How to read this document. It describes how Pinevon and Anchor are built and operated today. If a sentence is unclear or you think it does not match what you see in the product, write to legal@pinevon.com and we will answer and correct it. Before a material change takes effect we publish the new version here with a new version number and effective date.
1. Who is responsible for your data
Pinevon (“we”, “us”) is the controller of personal data described in this policy for pinevon.com and the Pinevon account. For data a business customer puts into a Pinevon product such as Anchor (for example its customers and orders), the business is the controller and Pinevon is its processor under the Data Processing Addendum.
Pinevon is operated as a sole proprietorship based in Bangladesh. As a matter of policy we do not publish registration numbers, tax identification numbers or the registered address on this website. Any such identifiers are kept in our private company records.
Customers, partners, payment providers and authorities that need these details can request them at the legal contact below, and we will provide them through an appropriate channel.
“Pinevon”, “we” and “us” in these documents refer to the individual who operates Pinevon as a sole proprietorship in Bangladesh.
Privacy contact: privacy@pinevon.com.
2. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account | Email address, sign-in method, verification status, security events (sign-ins, password changes, enrolled factors). Passwords are handled by our authentication provider and are never visible to us. | You / provider |
| Profile | Display name, avatar, language and region preferences you choose to set. | You |
| Support and contact | Name, email, phone, company, message, topic and any attachment you send; a ticket reference and status. | You |
| Assistant conversations | The messages you send to the Pinevon Assistant and its replies during the conversation. | You |
| Events, newsletter and inquiries | Event registrations (name, email, optional company and role, consent time, email delivery status), "Notify me" requests for a single event, newsletter subscriptions (email, chosen topics, consent and confirmation times, unsubscribe or suppression status) and design-partner inquiries (name, work email, company, size, industry and your description). | You |
| Usage and diagnostics | Page visited, referrer, coarse device and country signal, app version, service-worker and connectivity state, error reports. No cross-site identifier and no advertising profile. | Your device |
| Payments (paid products) | Plan, status, invoice history and the provider’s customer reference. Card details go to the payment provider, not to us. | You / provider |
| Technical and security | IP address, user agent, timestamps and request identifiers in server logs and audit records, used to secure the Services and investigate abuse. | Your device |
3. Why we use it (purposes and legal bases)
- Provide the Services you asked for — create and secure your account, deliver features, answer support requests (performance of a contract).
- Keep the Services secure and prevent fraud and abuse — rate-limiting, audit trails, incident response (legitimate interests, and legal obligation where applicable).
- Understand and improve the Services using cookieless aggregate usage data (legitimate interests).
- Send service messages such as verification, security alerts, billing notices and replies to your requests (contract / legitimate interests). The Pinevon newsletter is sent only to people who confirmed a subscription by email (consent), always has an unsubscribe link and a link to choose topics, and is never sent because you merely have an account or registered for an event.
- Comply with law, enforce our Terms and establish or defend legal claims (legal obligation / legitimate interests).
- Where the law requires consent for a purpose, we ask for it and you can withdraw it at any time.
We do not sell personal data, we do not share it for third-party advertising, and we do not use it for automated decisions that have legal or similarly significant effects on you.
4. AI processing
When you message the Pinevon Assistant, the conversation is sent to an AI provider we have configured to generate the reply. We send only what is needed for the conversation, not unrelated account data. Providers may include Google (Gemini), Groq, OpenAI and Anthropic depending on availability; each processes the request under its API terms and, under those terms, does not use API inputs to train its general models. See the AI Use Policy.
5. Who we share data with
We share personal data only with providers that help us operate the Services (see the Subprocessors list), with professional advisers under confidentiality, with authorities where legally required, and in a business transfer such as a merger (with notice to you). Providers act on our instructions and may not use the data for their own purposes.
6. International transfers
Our providers may process data in countries other than yours, including the United States and the European Union. Where required we rely on appropriate safeguards such as standard contractual clauses or the provider’s certified transfer mechanisms.
7. How long we keep data
| Data | Retention target |
|---|---|
| Account and profile | While your account is active; deleted when you delete your account, subject to the exceptions below. |
| Support tickets and attachments | 24 months after the ticket is resolved or closed, then deleted automatically (including any attachment). |
| Read notifications | Deleted automatically 12 months after being read. |
| Assistant conversations | Kept only while needed to answer the conversation; not used for training. |
| Cookieless usage records | Up to 14 months; deleted automatically every day. |
| Security and audit logs | Kept while needed for security, integrity and legal purposes. These logs are append-only and are not currently deleted automatically. |
| Event registrations and "Notify me" requests | Kept while needed to run the event and follow up, then until you ask us to delete them. They are not yet deleted automatically. |
| Newsletter subscriptions | Until you unsubscribe. We then keep a minimal record of the address and its unsubscribed or suppressed status so that we do not email you again. |
| Job applications and resumes | While your application is being considered and afterwards until you ask us to delete it (you can, at any time). Automatic deletion of declined or withdrawn applications after a fixed period is built but not yet switched on. |
| Invoices and tax records | As long as tax and accounting law requires. |
These are the periods we work to. Deletion of cookieless usage records, support tickets (with their attachments) and read notifications is automated and runs daily; other categories are reviewed periodically. We may keep data longer where needed to comply with law, resolve disputes or enforce agreements. Backups age out on their normal cycle.
8. Your rights and choices
Depending on where you live you may have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, to withdraw consent, and to complain to a data-protection authority. You can view and edit your profile in Settings, and delete your account and its data yourself — see how to delete your data. For anything else email privacy@pinevon.com. We may need to verify your identity first and will respond within 30 days (or the period the law sets).
We do not discriminate against you for exercising these rights.
9. Security
We protect personal data with encryption in transit, access controls enforced in the database as well as the application, least-privilege staff access, audit logging of sensitive actions and separation between products. No system is perfectly secure. If a breach affects your data we will notify you and the relevant authorities as the law requires. Report vulnerabilities via our Security Disclosure Policy.
10. Cookies and similar technologies
See the Cookie Policy. In short: we set only essential cookies and local storage needed to keep you signed in and remember your preferences; we do not run advertising or cross-site tracking.
11. Children
The Services are not directed to children and are not intended for anyone under 18. We do not knowingly collect personal data from children; if you believe we have, contact us and we will delete it.
12. Changes
We will post updates here with a new version number and, for material changes, notify you before they apply.