Privacy Policy

Pinapl is a marketing platform for Shopify merchants, operated by Agile Studios LLC, a Delaware limited liability company. When you connect your store, Pinapl analyses your store data to identify recoverable revenue and, once you approve a plan, runs email and WhatsApp marketing campaigns on your behalf.

For personal data we process about you as a Pinapl customer — your account, your billing details, your use of the site and app — we act as the data controller. For personal data we process about your own customers when running your campaigns, you are the controller and Pinapl acts as your processor, on your instructions and under our Data Processing Terms.

That distinction matters throughout this policy: it determines who decides how the data is used, and who your customers should contact about their rights.

We only collect what we need. Depending on how you use the site and the platform, this may include:

We use personal data to operate and secure the platform, to analyse your store and recommend a marketing plan, to send the campaigns you review and approve, to measure performance and attribute recovered revenue, to respond to your enquiries and provide support, and to comply with our legal obligations.

Our lawful bases are the performance of our contract with you; our legitimate interests in operating, securing, and improving our business; your consent where required, for example for non-essential cookies and certain marketing messages; and compliance with legal obligations. Where we rely on consent you may withdraw it at any time.

We do not sell your personal data. We do not intentionally collect sensitive personal data through the site, and we ask that you do not send it to us unsolicited.

When Pinapl processes your customers' personal data to run your campaigns, we do so only on your instructions and only for the purposes you have set. We do not use your customers' data to build our own marketing lists, to contact them for our own purposes, or to train models for other merchants.

As the controller of that data, you are responsible for having a valid lawful basis and, where required, valid consent to contact your customers by email and WhatsApp. If one of your customers asks us to exercise a right over their data, we will refer them to you and support you in responding.

We do not currently run any third-party analytics on pinapl.ai. Nothing on the public site profiles you, follows you between sites, or reports your visit to an advertising network.

What we do have is our hosting provider's ordinary server logs, which record requests to the site and may include your IP address. We use them for security, abuse prevention, and diagnosing faults, and they are kept for a short period.

If we introduce analytics, we will use a privacy-friendly, cookieless provider that sets no cookies, does not track you across sites, and collects no personal data — and we will update this policy before it goes live.

We share personal data only with service providers who help us run the platform and our business — hosting and cloud infrastructure, email and WhatsApp delivery, analytics, scheduling, payment processing, and support tooling — and only as needed to provide their service to us, under contract. We also exchange data with Shopify to operate the integration you authorised.

We may disclose data where required by law, to enforce our terms, or to protect our rights and the safety of our users. If we are involved in a merger, acquisition, or sale of assets, we will notify you of any change in control or in how your personal data is used.

We do not share your data with third parties for their own marketing.

Cookies are small files stored on your device. The public pages of pinapl.ai set no cookies at all, and we show no cookie banner because we set nothing that requires your consent.

Cookies are set only when you sign in to a private Pinapl area, such as the admin dashboard. Those are strictly necessary — they keep you signed in and protect the sign-in form — and are exempt from consent because the service cannot work without them. We set no advertising, profiling, or cross-site tracking cookies anywhere.

You can still refuse or delete cookies through your browser settings at any time. Doing so will sign you out of any private area, but it will not stop you using the public site.

We are a United States company and use service providers that may process data in the United States, the EEA, the UK, the UAE, and elsewhere. When we transfer personal data across borders we take reasonable steps to ensure it stays protected to a standard consistent with applicable data protection law, including standard contractual clauses and equivalent contractual safeguards with our providers where appropriate.

We keep personal data only as long as needed for the purposes above. Account and store data is retained while your account is active and for a reasonable period afterwards so you can reactivate; enquiries are typically kept no longer than needed to respond and for a reasonable follow-up period. We then delete or anonymise the data, unless a longer period is required for legal, accounting, tax, or reporting obligations.

You can disconnect your Shopify store at any time, which stops further store data being collected, and you can ask us to delete your data as described below.

Subject to applicable law, you may ask us to access, correct, or delete your personal data; object to or restrict certain processing; withdraw consent; and receive a copy of the data you provided in a portable form. To exercise any right, contact us using the details at the end of this policy — by email or through the contact form, whichever you prefer. We will respond within the timeframe required by applicable law, and we will not charge you or treat you differently for asking.

You also have the right to complain to your local data protection authority — for example the UAE Data Office, an EU supervisory authority, or the UK Information Commissioner's Office.

We use reasonable technical and organisational measures to protect personal data, including encryption in transit, access controls, and least-privilege access to production systems. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to address any incident appropriately, including notifying you and the relevant authority where the law requires it.

Pinapl is a business tool intended for merchants and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this policy from time to time. The dates at the top of this page show the current version, and material changes will be reflected here and, where appropriate, notified to you. Your continued use of Pinapl after an update means you accept the revised policy.

For any privacy question or request, contact: