Privacy Policy

1. Introduction

Company Software Pvt. Ltd., operating as Pinnasys ("Pinnasys", "we", "us", or "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit pinnasys.com, interact with our content, or engage us for AI engineering and consulting services.

Please read this policy carefully. By accessing our website or working with us, you acknowledge that you have read and understood how we handle your data. If you disagree with the practices described here, please discontinue use of our website.

2. Information We Collect

We collect information in the following ways:

3. How We Use Your Information

We use the information we collect for the following purposes:

• To respond to your inquiries, consultation requests, and support tickets.
• To deliver, manage, and improve our AI services and client engagements.
• To send service-related communications such as proposals, project updates, and invoices.
• To send marketing emails, newsletters, or event invitations — only where you have opted in or where we have a legitimate interest.
• To analyze website usage and improve our content, navigation, and user experience.
• To evaluate job applications and manage the recruitment process.
• To comply with legal obligations, resolve disputes, and enforce agreements.
• To detect, prevent, and address fraud, security incidents, or technical issues.

4. Legal Basis for Processing

Where applicable under data protection laws (including GDPR for users in the European Economic Area and UK GDPR for users in the United Kingdom), we process your personal data based on the following legal grounds:

• Contractual necessity: to fulfill a service agreement or take steps before entering into one.
• Legitimate interests: to operate our business, improve services, and communicate with prospects, provided those interests are not overridden by your rights.
• Consent: where you have explicitly opted in to receive marketing communications.
• Legal obligation: where processing is required to comply with applicable laws or regulations.

5. Sharing Your Information

Pinnasys does not sell, rent, or trade your personal information. We may share your data with trusted third parties only in the following circumstances:

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this policy, or as required by law. Specifically:

• Inquiry and lead data is retained for up to 24 months from last contact unless a business relationship is established.
• Client project data is retained for the duration of the engagement and up to 7 years thereafter for legal and compliance purposes.
• Job application data is retained for 12 months from the date of application unless a position is offered.
• Website analytics data is retained in aggregate form for up to 26 months.

Once data is no longer needed, we securely delete or anonymize it.

7. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to improve your browsing experience, analyze site traffic, and support our marketing efforts. The types of cookies we use include:

You can manage or disable cookies through your browser settings. Note that disabling certain cookies may affect site functionality. For users in the EU or UK, a cookie consent banner is displayed on first visit.

8. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that inaccurate or incomplete data be corrected.
• Deletion: Request that we delete your personal data (subject to legal obligations).
• Restriction: Request that we limit how we use your data while a dispute is resolved.
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests or for direct marketing.
• Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting prior lawful processing.

To exercise any of these rights, please contact us at hello@pinnasys.com. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

9. Data Security

Pinnasys implements industry-standard technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include:

• Encrypted data transmission via HTTPS/TLS.
• Access controls limiting data access to authorized personnel only.
• Regular security reviews and vulnerability assessments.
• Secure cloud infrastructure with reputable providers.

While we take reasonable steps to protect your data, no method of internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security and encourage you to take precautions when sharing sensitive information online.

10. International Data Transfers

Pinnasys is headquartered in Jaipur, India, and serves clients in the United States, United Kingdom, Australia, and other regions. Your information may be transferred to and processed in countries other than your own.

Where we transfer data across borders, we ensure appropriate safeguards are in place in accordance with applicable data protection laws, including standard contractual clauses, adequacy decisions, or equivalent protections.

11. Children's Privacy

Our website and services are not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected data from a minor, we will take steps to delete it promptly.

If you believe we have collected information from a child, please contact us at hello@pinnasys.com.

12. Third-Party Websites

Our website may contain links to third-party websites, case study partners, or external resources. This Privacy Policy applies only to pinnasys.com. We are not responsible for the privacy practices of any third-party sites and encourage you to review their policies before submitting any personal data.

13. AI Services and Client Data

When we build AI systems for clients, the data you share with us for a project is used only to deliver that project. We do not use client data to train general-purpose models for other customers, and we do not combine one client's data with another's.

Where a project involves third-party model providers such as Anthropic's Claude, we configure the integration according to your requirements, including data retention settings, access controls, and regional processing preferences, and we document these choices in the statement of work.

• Client data is accessed only by engineers assigned to your engagement.
• Sensitive fields can be masked, tokenized, or excluded before data reaches a model.
• Production credentials and API keys are stored in secure secret managers, never in source code.
• At the end of an engagement, we delete or return project data in line with your agreement.

14. Additional Rights for US Residents

Residents of certain US states, including California, Colorado, Virginia, Connecticut, and Texas, may have additional rights under state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA).

We do not sell personal information and we do not share it for cross-context behavioral advertising without your consent. You may request details of the categories of personal information we have collected, the purposes for which it is used, and the categories of third parties with whom it is disclosed. We will not discriminate against you for exercising any of these rights.

15. Do Not Track and Data Breach Notification

Some browsers send a "Do Not Track" signal. Because there is no common industry standard for responding to these signals, our website does not currently alter its behavior when one is received. You can limit tracking through your cookie preferences and browser settings.

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected individuals and the relevant regulators without undue delay and within the time limits set by applicable law, describing what happened, what data was involved, and the steps we are taking in response.

16. Marketing Communications and Your Choices

We may contact you about our services, events, and insights if you have asked to hear from us or if we have a legitimate interest in doing so, for example when you have recently enquired about a project. Every marketing email includes a clear way to unsubscribe, and we act on opt-out requests promptly.

Opting out of marketing does not stop service-related messages, such as proposals you requested, project updates, invoices, security notices, and responses to your enquiries, because these are necessary to deliver what you asked for.

• Use the unsubscribe link in any marketing email to stop receiving them.
• Email hello@pinnasys.com to update your contact preferences or to ask us to delete your details from our mailing lists.
• Adjust your cookie preferences or browser settings to limit analytics and advertising technologies.
• Ask us to restrict how your data is used while a question or complaint is being resolved.

17. Forms, Calls, and Meeting Records

When you submit a form on our website, we use the details you provide to respond and to keep a record of the conversation in our CRM. Please avoid including sensitive personal information, such as health or financial account details, in free-text fields unless we have asked for it.

If we record or transcribe a discovery call or workshop, we will tell you at the start and ask for your agreement. Recordings and notes are used to prepare proposals, capture requirements, and improve our delivery, are stored securely, and are deleted when no longer needed for those purposes.

18. Questions, Complaints, and Regulators

We would like the chance to resolve any concern about how we handle your data, so please contact us first at hello@pinnasys.com. We will acknowledge your message, look into it, and reply with what we found and any action we will take.

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority, such as the Information Commissioner's Office in the United Kingdom or the supervisory authority in your EU member state. Residents of other regions may contact their relevant state or national privacy regulator.

19. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this page.

We encourage you to review this policy periodically. Your continued use of our website after changes are posted constitutes your acknowledgment of the updated policy.

20. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or your personal data, please reach out to us: