Privacy Policy

This Privacy Policy explains how pinacall, trading as "Pinacall", of 55 Purana Paltan (Azad Center), Dhaka, Bangladesh ("Pinacall", "we", "us", or "our"), collects, uses, shares, retains, and protects personal data through pinacall.com and the Service.

It applies to Customers, prospective Customers, dashboard users, website visitors, support contacts, and people who communicate with a Customer through a channel connected to Pinacall (end users).

A Customer may provide an additional privacy notice describing its own purposes and practices. That Customer notice controls the Customer's independent use of personal data.

Pinacall is generally a data controller for information used to manage accounts, billing, website operation, sales, security, support, legal compliance, and our business relationship.

For conversations, contacts, appointments, orders, and other personal data that we process only on a Customer's instructions, the Customer is generally the controller and Pinacall is its processor/service provider.

Contact the relevant business first if your request concerns a conversation or transaction with that business.

Depending on how the Service is used, we may collect:

Account and business data

Name, role, email, phone number, organisation, address, industry, login and team details, preferences, and verification information.

Customer Content and end-user data

Names, social or platform identifiers, phone numbers, email addresses, messages, voice notes, images, files, inquiries, appointment details, order information, preferences, support history, and any information entered into forms, prompts, knowledge bases, or conversations.

Sensitive data

Health symptoms or service interests and other sensitive information may appear when a Customer uses Pinacall in healthcare or another regulated context.

Customers must configure and use the Service lawfully and minimise such data.

Integration data

Page, account, calendar, phone-number, webhook, API, access-token, permission, template, delivery, and connection metadata from services you choose to connect.

Billing and transaction data

Plan, credits, usage, invoices, payment status, currency, tax and transaction references.

Full payment-card details are generally handled by authorised payment providers rather than stored by Pinacall.

Technical and usage data

IP address, device and browser information, identifiers, timestamps, login and audit events, feature use, message and model usage, token or credit consumption, diagnostics, crash data, and security logs.

Communications and feedback

Support requests, demos, survey responses, complaints, recordings where notified, and correspondence with us.

Cookies and similar technologies

Session, security, preference, performance, and analytics information as described in Section 12.

We collect data:

• directly from you;
• from the Customer whose AI agent or channel you contact;
• from authorised team members;
• from connected services such as Meta, WhatsApp, Facebook, Instagram, Google, calendars, websites, commerce tools, or webhooks;
• from payment and identity providers; and
• automatically from use of the Service.

We may also receive business contact information from lawful public or commercial sources for sales and security purposes.

Subject to applicable law and our role, we use personal data to:

• create and administer accounts, authenticate users, provide features, route messages, run AI agents, manage appointments or workflows, and maintain integrations;
• follow Customer instructions and generate, classify, translate, summarise, or retrieve content needed for an interaction;
• measure credits and usage, process payments, issue invoices, manage subscriptions, and prevent billing abuse;
• provide support, demos, onboarding, notices, service communications, and requested marketing;
• monitor reliability, debug errors, improve usability and language performance, and develop features using aggregated, de-identified, or otherwise lawfully processed data where practicable;
• protect accounts, detect fraud, spam, abuse, security threats, and violations, and enforce our agreements; and
• comply with law, lawful requests, tax and accounting requirements, and establish, exercise, or defend legal claims.

Depending on the context, processing is based on consent, performance of a contract, compliance with law, protection of vital interests, public interest, or legitimate interests that are not overridden by individual rights.

Where we act as processor, we rely on the Customer's instructions and lawful basis.

Customer Content may be sent to authorised AI model, transcription, translation, or infrastructure providers to generate or support requested output.

Automated processing may classify intent, draft replies, extract contact or appointment details, summarise conversations, route requests, and flag items for human follow-up.

Pinacall does not make final medical, legal, credit, employment, insurance, or similarly high-impact decisions about end users.

Customers must use meaningful human review where decisions could significantly affect a person.

We do not use Customer Content to train a general-purpose AI model for unrelated customers unless we first provide appropriate notice and obtain any consent required by law or contract.

We may use limited data for security, diagnostics, quality assurance, and Service improvement as described here and in the applicable agreement.

We do not sell personal data.

We may disclose it only as reasonably necessary to:

• the Customer and its authorised users, according to account permissions and Customer instructions;
• cloud hosting, database, AI model, communications, analytics, support, security, identity, payment, and professional service providers under appropriate obligations;
• connected platforms such as Meta, WhatsApp, Facebook, Instagram, Google, calendar, commerce, or webhook services selected by the Customer;
• law-enforcement, regulators, courts, government bodies, or other parties where required by law or reasonably necessary to protect rights, safety, security, or prevent fraud;
• a buyer, investor, lender, adviser, or successor in a merger, financing, restructuring, acquisition, insolvency, or sale, subject to appropriate confidentiality and legal safeguards; or
• another party with the individual's direction or consent.

