Loading the page
Last updated: 10 October 2026
This policy explains what personal data Pinard collects, why, who it is shared with, how long it is kept, and your rights. It is written to meet the EU General Data Protection Regulation (GDPR), the Irish Data Protection Act 2018 and, for users in the UK, the UK GDPR.
Pinard is run by [legal name to be added], [postal address to be added]. We are the "controller" of your personal data.
For any privacy question or request, email [email protected]. We are a very small business and are not required to appoint a Data Protection Officer; your request comes straight to the person responsible.
| What | Why we use it | Legal basis |
|---|---|---|
| Account: your name, email address and password (stored only in scrambled, hashed form by our sign-in provider) | To create your account and sign you in | Contract |
| Exam details: exam part, exam date, time zone and preferred reminder time | To build your study plan and send reminders at the right time | Contract |
| Revision data: your answers, time per question, scores by section, mock results, study plans, questions you flag | To run the Service: your plan, sessions and progress | Contract |
| Ask Pinard: the questions you type and the answers you receive | To answer you, and to show you the conversation again on that question | Contract |
| Payments: your Stripe customer reference, plan, price region, status, renewal dates and top-up purchases, and the country your payment card was issued in (never your card number) | To take payment, manage your plan, and set the price for your country | Contract; legal obligation |
| Price checks: the country your connection comes from, and whether your browser's time zone and language agree with it (kept as a yes or no, not stored with you) | To show the right price for your country, and to refund a purchase made at another country's price | Legitimate interests |
| Sign-in countries: the country each sign-in comes from, by day (never the IP address) | To spot shared accounts; we look, and nothing happens automatically | Legitimate interests |
| Pricing and checkout steps: which page or plan was viewed or chosen, with the country, and your account if you are signed in (nothing at all if your browser asks not to be tracked) | To see which plans work, and improve the pricing page | Legitimate interests |
| Reminder emails: which reminders we sent and when | So you get at most one a day | Contract; legitimate interests |
| Security: an identifier for the one device you are signed in on, and a scrambled (hashed) form of your IP address when you enter an access code or join the waitlist | To stop account sharing, guessing of access codes and spam | Legitimate interests |
| Feedback, question reports and pilot reviews | To fix mistakes and improve Pinard | Legitimate interests |
| A review comment you agree we may publish, with the name and detail you choose | To show as a testimonial | Your consent, which you can withdraw |
| Waitlist: email address, exam part and date | To tell you when Pinard opens | Your consent |
| Withdrawal and refund requests | To process them and keep a record | Legal obligation |
We do not sell your data, and we do not use it for advertising. We do not use cookies or tools that track you around the web.
Some features use AI. This is what they receive:
Neither Amazon Web Services nor Voyage AI uses what we send to train their AI models, and Amazon Web Services does not share it with Anthropic.
Please never type patient details, or anyone else's personal information, into Ask Pinard. Ask about the guidance, not about a person.
Pinard does not make decisions about you by automated means that have legal or similarly significant effects. Your study plan is worked out by software from your scores, and you can change your exam and settings at any time.
We share data only with the service providers below, who process it on our instructions under data processing agreements, and where the law requires it.
| Provider | What they do for us | Where the data is processed |
|---|---|---|
| Supabase Inc. | Database, sign-in and file storage | London, United Kingdom |
| Vercel Inc. | Hosts the website and runs its server code; keeps short-lived technical logs | United States, and its global network |
| Amazon Web Services EMEA SARL (Bedrock) | Runs the Claude AI model | Requests go to Ireland and may be processed in other AWS regions, including the United States |
| Voyage AI Inc. | Searches the source library for Ask Pinard | United States |
| Resend (Plus Five Five, Inc.) | Sends our emails | United States |
| Stripe Payments Europe Ltd | Manages subscriptions and the billing portal | Ireland and the United States |
Link (Stripe) is the merchant of record for payments: it sells your subscription or top-up to you, takes the payment, collects and pays the tax, and answers payment questions. For that it is an independent controller of your payment details; the Link privacy policy and explain how it uses them.
Some of these providers process data outside the European Economic Area. The United Kingdom has an EU "adequacy decision", which means the EU considers its protection equivalent. For the United States, we rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses (with the UK Addendum for UK users). You can ask us for more detail.
| Data | How long |
|---|---|
| Account, revision data and Ask Pinard history | While your account is open. Deleted at once when you delete your account, and gone from our provider's backups within 30 days. |
| Payment and invoice records | Six years after the end of the tax year they relate to, because Irish tax law requires it |
| Reminder log | While your account is open |
| Feedback and question reports | While useful for improving the questions. If you delete your account they are kept without your name or any link to you. |
| Pilot review and any published comment | Until you ask us to remove them. A published comment comes down within 7 days of your request. |
| Waitlist entry | Until we tell you Pinard is open, and no longer than 12 months after you joined |
| Records of failed Ask Pinard answers (the question text, without your name) | Up to 12 months |
| Security records (scrambled IP address) | Up to 30 days |
| Technical logs at our hosting provider | Up to 30 days |
You have the right to:
Several of these you can do yourself on your Account page: Download my data gives you a copy of everything linked to your account, Delete your account removes it, and you can turn reminder emails off there or from the link in any reminder. For anything else, email [email protected]. We reply within one month, and may ask you to confirm your identity first.
If you are unhappy with how we use your data, please tell us first. You also have the right to complain to a data protection authority. Our lead authority is the Data Protection Commission in Ireland (dataprotection.ie). In the UK it is the Information Commissioner's Office (ico.org.uk), and elsewhere in the EU you can also complain to the authority in your own country.
We use the cookies needed to sign you in and keep Pinard secure, and one optional cookie, set only if you accept it in the cookie banner. Our Cookie Policy lists each one.
Data is encrypted in transit and stored with providers that encrypt it at rest. Access to the database is restricted, each account can only reach its own data, and we test the Service for security problems. If a breach puts your data at risk, we will tell you and the Data Protection Commission as the law requires.
Pinard is for adults (18 and over). We do not knowingly collect data about anyone under 18.
When we change this policy we update the date at the top. For an important change, we will email you before it takes effect.
If we change provider, for example to use Anthropic's own service in place of Amazon Web Services, we will update this list first.