Privacy Policy

1. Controller

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

mypinio GmbH
Pappelallee 78/79
10437 Berlin, Germany

Email: [email protected]
Website: https://mypinio.com

The appointment of a Data Protection Officer is currently not required pursuant to Art. 37 GDPR in conjunction with § 38 BDSG. For all data protection inquiries, please contact the email address above.

2. Scope

This privacy policy applies to the websites mypinio.com and mypinioresearch.com (including their subdomains) and to the mypinio platform, including all products and services provided through the platform. These include:

• Stream (real-time routing of survey participants, checked and matched to open studies)
• Publishers (survey wall for apps and websites)
• Community (our participant community with surveys and rewards)
• Synthetic Data (model-based respondents, always labelled as synthetic)
• Researcher platform (in preparation)

This privacy policy applies to business customers and partners (for example publishers and researchers), website visitors, survey participants and community members.

3. Legal bases for processing

We process personal data exclusively on the basis of the following legal grounds under Art. 6(1) GDPR:

4. Data we collect

4.1 Account data

When you register and use the platform, we collect:

• Name and email address — for account management and communication (stored in plaintext, protected by access restriction and encryption in transit (TLS))
• OAuth account data — when signing in via third-party providers (e.g. Google)
• Organisation association — to keep the data of each business customer and partner separate
• Session data — to maintain authenticated sessions (httpOnly, Secure, SameSite cookies)

4.2 Usage data

• Content you create — for example the profile details you enter, support tickets, publisher placements and the survey projects of business customers
• Media files — uploaded images and files (stored on Cloudflare R2)

4.3 Technical data

• IP address — stored in full for survey participation and security checks (fraud, duplicate and quality protection, Art. 6(1)(f) GDPR), together with the country and region derived from it; for website analytics only the country of origin is used
• Device recognition (browser fingerprint) — when you open a survey entry page or our community sign-up page, a script served from our own website reads technical properties of your browser and device (for example how it renders a test image and a test sound, installed fonts, graphics chip, memory class, language and time zone, screen and input type, browser version) and calculates a single hash value from them. Only this hash value reaches our server — not the individual properties, and nothing is sent to a third party. We use it solely to recognise the same device again for fraud and duplicate protection: several participations or accounts from one device, rotating connections, automated access. This protects the survey you chose to take part in — a duplicate or automated participation is rejected by the research client, and no reward is paid. Legal basis: Art. 6(1)(f) GDPR; the access to your device is strictly necessary for the survey participation you requested (§ 25(2) no. 2 TDDDG). The hash is stored with your survey sessions (see section 9) and is not used for advertising or to track you across other websites.
• Browser and operating-system information (user-agent string, device class) — stored with survey sessions for the same security checks and for support
• Error reports — via Sentry, with automatic PII scrubbing (no emails, names, or IP addresses)

4.4 Survey respondents

Survey respondents are anonymous by default. Participation is identified solely by a randomly generated response code. IP addresses are not stored on the SurveyResponseSession. Segments and contact data are controlled exclusively by the survey creator.

4.5 Community members

Community members sign in with e-mail and password or, if they choose, with Sign in with Google or Sign in with Apple. Password hashes use scrypt (via Better Auth). Profile data: date of birth, gender, postal code and city (used to match surveys). When you delete your account, your account, profile, balance, redemptions, push tokens, device-integrity results and sign-in data are deleted. Survey participation records needed for billing our clients, and fraud-prevention records, are kept without your name or e-mail address (see sections 9 and 10.3).

4.6 Fraud prevention and quality data (community)

To protect the community and our research clients we process:

• the device hash described in 4.3, calculated when you open our sign-up page (also inside the app) and stored with your account to detect several accounts or several welcome bonuses on one device, and calculated again with every survey you open; it is calculated on our own website and is not sent to a third party;
• your IP address and the country derived from it (we look up the country with a database that runs on our own servers; our hosting provider also passes us the country of your connection);
• a salted hash of your IP address and your browser type when you save cookie settings, as proof of your choice;
• when you use the app: the results of the device-integrity checks of Google Play Integrity (Android) and, where enabled, Apple App Attest and DeviceCheck (iOS);
• the progress of every survey you open (started, completed, screened out, reversed by the research company) and the results of quality checks, including your history of reversals;
• for the community itself: language of the sign-up page, device class and operating-system family at sign-up, the days you visit and how many surveys were offered to you.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in preventing fraud and multiple accounts and in delivering reliable survey results to our research clients. We do not use phone-number verification.

4.7 Profile details returned by market-research partners

Some survey providers and market-research partners whose surveys we offer you send profile answers you gave in their system (for example household, employment, income bracket or occupational details) back to us when they redirect you to our page at the end of a survey. Once we switch this on, we store those answers in your participant profile and use them to offer you surveys that match your profile and to spare you repeated qualifying questions. Special categories of personal data (Art. 9 GDPR, for example ethnic origin, health, religion or political opinions) are never taken over into your profile. Legal basis: Art. 6(1)(b) GDPR for community members (matching surveys to your profile is part of the membership) and Art. 6(1)(f) GDPR for all other participants (our legitimate interest in offering surveys that fit, with fewer screen-outs). You can object at any time (section 10.5) and ask us which details we hold (section 10.1).

5. Cookies and consent management

We use a cookie consent system with four categories. Non-essential cookies are disabled by default and are only set after explicit consent.

Consent can be withdrawn at any time via the cookie banner or platform settings. The consent decision is stored in a first-party cookie in the browser (cc_cookie).

Note: We do not use Google Analytics, Google Tag Manager, Meta Pixel, or any other third-party tracking tools.

6. Use of artificial intelligence

We use AI models from Anthropic (Claude) for internal editorial and configuration tasks: suggesting how research clients' survey questions and answer options map to our profile questions, and drafting or translating website and social-media content.

What is sent to Anthropic

• Question and answer-option texts of surveys, our own website content and our instructions
• No names, e-mail addresses, survey answers or other data of participants

Synthetic data

Synthetic-data runs of the researcher platform (in preparation) use a model on our own hardware by default. API keys for AI services are used exclusively server-side and are never included in client-side code.

Legal basis: Art. 6(1)(f) GDPR (efficient operation of the platform); these features are not designed to process personal data.

7. Sub-processors and recipients

We engage the following service providers as sub-processors pursuant to Art. 28 GDPR. A data processing agreement (DPA) is in place with each sub-processor.

The Cloudflare row above also covers: the country of your connection (cf-ipcountry header) and storage of the IP-to-country lookup file we use (on Cloudflare R2, EU).

An up-to-date sub-processor list can be requested at any time via [email protected].

7a. Additional recipients for the community

For the community product specifically, we also share data with the following recipients. The "Status" column reflects which of these are actually switched on in production today; several exist in the code but are off by default and only become recipients once we switch them on for a country or payout method.

Not a recipient: MaxMind. The IP-to-country lookup runs on our own servers from a file we download; no member data is sent to MaxMind.

Other recipients

In addition to the sub-processors listed above, we disclose personal data to the following categories of recipients (Art. 13(1)(e) GDPR):

• Clients commissioning a study (market research companies and survey platforms): when you start a survey, you are forwarded to the client's survey. The client receives a pseudonymous participant ID and transaction ID (never your name or your e-mail address), the profile and screening details needed to match you to the study (for example age or year of birth, gender, region or postal code, answers to qualifying questions) and the answers you give in its survey. Because your browser opens the client's survey directly, the client also receives the connection data any website receives (for example IP address and browser information). For some studies we also pass your IP address and browser information to the client ourselves so that it can detect duplicate or automated participation (Art. 6(1)(f) GDPR).
• Partners and publishers whose app, website or link you used to reach a survey: they receive session and transaction IDs, a pseudonymous participant ID (the one they assigned to you or the one we use), the outcome of the survey (for example completed or not qualified), the reward status and, in some cases, the country. They receive no survey answers.
• Sub-processors as listed in the table above (Art. 28 GDPR).
• Public authorities and courts, where we are legally obliged to disclose data.

