data outside India, and their own terms and privacy policies apply to that processing.

• Account and workspace data: while your workspace is open, then deleted as described in section 8.
• Messages: deleted automatically 5 years after they were sent or received, or earlier when the workspace is deleted.
• Campaign delivery logs: 90 days.
• Billing records (the wallet ledger, top-ups, invoices, the workspace name and the billing email): kept after the workspace is deleted, because tax and accounting law requires us to keep them.
• IP addresses recorded with administrative actions on a workspace: cleared one year after the workspace is deleted.
• Temporary copies in our internal message queues: deleted within 30 days.

An admin or manager can close the workspace from its settings in one of two ways:

• Deactivate: the workspace is paused and its data is kept, so it can be reactivated later.
• Delete: deletion is scheduled after a grace period, 14 days by default, during which it can be cancelled. When the grace period ends, contacts, messages, files, connected accounts and settings are erased, and the workspace’s user accounts are anonymised. Billing records are kept (section 7).

Deletion cannot be requested while invoices or wallet debt are unpaid. Any wallet balance left at deletion is forfeited; the app asks you to confirm this before you delete.

The app sets two cookies that scripts in the browser cannot read: one keeps you signed in for up to 8 hours, the other renews your session for up to 7 days. It also keeps small settings in your browser’s storage, such as the light or dark theme.

The website stores only your light or dark theme choice in your browser. Neither the app nor the website uses advertising or analytics trackers.

Passwords are stored as bcrypt hashes. Access tokens for the accounts you connect are encrypted with AES-256-GCM before they are stored, and developer API keys are kept only as hashes. Messages from Meta are accepted only with a valid signature. Everyone in a workspace is an admin, a manager or an agent, and sees what that role allows.

More detail is on the security page.

No system is completely secure. If a breach affects your personal data, we will inform you and the Data Protection Board of India as the DPDP Act requires.

Under the DPDP Act you can:

• get a summary of the personal data we process about you and of the services we share it with;
• have it corrected, completed or updated; you can change most account details yourself in your profile;
• have it erased, by deleting your workspace or by asking us, except data the law requires us to keep;
• nominate another person to exercise these rights for you if you die or become unable to;
• have a grievance handled by us and, if you are not satisfied, complain to the Data Protection Board of India.

Write to support@pinnaki.com from the email address of your account, so that we can confirm it is you. If your data is in a business’s workspace, we will refer you to that business, which decides on it (section 2).

Pinnaki is a service for businesses and is not meant for children. You must be at least 18 to create an account. If you message people under 18 through Pinnaki, you are responsible for the verifiable consent of a parent or guardian that the law requires.

We may update this policy when the service or the law changes. The date at the top shows the current version. We will email account admins about important changes before they take effect.

For privacy questions, data requests or complaints, write to support@pinnaki.com.

The name and contact details of our grievance officer under the DPDP Act will be published here after legal review. Until then, the address above reaches the people who handle grievances.