Privacy policy

Last updated: October 2026

1. Controller

The controller responsible for Pinpap is:

René Kubitzek
Neumoorland 2
21147 Hamburg
Germany

Email: kontakt@pinpap.de

2. General information

Pinpap processes data for buying advice, user accounts, handling messages, security and improving the service. Pinpap does not use advertising trackers or external analytics or session-recording tools and does not create personal advertising profiles. Internal usage and quality analyses take place. A consultation does not automatically lead to a purchase.

3. Use without an account / guest consultations

Buying advice is available without a user account. We store the search text, requirements and answers entered, as well as structured criteria, follow-up questions, product recommendations and result states. A technical session association enables access to your guest consultation and protects it against unauthorised access.

Guest consultations are normally stored for operational use until cleanup after 90 days from creation. Cleanup then removes the previous guest, session and user associations and transfers content to a separate analysis dataset. The previous guest consultation is then no longer accessible through the session. Cleanup runs in limited batches through the central scheduler; its regular operation is a prerequisite, so processing may take place after the retention period has elapsed.

Detached analysis content is fully deleted during scheduler cleanup 24 months after detachment, including any free text and individual result states. Known technical identifiers are removed; this does not automatically make free text fully anonymous. Personal information you entered may still be present. Please do not enter unnecessary personal or particularly sensitive information. Detachment and de-identification do not guarantee full anonymisation.

4. User account

An account stores an email address, a password exclusively as a hash, verification and activation status, roles and technical timestamps. Verification and password-reset tokens are stored as hashes. Personal consultation history generally remains while the account exists; no automatic retention period is currently configured for it.

When an account is deleted, personal account data and account/history associations are removed. Consultation content may remain detached in the analysis dataset. Free text is therefore not guaranteed to be fully anonymous. Associated feedback email addresses and account associations are removed. This does not fully delete message content. Necessary administrative references may remain through disabled placeholders that can no longer log in; personal account details are replaced there.

5. Buying advice and OpenAI

Pinpap uses the OpenAI API for semantic interpretation of natural language. Search text, relevant answers and necessary consultation/product context may be transmitted to OpenAI for this purpose. Email addresses and user IDs are not intentionally included as account metadata in the advice request; personal information you enter may nevertheless be transmitted. Please do not enter unnecessary personal or particularly sensitive information. Selection and ranking then take place in the backend according to product data and rules.

For customers in the EEA, the current OpenAI DPA specifies OpenAI Ireland Ltd. as the contracting party. API content is not used for model training by default unless data sharing is enabled. With the standard API configuration, inputs and outputs may be retained in abuse-monitoring logs for up to 30 days; exceptions for legal or security reasons are possible. Pinpap uses store=false for Responses calls and thus does not request storage of the response state. This does not replace a Zero Data Retention agreement; no such arrangement is promised.

OpenAI may use affiliates and subprocessors outside the EEA. The DPA provides for adequacy decisions or standard contractual clauses for this purpose. Processing exclusively in the EU is not promised.

Provider information: https://openai.com/policies/data-processing-addendum/ and https://developers.openai.com/api/docs/guides/your-data

6. Contact and feedback form

We process the message, message type, timestamp and handling status, an optionally provided email address and, where applicable, the account and associated consultation state. Technically necessary security information helps prevent abuse. Message types are bug reports, feature requests, praise and partnership enquiries. Messages are stored in the backoffice and forwarded internally by email for handling. An email address you provide may be used as the reply address. The public contact address is kontakt@pinpap.de.

Bug reports, feature requests and praise are deleted 180 days after the last activity; partnership enquiries are deleted after 12 months. In the application, the last activity is creation or a recorded status change in the backoffice. Database cleanup takes place automatically when the central scheduler runs.

Email copies follow the same internal retention rule from the last activity in the mailbox. Pinpap cannot delete mailbox content through SMTP. Compliance must therefore be organised administratively; automatic mailbox deletion is not claimed. SMTP delivery through united-domains is configured in production and delivery has been tested successfully. Where an enquiry leads to separate contractual or business documents subject to statutory retention duties, the statutory periods apply to those separately managed documents.

7. Security and abuse prevention

Rate limiting and technical security logs protect operation. Short-lived pseudonymised, HMAC-based keys help prevent abuse. Redis stores time-limited counters and technical associations, not complete consultation prompts. Short-lived hashed account limits in the database and CSRF protection are also used.

Processing attempts may contain search text or answers, status, error class, execution time and technical associations. They are normally deleted after 30 days during scheduler cleanup. Local AI usage data, such as model, token counts and estimated costs, supports operational and cost control.

Cloudflare Turnstile is disabled by default.

8. Cookies and local storage

Pinpap uses technically necessary session cookies for guest association, login and security features. The PINPAP_SESSION cookie is configured for the browser session; actual storage may depend on browser settings. The language preference may be stored through the locale functionality. Pinpap does not use advertising cookies or external analytics cookies.

In sessionStorage, Pinpap stores the current consultation state under pinpap:search, including search text, answers, budget and notes, result state and draft answers. This supports the ongoing consultation and its restoration after reloading in the same tab. Starting a new consultation replaces the previous state; resetting the consultation, logging out, a detected session expiry or an account change clears it. Account deletion also clears this state. No separate expiry period is configured. sessionStorage is tied to the tab session; restoring closed tabs may depend on browser settings.

The following information is stored in localStorage:

pinpap-theme: the selected light or dark appearance. The selection is stored when the appearance is changed.
pinpap:prefs: Local switch preferences from earlier account settings may remain in the browser. The previous price-alert and summary switches are not currently offered; these preferences do not create an email subscription.
pinpap:account-change: the time of a login, logout or account deletion as a signal for other open tabs. They then reset their consultation state and reload account information. The key contains no email address or account identifier and is overwritten on subsequent account changes.
pinpap-storage-notice-dismissed: remembers that the storage notice should remain hidden after it is closed.

These localStorage entries have no automatic expiry or deletion period. They remain until deleted by the browser or through its settings and are overwritten when changed. Logging out or deleting an account does not remove the theme, toggle preferences or hidden-notice preference; the account-change signal is updated. Personal account history is managed on the server.

Storing the appearance, toggle preferences and hidden-notice preference serves convenience features. The consultation state and account-change signal support the consultation or synchronisation between open tabs. This does not promise that all storage access is strictly necessary for the core advice function. Closing the storage notice is not consent to further storage access. Deleting local browser data does not automatically delete server-side consultations or the user account.

9. Product images and external content

Some product images are loaded directly from external merchant and product-data servers and CDNs whose URLs come from product/offer data, such as Awin feeds or Icecat data. Fetching them may transmit the IP address and necessary request information to the respective image host. The specific host depends on the product displayed. A complete list of all product-dependent image hosts is not currently defined.

10. Merchant links / demo mode

Pinpap publicly operates in demo mode. Available merchant links lead to the respective product page; Pinpap does not provide affiliate/publisher tracking as a public merchant call to action in demo mode. Pinpap receives no affiliate commission through these demo links. If a link format does not provide a safe product address without tracking, no such merchant link is shown.

Imported offer data may still contain affiliate tracking data internally. Output is prepared on the server for current and saved consultations; the imported URLs remain unchanged. After a click, the merchant's data processing applies. Pinpap makes no statement about the merchant's own cookies or tracking methods.

11. Server logs / hosting

Production logs controlled by Pinpap are retained for 14 days and automatically rotated and cleaned up. Our access logs contain only a timestamp, a broad endpoint group, HTTP method, status, data volume and duration. They contain no IP addresses, full URLs, query strings, headers, cookies, session identifiers or request bodies. Error logs support technical diagnosis and may contain necessary connection and error information.

Application hosting: Contabo GmbH, Welfenstraße 22, 81541 München, Germany. The server was ordered in an EU region. This does not promise a specific data-centre location in Germany.

For domain and email services, Pinpap uses united-domains GmbH, Gautinger Straße 10, 82319 Starnberg, Germany. A data processing agreement with united-domains is in place; under this agreement, processing takes place exclusively within the EU. united-domains uses subprocessors for these services. The Pinpap application is hosted by Contabo.

The domain and email services used at united-domains are subject to contractual protection and deletion rules: certain technical logs are pseudonymised, IP addresses are shortened, or logs are deleted after 7 days. This is not a uniform retention period for all provider logs and does not describe log retention at Contabo. Pinpap's own 14-day log retention period applies independently.

Provider-side email backups at united-domains are separate from backups of the Pinpap application: under the agreement, united-domains creates daily encrypted backups and checks restoration. Email data is automatically deleted after the contract ends; the corresponding provider backups are generally removed no later than 14 days after termination or deletion of the original data. These statements do not concern backups of the application operated at Contabo.

12. Legal bases

Providing expressly requested advice and account features and handling corresponding requests is based on Article 6(1)(b) GDPR. Security, abuse prevention and error diagnosis are based on Article 6(1)(f) GDPR; the legitimate interest is a secure, functioning service. Other messages may be handled on the basis of Article 6(1)(f) GDPR, with the interest in responding to incoming enquiries. Internal quality improvement serves the interest in understandable, reliable recommendations.

Detached internal quality analyses are based on Article 6(1)(f) GDPR; the legitimate interest is improving the clarity and reliability of the buying adviser.

13. Retention periods

Guest consultations: normally 90 days of operational association from creation, followed by cleanup through the scheduler.
Processing attempts: normally deleted after 30 days through the scheduler.
Account data and personal history: generally while the account exists, subject to account deletion or the purpose otherwise ceasing to apply.
Verification tokens: valid for 24 hours; password-reset tokens: valid for 30 minutes. Used tokens are removed; expired tokens are deleted during cleanup.
Detached analysis content: 24 months from detachment, followed by full deletion through the scheduler. No general automatic deletion period is currently configured for technical AI usage data.
Feedback database: bug reports, feature requests and praise for 180 days; partnership enquiries for 12 months, in each case from the last recorded activity.
Email copies: the same periods as an operational rule to be followed administratively; no automatic mailbox deletion by Pinpap.
Our production logs: 14 days, with automatic rotation and cleanup.
Provider logs and email-provider backups at united-domains: the separate contractual rules described above; these are not equivalent to Pinpap's own retention periods or application backups at Contabo.

A token's validity period is not the same as its immediate physical deletion. Depending on the storage type, local browser data remains until the session ends or until deleted by the browser or the respective feature.

14. Rights of data subjects

Subject to the legal requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. Where applicable, you may object and withdraw consent with effect for the future. You may lodge a complaint with a data protection supervisory authority. Please send enquiries to kontakt@pinpap.de.

15. Automated decisions

Pinpap generates product recommendations algorithmically. The service does not make automated decisions with legal or similarly significant effects within the meaning of Article 22 GDPR. Recommendations are a decision aid; you decide whether to buy.