Privacy Policy
Pinglide · Version 1.3 · Effective 5 November 2026
This policy explains how Marius Zakarauskas ("we", "us") processes personal data when you visit our website, create or use a Pinglide account, or contact us.
It does not cover the websites where our customers publish maps. When a map made with Pinglide is shown on a customer's website, that customer decides what is collected about the people using it, and is responsible for it; we process that data on the customer's behalf. §6 explains what that means if you used one of those maps.
1. Who is responsible
The controller is Marius Zakarauskas, individual activity certificate No. 1554078, Debreceno g. 8-10, Klaipėda, Lithuania.
Write to privacy@pinglide.com about anything in this policy. We have not appointed a data protection officer, because our core activities do not involve regular and systematic monitoring of people on a large scale (Article 37(1) GDPR). We will review that as the Service grows.
2. What we collect, why, and on what legal basis
"Legal basis" refers to Article 6(1) of the General Data Protection Regulation (GDPR).
| What we do | Personal data | Legal basis | How long we keep it |
|---|---|---|---|
| Run your account | Name, email address, password (stored only as a salted Argon2 hash, never readable), your Plan and account settings. If you choose "Sign in with Google" or "Sign in with GitHub": the account identifier, name and email address that Google or GitHub shares with us | (b) contract | For the life of your account, then as in §8 |
| Sign you in and keep accounts secure | Session records: IP address, browser, operating system, device type, country, and times. The sign-in cookie (see the Cookie Policy). Records of password-reset and email-confirmation requests. When you sign up or ask for a password reset, the signals Cloudflare Turnstile checks to tell people from automated programs: IP address and characteristics of your browser and device | (f) our legitimate interest in keeping the Service and accounts secure | Session records until the session ends or expires (at most 1 year); security records up to 12 months |
| Send service emails — confirming your address, resetting your password, and notices about your account, billing and changes to our terms | Email address, name, message content, delivery status | (b) contract; (c) legal obligation, for notices the law requires | Delivery logs as kept by our email provider, which deletes them automatically after a short period (currently 30 days) |
| Run our Shopify app | If you install Pinglide from the Shopify App Store, there is no sign-up: Shopify shares your store's name, its myshopify.com address and primary domain, Shopify's identifier for the store, and the store's contact email, and we read your Plan and subscription status from Shopify. We are given no access to your store's customers, orders or products | (b) contract | While the app is installed, then deleted as set out in §8 |
| Host what you put into the Service | Customer Content, which may include personal data such as contact names, phone numbers, email addresses and photos | We process it for our customer under our Data Processing Agreement. For your own details in it: (b) contract | As set out in §8 |
| Bill paid Plans | The Merchant of Record handles payment details — we never see card numbers. We receive: name, email address, company name, billing country and address, VAT number, Plan, amounts and subscription status. Plans bought through our Shopify app are billed by Shopify instead, and from Shopify we receive only the Plan, its billing period and its status | (b) contract; (c) accounting and tax law | Accounting records for 10 years, as Lithuanian accounting law requires; the rest for the life of your account |
| Answer support requests | Your messages, and anything you tell us in them | (b) contract; (f) our legitimate interest in helping users | 24 months after the last message |
| Operate our servers | Technical request logs: IP address, address requested, time, browser, error details | (f) our legitimate interest in running, securing and fixing the Service | As kept by our hosting provider, and no more than 12 months where we control it |
| Improve the Service | How our website and the dashboard are used: pages viewed, buttons pressed, errors, and the steps you take (signing up, creating a map, adding locations, publishing, paying), with browser, device type and approximate location derived from the IP address. Once you sign in — or open our Shopify app — this is linked to your account identifier, name and email address (for the Shopify app, your store's name and contact email), and records whether you came to us through our website or through Shopify | (f) our legitimate interest in understanding and improving the Service | For as long as our analytics provider retains it on our plan, and at most 7 years |
| Protect our legal position | Any of the above that is relevant to a claim, dispute or request from an authority | (c) legal obligation; (f) our legitimate interest in establishing, exercising or defending legal claims | As long as needed, up to the end of the applicable limitation period |
| Tell customers about product news | Name, email address | (f) our legitimate interest, for existing customers about similar services — or your consent. You can opt out in every email | Until you opt out |
We measure how our website and dashboard are used with PostHog, hosted in the European Union. It stores nothing on your device — no cookies, no local storage — so it forgets you when you reload a page, and only knows who you are while you are signed in. We use no advertising or cross-site tracking tools. Maps published on our customers' websites never load PostHog; what they measure, if the website owner switches it on, is described in §6.
We do not sell personal data. We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.
3. What happens if you do not give us data
Account and billing data are needed to provide the Service. Without them we cannot open an account for you or sell you a paid Plan.
4. Where the data comes from
From you; from Google or GitHub, if you sign in with one of them; from the Merchant of Record, when you buy a paid Plan; from Shopify, if you use our Shopify app; and from your browser, when you use our website and dashboard.
5. Who we share it with
Service providers that process data for us, under contracts that bind them to protect it:
| Provider | What for | Where | Safeguard for transfers |
|---|---|---|---|
| Appwrite Code Ltd. | Database, file storage, sign-in, backups | European Union — Frankfurt, Germany. Backups, where taken, are encrypted and kept in a separate location | EU hosting; EU Standard Contractual Clauses under Appwrite's data processing agreement for any access from outside the EEA |
| Appwrite Code Ltd. (Appwrite Sites) | Runs our website, the dashboard, and the endpoint that receives visitor measurement | European Union — Frankfurt, Germany | EU hosting; EU Standard Contractual Clauses under Appwrite's data processing agreement for any access from outside the EEA |
| Plus Five Five, Inc. (Resend) | Sending service emails | United States | EU Standard Contractual Clauses and the EU-US Data Privacy Framework |
| PostHog Inc. | Measuring how our website and dashboard are used, and reporting errors | European Union — Frankfurt, Germany | EU hosting; EU Standard Contractual Clauses under PostHog's data processing agreement for any access from outside the EEA |
| Geoapify GmbH | Placing addresses you import on the map, and calculating routes you draw | Germany and Finland | European Economic Area |
| Cloudflare, Inc. | Storing and delivering published map files; checking that sign-up and password-reset requests come from people (Turnstile) | Global network; United States company | EU Standard Contractual Clauses and the EU-US Data Privacy Framework |
Independent controllers, whose own privacy policies apply:
- Google — if you choose "Sign in with Google".
- GitHub, Inc. — if you choose "Sign in with GitHub".
- Link, LLC (formerly Lemon Squeezy LLC), trading as Lemon Squeezy — sells paid Plans and processes payments.
- Shopify — if you use our Shopify app: it runs your store and the Shopify admin the app opens in, tells us who you are when you open it, and bills the app's paid Plans.
- OpenFreeMap (Hyperknot Software Kft., Hungary) — serves the map tiles your browser downloads to draw a map, both in our dashboard and on Published Maps. Each request necessarily carries your IP address. Its privacy policy states that it does not log IP addresses, except temporarily when investigating an attack or misuse.
Others:
- professional advisers — lawyers, accountants and auditors — under a duty of confidentiality;
- courts, authorities and law enforcement, where the law requires it or where it is needed to protect our rights;
- a buyer, investor or successor in a merger, acquisition, financing, reorganisation or sale of all or part of our business, who may continue to use the data under this policy.
6. If you used a map on one of our customers' websites
-
The owner of that website is responsible for data collected about how you used its map. Read their privacy notice and send requests to them. If you write to us instead, we will pass your request on to them.
-
The map sets no cookies and stores nothing in your browser.
-
To draw the map, your browser downloads the map file and photos from our providers, and map tiles from OpenFreeMap. Those requests carry your IP address, as every request on the internet does.
-
"Find nearest" uses your location on your own device. Your position is not sent to us.
-
Only if the website owner has switched on visitor measurement, we record the following on the owner's behalf, once per page view:
- your IP address;
- your approximate location — country, city and coordinates — where our hosting network derives them from your IP address (never GPS);
- the website and page where the map was shown, and the page you came from;
- whether you used a desktop, tablet or mobile device;
- what you did in the map: that it loaded; which locations, shapes and groups of pins you opened; what you typed in its search box and how many results it found; which suggestion you picked; and whether you pressed directions, phone, email, website or "find nearest" — with timings.
