Privacy Policy

This Privacy Policy explains how Pinacall ("PINACALL", "we", "us" or "our") handles personal information when you use the PINACALL application, its dashboard and connected services. It applies to account holders, authorized team members and customers whose information is managed through the application. Our contact address is 55 Purana Paltan (Azad Center), Dhaka, Bangladesh.

We decide how information is used for our own account administration, support, security and billing. When a business uses PINACALL to handle its customer messages, leads, orders or appointments, that business generally decides the purposes of processing and we act on its instructions. The business's own privacy notice also applies to its handling of customer information.

• Account and business information: names, email addresses, phone numbers, organization details, user roles, authentication information, settings and support correspondence.
• Conversation and workflow information: messages, channel identifiers, customer contact details, submitted images, audio, attachments, lead details, delivery addresses, order information and appointment information. Business-provided knowledge and catalogs may also contain personal information.
• Integration information: connected account or page identifiers, authorized permissions, access credentials, calendar and commerce records, connection status and delivery metadata.
• Billing information: subscriptions, invoices, payment status and transaction references. Payment providers handle payment credentials according to their own privacy notices.
• Technical information: IP addresses, device and browser information, application activity, timestamps, diagnostic information, usage records and security events.

Information comes from users, authorized business team members, connected services and use of our service. We process images, audio and files when they are submitted or received through a connected feature. Where a mobile feature requires a device permission, its purpose is explained when permission is requested. Permissions can be managed through device settings; declining an optional permission may limit that feature.

We use information to operate accounts; route and answer messages; retrieve business information; capture leads and orders; coordinate bookings; enable human follow-up; maintain integrations; provide support; measure usage and billing; investigate errors and abuse; and meet applicable legal obligations. Service improvement must respect the restrictions on customer content and connected-platform data described below. Marketing messages must have a lawful basis and provide an applicable opt-out method.

Where a legal basis is required, it depends on the activity and may include providing an agreed service, consent, a legal obligation or a legitimate interest that does not override individual rights. Business customers are responsible for the lawful basis and notices for the data they ask us to process.

Relevant messages, business knowledge and submitted content may be processed by authorized AI, transcription or translation providers to produce replies, identify intent, extract requested details and support workflows. AI processing is part of the service and may require information to leave the device. Business users must review outputs where errors could affect a person.

We do not use customer content to train general-purpose AI models for unrelated customers without the appropriate notice and any required permission. This does not override the stricter Google-data restrictions below. Limited diagnostic or quality review must remain consistent with this policy, customer instructions and provider agreements.

PINACALL supports clinic administration and customer communication. It does not make final medical or other decisions with significant legal or similarly serious effects. Users should avoid submitting unnecessary health or other sensitive information. A business processing sensitive information must provide the required notice, obtain applicable consent and configure appropriate access controls.

Information is available to the relevant business and its authorized users according to their access rights. We use service providers for hosting, storage, AI processing, messaging, authentication, diagnostics, support and payments where applicable. Providers receive information needed for their role under appropriate obligations. Connected platforms receive information required for the functions the business authorizes.

We may also disclose information when legally required, to investigate fraud or protect rights and security, with your direction, or as part of a business transfer subject to applicable safeguards. We do not sell personal information. Independent platforms and business customers remain responsible for their own copies and uses of information.

Google Calendar

When Google Calendar is connected, PINACALL uses authorized calendar information to check availability and create, update or cancel requested appointments. PINACALL's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Google API data is not used for advertising or to train, develop or improve generalized AI or machine-learning models. Transfers are restricted to permitted purposes, such as delivering the connected user-facing feature, security or legal requirements. Human access is limited to the exceptions allowed by that policy, including affirmative permission for specific data, necessary security investigations, legal obligations, or aggregated and anonymized internal operations. These restrictions prevail over broader improvement or sharing language in this policy.

You can revoke Google access through your Google Account permissions. Revoking access stops future authorized access but does not itself erase existing PINACALL records or events in your calendar. Request deletion as described below.

Meta (Facebook, Instagram and WhatsApp)

Meta connections process authorized business account information and communications to provide connected messaging and workflow features. You can remove PINACALL in the relevant Meta app or business integration settings. Removing a connection and deleting stored data are separate actions. Our Account and Data Deletion Policy at https://pinacall.com/data-deletion explains how to request both.

We retain information while needed for the service, authorized customer instructions or legitimate legal, accounting, security and dispute purposes. Retention varies by category and applicable obligations; data is not kept indefinitely merely because an account existed.

When information is no longer needed, we delete it or irreversibly anonymize it. Verified deletion requests are handled without undue delay and within applicable legal deadlines. Residual backups are removed or overwritten through the applicable backup cycle. Information retained for a necessary legal, accounting, security or dispute purpose remains restricted until that purpose ends. We explain relevant retention exceptions and the expected completion period when responding to a deletion request.

We apply technical and organizational safeguards proportionate to the information and service, including access restrictions and secure handling of credentials and transfers. No system can guarantee absolute security. Users should protect credentials and limit access to authorized staff.

PINACALL operates from Bangladesh. Providers or connected services may process information in other countries. Where applicable, transfers require appropriate legal and contractual safeguards. A connection to an external service also remains subject to that service's privacy terms.

Depending on applicable law, you may request access, correction, deletion, portability or restriction of your personal information, object to certain uses, withdraw consent or complain to the relevant authority. Email support@pinacall.com with "Privacy Request" and enough information to identify the account or interaction. Do not send passwords, access tokens or unnecessary sensitive documents.

We may verify identity and authority using proportionate information. Where a business controls your conversation or transaction, contact that business; we will help route a request received by us and assist the business as appropriate. Consent withdrawal does not invalidate earlier lawful processing. Optional marketing can be stopped through its unsubscribe method or by contacting support.

Cookies

The website and application may use session storage or cookies for authentication, preferences and security. Any optional analytics or similar technologies must be disclosed and used with consent where required. Browser or device controls can limit storage, although essential features may stop working.

Children

PINACALL business accounts are intended for adults aged 18 or over. Businesses must not use the service to process children's information without the required authority, notices and safeguards. Contact us if you believe children's information has been handled improperly.

Policy changes

We will publish revisions to this policy and identify their effective date on the published page. Material changes will receive additional notice where required, and new consent will be requested when necessary.