GDPR Compliance · mypinio research

mypinio is designed for organizations that handle personal data responsibly. GDPR compliance, self-service data subject rights, and transparent sub-processor management — by design, not as an afterthought.

Send a privacy request E-mail [email protected]

GDPR Compliant
EU database hosting
Self-Service Rights
Audit trail

Privacy Policy & transparency

Processing activities, legal bases, retention periods, and sub-processors are documented in our Privacy Policy.

View Privacy Policy

DATA SUBJECT RIGHTS

Your users' rights, built into the platform.

Right of access

Community members download a copy of their personal data in the Privacy Center of the community app. Everyone else sends a request with the form on this page — we reply by e-mail.

Right to erasure

Community members delete their account in the Privacy Center of the community app — all account data is permanently removed. Everyone else requests deletion with the form on this page. Deletion records are retained as legal proof.

Data portability

Your data in a machine-readable format: community members download it in the Privacy Center of the community app; everyone else requests it with the form on this page.

Right to rectification

Users can update their profile data directly in account settings. No support ticket needed — immediate self-service correction of personal information.

Right to restriction

You can request a restriction of processing at any time — with the form on this page or by e-mail to [email protected].

Right to object

You can object to processing based on legitimate interests at any time. Cookie consent can be withdrawn instantly via the "Cookie settings" link in the website footer.

IMPLEMENTATION

GDPR compliance at every layer.

Cookie consent management

Built-in

Four-category consent system (necessary, analytics, marketing, preferences). Non-essential cookies disabled by default. No Google Analytics, no Meta Pixel, no third-party tracking. Consent revocable at any time.

PII protection

Always on

Personal data stored with access restriction and encrypted in transit (TLS). API keys and passwords are stored only in hashed form. Session cookies use httpOnly, Secure, and SameSite flags.

Audit logging

Automated

Security-relevant actions are logged, such as data exports, deletions, API key operations, role changes and member management. Audit logs contain resource IDs and action types, not content.

Data retention

Documented

Retention periods per data type are listed in our Privacy Policy. Where a category has no fixed period at present, we review the need to keep it at least once a year.

Data minimization

By design

IP addresses stored in full only for fraud, duplicate and quality checks on survey participation; website analytics use the country only. Error reports PII-scrubbed before transmission to Sentry. Only survey question and answer-option texts and our own content go to Anthropic — no participant data. Survey respondents anonymous by default.

Transparent sub-processor management.

Each sub-processor we work with has a Data Processing Agreement in place. All sub-processors, their data scope, and storage locations are documented in our Privacy Policy. An up-to-date sub-processor list is available on request.

View our Privacy Policy

FOR YOUR CUSTOMERS

Help your customers trust you.

Participants from partners

Participants who reach a survey through a partner link or a publisher's survey wall are identified by a session and device signals only. We receive no name and no e-mail address from the partner.

Community member privacy

Community members manage their data themselves in the Privacy Center of the community app: download a copy or delete the account permanently — the account data is removed; only a record of the deletion request is kept as proof.

Data Processing Agreement

We provide a DPA for business customers, covering our role as data processor under Art. 28 GDPR. Available on request at [email protected].

FAQ

GDPR questions

Yes. mypinio is designed for GDPR compliance from the ground up. We implement all data subject rights (access, erasure, portability, rectification, restriction, objection), store personal data with access restriction and encryption in transit (TLS), and provide self-service tools for users to exercise their rights. Our Privacy Policy details all processing activities, legal bases, and retention periods.

Our primary database runs on Railway in the EU region. Cloudflare R2 is configured for EU-only object storage. Some sub-processors (Railway, Stripe, Resend, Anthropic, Sentry) process data in the USA, with appropriate safeguards under Art. 46 GDPR or on the basis of an adequacy decision (EU-US Data Privacy Framework).

Yes. We provide a DPA for business customers that covers our role as data processor under Art. 28 GDPR, including sub-processor management, data security measures, and breach notification procedures. Contact [email protected] to request one.

Community members use the Privacy Center of the community app for data export and account deletion. Everyone else sends a request with the form on this page or writes to [email protected]. We confirm receipt by e-mail and answer within one month.

We use AI models from Anthropic (Claude) for internal editorial and configuration tasks: suggesting how research clients' survey questions and answer options map to our profile questions, and drafting or translating website and social-media content. Only survey question and answer-option texts, our own website content and our instructions are sent — no names, e-mail addresses, survey answers or other data of participants. Details: section 6 of our Privacy Policy.

No. We do not use Google Analytics, Google Tag Manager, Meta Pixel, or any third-party tracking tools. Our cookie consent system defaults all non-essential categories to disabled. We use first-party analytics only, and only with explicit user consent.

Questions about GDPR compliance?

We are happy to provide our DPA and to answer specific requirements for your organization.