No identifier is stored on your device. Each page view gets a new random identifier that exists only inside that page.
-
On a Shopify store, measurement also follows the store's privacy settings and your choice in its cookie banner. The map asks Shopify whether analytics is allowed for you before sending anything, and sends nothing if the answer is no, or if the store gives no answer. Nothing recorded before you agree is sent afterwards.
-
Individual records are kept for 30, 180 or 365 days, depending on the website owner's Plan, and are then deleted automatically, at most a day late. Daily statistics made from them — counts per location, search term, country, device, referring website and page, with positions rounded to about 11 km — contain no IP addresses, and are kept until the owner deletes the map or their account.
-
If your details appear in a customer's map — for example as the named contact for a shop — that customer is responsible for them. Contact the customer; if you write to us, we pass it on.
7. Transfers outside the European Economic Area
We keep personal data in the European Economic Area wherever we can. Where a provider processes it elsewhere, we rely on an adequacy decision of the European Commission — including the EU-US Data Privacy Framework, for certified US companies — and on the European Commission's Standard Contractual Clauses (Decision 2021/914), so that a safeguard remains even if an adequacy decision is withdrawn. You can ask for a copy of the safeguards at privacy@pinglide.com.
8. How long we keep data
The periods for each kind of data are in §2. When an account ends, you may ask for an export for 30 days; we then delete account data and Customer Content within the following 60 days, and backup copies expire no later than 30 days after that (Terms of Service §13.7). The exceptions are accounting records, which we keep for 10 years, and data needed for a legal claim, which we keep for as long as the claim requires.
If you use our Shopify app, uninstalling it is how the account ends. Shopify tells us to delete your store's data 48 hours after you uninstall the app, and we then delete the account, its Customer Content and the store details from §2, without the 30-day export window above. Reinstalling within those 48 hours brings everything back. Accounting records are kept as above.
An account whose email address is not confirmed within 7 days of signing up is deleted automatically, together with everything stored for it. Until an address is confirmed, the account cannot create anything, so nothing of yours is lost; you can sign up again at any time.
9. Your rights
You have the right to:
- access the personal data we hold about you, and receive a copy;
- correct it if it is wrong;
- erase it;
- restrict our processing of it;
- receive the data you gave us in a portable format, and have it sent to someone else;
- object to processing based on our legitimate interests — and to direct marketing at any time, in which case we stop;
- withdraw consent at any time, where we rely on consent, without affecting what we did before.
To use these rights, write to privacy@pinglide.com from the email address on your account, or tell us how to confirm who you are. We answer within one month. For complex or numerous requests we may take up to two further months, and will tell you if we do. It is free, unless a request is manifestly unfounded or excessive.
You can delete your account yourself, in Settings → Account → Delete account. That deletes your account data and Customer Content straight away rather than after the periods in §8, and backup copies expire as §8 says. You can also write to us, and we delete it as set out in §8.
You also have the right to complain to a supervisory authority. In Lithuania that is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, 10312 Vilnius, ada@ada.lt, vdai.lrv.lt. You may instead complain in the EU country where you live or work. We would be grateful for the chance to put things right first.
10. Security
We protect personal data with measures including: encrypted connections (HTTPS); passwords stored only as salted Argon2 hashes; sign-in cookies that scripts cannot read; administrative credentials kept on servers only; access limited to people who need it; and a primary database hosted in the European Union. No system is completely secure. If a breach puts your rights at risk, we will tell you and the authorities as the law requires.
11. Children
Pinglide is a service for businesses. It is not directed at anyone under 18, and they may not create an account. We do not knowingly collect their data.
12. Changes to this policy
We may update this policy. If we make a significant change, we tell account holders by email or in the dashboard before it takes effect. The version and effective date are at the top of this page. Earlier versions are available on request.
13. Contact
Marius Zakarauskas · Debreceno g. 8-10, Klaipėda, Lithuania · privacy@pinglide.com