Privacy policy

Who is responsible

The controller of your personal data is Pinnora Technologies Limited, 4 Güldenhofer Ufer, Treptow-Köpenick, 12437 Berlin, Germany. For questions about your data, write to helpdesk@mypinnora.com or open a support ticket. Last updated 8 October 2026; if a change affects you, we tell you in the app or by e-mail.

What we keep and why

Your account. Your e-mail address, name, country, phone number if you give one, display currency, username, account number, who invited you and notes our staff add. Your password is kept only as a salted hash. We need these to provide your account (Art. 6(1)(b) GDPR).

Security. Passkeys (only their public key: your fingerprint or face stays on your device), signed-in devices with their browser and network, recent sign-in attempts, and a log of sign-ins and failed attempts, account changes, payments and requests with the IP address and browser of each. We keep these to protect your account and investigate misuse (Art. 6(1)(f)).

Identity verification. Your name, date of birth, address, phone number, occupation, source of funds, tax identifier, ID type, ID photos and a selfie, reviewed by our own staff and sent to no outside service. We need them before you take money out or apply for business capital, against fraud and money laundering and where the law requires (Art. 6(1)(c) and (f)).

Money and products. Deposits, withdrawals with the bank account or crypto address you name, transfers, orders, balances, plans with the terms you accepted, loans, Empowerment applications with your business details, referral rewards and your daily portfolio values (Art. 6(1)(b), and (c) for records the law requires).

Support and settings. Tickets with any screenshots and ratings, notifications, e-mail choices, preferences such as your watchlist and, if you turn them on, push notification details (Art. 6(1)(b); push on consent, Art. 6(1)(a)).

Reviews you publish, or give us another way and agree to publish, show your first name and last initial, rating, words, date and whether you are a verified customer; you can change or delete yours any time (Art. 6(1)(a)). Deleting a review we had hidden removes its words, but keeps a record of it linked to your account, with the name it showed, its rating and why it was hidden, so that posting the same words again does not put them straight back on the page.

Messages you send us. If you e-mail us, we use your address and message to deal with what you raise, for as long as that takes (Art. 6(1)(b) or (f)).

Other members see only your username, your account number, your first name and last initial, and whether you are verified; whoever invited you also sees your name, when you joined and whether you have verified and qualified for the reward.

Account details are needed to open an account, and identity details to take money out. No decision with legal or similarly significant effect on you is made by automated means alone.

E-mails we send

We e-mail you about your account: security, identity checks, money, trades, plans, loans, referrals and support (Art. 6(1)(b)), plus announcements and occasional feedback requests (Art. 6(1)(f)). Settings → E-mail notifications in the app turns each kind off except security and identity. News and offers come only if you switch them on (Art. 6(1)(a)); every optional e-mail has a one-click unsubscribe link. We do not track opens or clicks.

Cookies and your device

Our website’s pages set no cookies and use no analytics, advertising or social-media tools. The app sets only cookies strictly necessary to sign you in and keep your account safe, which need no consent (§ 25(2) TDDDG):

• pn_s keeps you signed in. Page scripts cannot read it; it lasts 30 days at most.
• pn_csrf proves a request comes from the app; it lasts as long as pn_s.
• pn_pv lets the browser you signed up on carry on once your address is verified. It lasts two hours.
• pn_state links the sign-in page back to the app. It lasts ten minutes.

The app also keeps a copy of your account and settings, and the name and e-mail address of the last account used, in your browser’s storage. Signing out removes your sign-in details; clearing this site’s data removes the rest.

Who else handles your data

Our staff see only what their role needs; support’s view of your account is read-only, lasts 15 minutes and is announced to you. Outside Pinnora:

• Hostinger provides the server everything above is stored on.
• Neo (neo.space) delivers our e-mails, so your address and each message pass through it.
• Your browser’s push service (Google, Apple, Mozilla or Microsoft) delivers push notifications you turn on, encrypted so it cannot read them.
• Google Fonts supplies the typefaces of the app, so opening the app sends your IP address to Google. Our website’s pages, the sign-in and verification pages and our e-mails use no outside fonts.

Our server fetches prices from public sources such as Binance, CoinGecko and Nasdaq without sending anything about you. We never sell your data or share it for advertising, and disclose it to authorities only where the law requires. Google, Apple, Mozilla and Microsoft may process data in the United States; transfers outside the EU or EEA are protected as Art. 44 to 49 GDPR require, such as by an adequacy decision or standard contractual clauses.

How long we keep it

• Your account and its records stay while it is open. Deleting it at your request removes its balances, history, plans, loans, applications, identity data and photos, tickets, notifications, passkeys, e-mails and review from our database at once.
• An account whose e-mail address was never confirmed, and which holds nothing, is removed after seven days.
• Sign-in records: sessions are deleted about 30 days after you sign in, sign-in attempts after about a day, and a network you sign in from 30 days after your last sign-in there.
• E-mails lose their text once sent (a failed one keeps it a week at most, for a retry); a record of recipient, subject, time and kind stays 30 days.
• The security log is never shortened: removing an entry would break the chain proving it unaltered, so entries about an account, including its deletion, stay, with the e-mail address, IP addresses and browser details they record. That includes an address used for a sign-up that was never confirmed.
• Nightly backups are kept for 14 days, so deleted data leaves them within that time.

Your rights

You can see the data we hold about you and get a copy (Art. 15 GDPR), have it corrected (Art. 16), deleted (Art. 17) or its use restricted (Art. 18), receive what you gave us in a machine-readable format (Art. 20), and withdraw consent at any time without affecting what was done before (Art. 7(3)).

To use your rights, write to helpdesk@mypinnora.com from your account’s address, or open a support ticket. We may ask you to confirm who you are. The GDPR gives us one month to answer, extendable for complex requests.

You may also complain to a supervisory authority, in particular where you live or work. Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (datenschutz-berlin.de).