Privacy policy

Last updated 15 November 2026

Draft for review. This page is not yet in force and will be finalised before PineMogul launches.

This policy explains what personal data we process when you visit this website and when your company uses the product.

This website

We use cookieless, privacy-friendly analytics to count visits. We do not use advertising trackers and we do not sell data.

Your account

We store your name, email address, sign-in details (passwords are hashed, never stored in readable form), the company you belong to and your settings. If you sign in with Google we receive your name, email address and profile picture.

Your company's business data

Clients, suppliers, contacts, jobs, staff records, emails, documents and decisions your company stores in the product are processed on behalf of your company. Your company is the controller of that data and we act as its processor under a data processing agreement.

Mailboxes you connect, including Google user data

When you connect a mailbox (Google, Microsoft or IMAP), PineMogul accesses this data from it: your email address and basic profile (your name), and the messages in the mailbox with their headers and attachments.

We use it only to provide the service to you:

• to show replies from clients and suppliers as cards in your approval feed;
• to match messages to the right client, job, offer or invoice, and to save attachments such as invoices in your document vault;
• to read and organise your messages (mark them as read, label them);
• to send emails that a person in your company approved, from your own address.

We never delete messages from your mailbox permanently.

How it is stored and protected: mailbox content we process is stored on our servers in the EU, in the isolated space of your company. Access tokens are encrypted. Only users of your company with the right role can see it.

How long it is kept, and how you delete it: it is kept while the mailbox is connected and your account is active. You can disconnect a mailbox at any time in Settings; we then stop accessing it and delete its access tokens. You can delete stored messages and documents in the app, or ask us to. After a company is closed, its data is deleted after 30 days.

Who it is shared with: only the service providers listed below, as our processors, and only to provide the service to you. It is never sold.

Google user data is not used for advertising, and it is not used to develop, improve or train generalised AI models. Where an AI feature processes mailbox content (for example to draft a reply or to read an invoice), it does so only to provide that feature to you, through AI providers with no training and zero data retention.

PineMogul's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google API Services User Data Policy

AI processing

AI requests are sent through OpenRouter, Inc. (USA) only to model providers that do not train on your data and do not retain it (zero data retention). If no such provider is available, the request fails; it is not sent elsewhere.

A request contains the text you wrote and the short facts needed to answer it. Search over your documents is computed on our own servers. Transfers to the USA are covered by standard contractual clauses.

If your company uses its own AI key, requests go to the provider you configured, under your contract with that provider.

Where data is stored

On servers in the European Union (Hetzner Online GmbH, Germany and Finland).

Service providers we use

• Hetzner Online GmbH: hosting and document storage
• Cloudflare: website delivery, network protection and account emails such as sign-in codes and invitations
• OpenRouter, Inc. (USA) and the AI model providers it routes to under no-training and zero-retention terms: AI processing
• Freemius, Inc., our payments reseller and merchant of record: checkout, invoicing, VAT and refunds
• Google and Microsoft: only when you sign in with them or connect their mailbox

How long we keep data

As long as your account is active. After an account or company is closed, data stays readable for 30 days for export and is then deleted, except records we must keep by law, such as invoices.

Your rights

You can access, correct, export or delete your personal data, object to processing and complain to a data protection authority. Write to us and we will respond within 30 days.

Who we are

PineMogul is provided by Pineido, a registered branch of Energetika-VDS DOOEL, Janko Cvetinov 13, 2400 Strumica, North Macedonia. Contact: contact@pinemogul.com.