Legal basis: Art. 6(1)(b) GDPR (conducting the survey you chose to take part in and crediting your reward), Art. 6(1)(f) GDPR (our legitimate interest in operating the survey marketplace where you take part via a partner's app or website without a contract with us, and in detecting duplicate or automated participation) and Art. 6(1)(c) GDPR (disclosure to authorities).

8. International data transfers

mypinio is headquartered in Germany. Some sub-processors process data in the USA (Railway, Stripe, Resend, Anthropic, Sentry). For these transfers, we employ the following safeguards:

• EU Standard Contractual Clauses (SCC) pursuant to Art. 46(2)(c) GDPR
• Adequacy decision of the European Commission, where available (e.g. EU-US Data Privacy Framework)
• Additional technical measures: encryption in transit; encryption at rest where the storage provider offers it; data minimization; PII scrubbing before transfer

Cloudflare R2 is configured for EU-only storage. The main database is operated on Railway in the EU region.

In addition, for the community: Tango Card, PayPal, Google and Apple (for push and sign-in) are based in the USA (EU Standard Contractual Clauses or, where the recipient is certified, the EU-U.S. Data Privacy Framework). Cash payouts via local payment systems are processed in the country in which you receive the payout (Art. 49(1)(b) GDPR). Gift-link providers (Giftbit in Canada/USA, Tremendous in the USA) receive no personal data from us; when you open a gift link, your browser connects to them directly. Research clients' survey systems may be located in any country; you connect to them directly when you open a survey, so that connection is not covered by our safeguards.

Clients commissioning a study and partners may also be located outside the EU/EEA (for example in the USA or the United Kingdom). Where this is the case, the disclosure is based on an adequacy decision of the European Commission or on EU Standard Contractual Clauses, where agreed; otherwise it is based on Art. 49(1)(b) GDPR, because the transfer is necessary so that you can take part in the survey you chose. The data transferred is limited to the pseudonymous and profile data described in section 7 (Other recipients).

9. Retention periods

We store personal data only as long as necessary for the respective purpose. The following specific periods apply:

10. Your rights as a data subject

Under the GDPR, you have the following rights:

10.1 Right of access (Art. 15 GDPR)

You have the right to obtain information about the personal data we process. Community members download a copy of their data in the Privacy Center of the community app. Everyone else writes to [email protected] or uses the request form on our GDPR page.

10.2 Right to rectification (Art. 16 GDPR)

You may request the correction of inaccurate data or the completion of incomplete data. Profile data can be changed directly in your account settings.

10.3 Right to erasure (Art. 17 GDPR)

You may request the deletion of your personal data.

• Community members delete their account themselves in the Privacy Center of the community app. The deletion takes effect immediately and cannot be undone; there is no grace period. While a gift-card redemption is still being processed, the account can only be deleted once that payout is complete, so that no credit is lost.
• Everyone else requests deletion by e-mail to [email protected] or with the request form on our GDPR page.

When a community account is deleted, the account, profile, Pintos balance and history, survey activity, gift-card redemptions, referral invitations and sign-in data are deleted.

Not deleted: a record of the deletion request (date, internal ID and the e-mail address of the deleted account) as proof that the request was carried out, and audit logs. Survey participation records that we need for billing with our clients are retained; their link to the member profile is removed.

10.4 Right to data portability (Art. 20 GDPR)

You may request an export of your data in a machine-readable format (JSON). Community members download it directly in the Privacy Center of the community app: the file is created immediately and downloaded in the browser. It includes account and profile data, consent records, Pintos history, survey activity, referral invitations, gift-card redemptions and support tickets. Everyone else requests the export by e-mail to [email protected] or with the request form on our GDPR page.

10.5 Right to object (Art. 21 GDPR)

You have the right to object to the processing of your data based on legitimate interests (Art. 6(1)(f)) at any time. We will cease processing unless there are compelling legitimate grounds.