Pinacall is based in Bangladesh, but authorised providers and connected platforms may process data in other countries.

Those countries may have different privacy laws.

Where required, we use contractual, technical, organisational, consent-based, or other lawful safeguards for cross-border transfers and limit transfers to what is necessary for the Service.

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Service, follow Customer instructions, maintain security and audit records, resolve disputes, and meet legal, tax, accounting, and platform obligations.

Retention depends on data type, account status, plan, Customer settings, sensitivity, risk, and legal requirements.

When data is no longer required, we delete, de-identify, or securely isolate it.

Deletion from active systems may not immediately remove encrypted backups, logs, fraud-prevention records, or data that we must keep by law; those records are protected and removed or overwritten according to applicable retention cycles.

A Customer may have independent retention duties and may retain copies outside Pinacall.

We use reasonable technical and organisational measures designed to protect personal data, which may include encryption in transit, access controls, authentication, logging, environment separation, backups, vendor review, and incident response.

Security depends partly on Customers and users: protect credentials, restrict team access, review integrations, minimise data, and promptly report suspicious activity.

No internet service is completely secure, and we cannot guarantee absolute security.

Subject to applicable law and verification, an individual may request:

• information about processing;
• access to or a copy of personal data;
• correction;
• deletion;
• restriction;
• objection;
• withdrawal of consent; or
• portability where available.

A person may also complain to the competent authority.

Withdrawing consent does not affect processing already lawfully completed and may prevent continued use of some features.

For data controlled by a Pinacall Customer, contact that Customer first. We will assist the Customer as required.

For Pinacall-controlled data, email support@pinacall.com with the subject "Privacy Request".

We may request information to verify identity and authority, and may retain a record of the request.

Rights can be limited where an exemption or overriding legal obligation applies.

We use strictly necessary cookies or local storage for login, session continuity, security, load balancing, and preferences.

We may use performance or analytics technologies to understand website and dashboard use.

Where law requires consent, non-essential technologies should remain disabled until consent is given.

Browser controls can block cookies, but required features may stop working.

The website should display a cookie notice identifying the actual non-essential tools in use.

We may send product news, offers, or event information where permitted by law.

You may opt out using the message instructions or by contacting us.

We may still send non-marketing communications about security, billing, account status, policy changes, or requested support.

Customers are responsible for consent and opt-out compliance for marketing they send through Pinacall.

The Service is not directed to children under 18 as account holders.

Customers must not intentionally use Pinacall to collect or process children's personal data without lawful authority, appropriate notice, verifiable parent or guardian consent where required, and suitable safeguards.

If you believe children's data has been processed improperly, contact us promptly.

Connected platforms, external websites, payment providers, and other third-party services have their own privacy practices.

Pinacall does not control those independent practices.

Review their notices before connecting or using them.

Removing an integration from Pinacall does not automatically close the third-party account or delete data held independently by that provider.

If you connected Facebook or Instagram to Pinacall, you may disconnect the integration in the Pinacall dashboard and remove Pinacall from the relevant Meta business or app settings.

To request deletion of data received through Meta products:

• Email support@pinacall.com with the subject "Meta Data Deletion Request".
• Include the Pinacall account email, business/page name, relevant Facebook Page or Instagram account, and enough information to locate the connection. Do not email passwords or access tokens.
• We will verify authority, acknowledge the request, and delete or de-identify data controlled by Pinacall unless retention is required by law, security, fraud prevention, dispute handling, or valid Customer instructions.
• Where the relevant business Customer controls the conversation data, we may forward the request to that Customer or ask you to contact it directly.

Full step-by-step instructions, including how to remove Pinacall from your Meta settings and what a completed deletion covers, are published at https://pinacall.com/data-deletion.

Closing an account stops future use but may not immediately delete all data.

Before closure, export data you are required to keep.

An authorised account administrator may request account deletion through available settings or support@pinacall.com.

We will process the request subject to verification, Customer instructions, outstanding payment or dispute records, platform requirements, and applicable retention obligations.

We may update this Policy to reflect legal, security, operational, vendor, or Service changes.

We will post the revised version and update the effective date.

We will provide additional notice for material changes where appropriate or required.

If consent is required for a new purpose, we will request it before that processing.