10.6 Right to restriction (Art. 18 GDPR)

You may request the restriction of processing, in particular if the accuracy of the data is contested or the processing is unlawful.

10.7 Withdrawal of consent

Where processing is based on your consent, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out prior to withdrawal remains unaffected.

10.8 Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular with the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

11. Self-service privacy center

Community members can exercise their data protection rights directly in the Privacy Center of the community app (account menu > Privacy Center). The following functions are available:

There is no self-service privacy center for other users (for example business customers, publishers and other partners). They send their request by e-mail to [email protected] or with the request form on our GDPR page. We confirm receipt in writing and answer within one month.

12. Data security

We employ extensive technical and organizational measures to protect your data:

Encryption and access control

• PII fields (e.g. email addresses) are stored in plaintext, protected by access restriction and encryption in transit (TLS)
• API keys of partners are stored only as hashes — the plaintext is not kept
• Community passwords: scrypt (via Better Auth)
• Session cookies: httpOnly, Secure, SameSite
• HSTS (Strict-Transport-Security) with a max-age of 2 years

Network and application security

• Rate limiting on sign-in, survey-entry and partner API endpoints
• Role-based access: staff and partner accounts see only the data of their role; database roles with least privilege
• Input validation with Zod on API routes
• Text you enter is rendered as text, never as executable HTML
• Survey return links are signed and rejected if altered
• Payment webhooks (for example Stripe) are verified by signature

Monitoring

• Sentry error reports with automatic PII scrubbing (beforeSend hook)
• Error reports contain no emails, names, phone numbers or IP addresses
• Audit logging of all security-relevant actions

13. Children and minors

Participation in the community requires a minimum age of 18, in every country. We check this against the date of birth you give at sign-up; we do not use phone-number verification. If we learn that a person under 18 has registered, we close the account and delete its personal data, except for records we must keep as described in section 9. Our other services are likewise not directed at persons under the age of 18, and we do not knowingly collect personal data from persons under 18 elsewhere on the platform; should we become aware that such data has been collected, we will delete it without delay.

14. Audit logging

To ensure compliance and protect against misuse, we log security-relevant actions in an immutable audit log. Actions logged include: data export requests, deletion requests and their execution, API key creation and revocation, staff actions in the administration, and changes to staff roles and partner accounts.

Audit logs never contain the content of the action, only the resource ID and the type of action. You can ask us what is logged about your account (section 10.1).

15. Third-party services on the website

Some images on our website are served via Next.js image optimization. Your browser requests the optimized image from our domain; our servers may retrieve the original file from the provider (e.g. Unsplash). Your device does not establish a direct connection to third-party providers for these images.

We do not use social media widgets (Facebook Like button, Twitter widgets, etc.). No third-party tracking tools (Google Analytics, Meta Pixel, Flurry, etc.) are used.

16. Changes to this privacy policy

We reserve the right to update this privacy policy as needed, in particular when our processing activities, legal requirements, or technologies change. In the event of material changes, we will notify registered users by email and update the date at the top of this document.

16a. Transfer on sale, merger or restructuring

If mypinio GmbH is sold, merges with another company, or is restructured, member data and Pintos balances may be transferred to the acquiring or successor entity, who will continue to process them for the same purposes described in this policy. We will inform affected members before any such transfer takes effect.

16b. Additional information under the data protection law of your country

If the data protection law of your country of residence grants you further rights or places further duties on us (for example the Digital Personal Data Protection Act, 2023, under which mypinio GmbH acts as the Data Fiduciary), you can exercise those rights — for example ask for a summary of your data, its correction or deletion, or withdraw your consent — through the Privacy Center in the community app or by writing to [email protected]. Grievance contact: [email protected] (Mike Wilde). We inform the competent authority and affected members of a personal-data breach where the law of your country requires it.

17. Contact

For all data protection inquiries, exercise of your data subject rights, or complaints, please contact:

mypinio GmbH
Pappelallee 78/79
10437 Berlin, Germany
Email: [email protected]

Please indicate "Privacy Request" in the subject line so we can process your inquiry as quickly as possible.