Privacy Policy

1. Data Controller

PinealOS ("we", "us", "our") acts as the data controller for the personal data you provide while using our platform at pinealos.com (the "Platform").

Contact: info@pinealos.com
Address: Istanbul, Turkey

We have not appointed a Data Protection Officer (DPO) as we are not required to do so under Article 37 of the GDPR. For all data protection inquiries, please contact us at info@pinealos.com.

2. Personal Data We Collect

3. Lawful Bases for Processing (GDPR Article 6)

We process your personal data under the following lawful bases:

• Contract performance (Art. 6(1)(b)): Account creation, subscription management, service delivery, domain registration.
• Legal obligation (Art. 6(1)(c)): Invoicing (Tax Code art. 230, 253), domain registration (TR ABIS), fraud prevention.
• Legitimate interests (Art. 6(1)(f)): Service security, fraud detection, platform improvement, direct marketing (with opt-out).
• Consent (Art. 6(1)(a)): Marketing communications, cookie preferences (where required).

4. Data Processors and Sub-Processors

We engage the following third-party data processors who may access your personal data:

All processors are bound by data processing agreements (DPAs) that comply with Article 28 of the GDPR. For transfers to the US, we rely on the EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs).

5. International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States and Turkey. When we transfer your data internationally, we ensure appropriate safeguards are in place, including:

• EU-US Data Privacy Framework (for transfers to certified US processors like Cloudflare)
• Standard Contractual Clauses (SCCs) adopted by the European Commission
• Adequacy decisions where applicable

6. Data Retention

7. Your Rights

7.1 Under the GDPR (EEA Users)

If you are located in the European Economic Area, you have the following rights under Articles 15-22 of the GDPR:

• Right to access (Art. 15): Request a copy of your personal data.
• Right to rectification (Art. 16): Correct inaccurate or incomplete data.
• Right to erasure (Art. 17): Request deletion of your data ("right to be forgotten").
• Right to restrict processing (Art. 18): Limit how we use your data.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests or direct marketing.
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent.
• Right to lodge a complaint: File a complaint with your local data protection authority.

7.2 Under the CCPA (California Users)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA:

• Right to know: Request disclosure of the categories and specific pieces of personal data we have collected about you.
• Right to delete: Request deletion of your personal data, subject to certain exceptions.
• Right to correct: Request correction of inaccurate personal data.
• Right to opt-out: Opt out of the sale or sharing of your personal data for cross-context behavioral advertising. We do NOT sell your personal data.
• Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise your CCPA rights, contact us at info@pinealos.com. We will verify your request using the email address associated with your account.

7.3 Under the KVKK (Turkey Users)

If you are a resident of Turkey, you have the following rights under Article 11 of the Personal Data Protection Law (KVKK No. 6698):

• Learn whether your personal data is processed
• Request information about processing activities
• Learn the purpose of processing and whether data is used for its intended purpose
• Request correction of incomplete or inaccurate data
• Request deletion or destruction of your data
• Request notification of correction/deletion to third parties
• Object to processing that causes detriment
• Request compensation for damages caused by unlawful processing

You may file a complaint with the Turkish Personal Data Protection Authority (KVKK) at www.kvkk.gov.tr.

8. Children's Privacy

Our Platform is not directed to children under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us immediately.

9. AI Training and Customer Data

We do NOT use your project files, code, chat history, or any customer data to train or improve AI models. Your API keys connect directly to third-party AI providers (DeepSeek, OpenAI, Anthropic, etc.) under your own account. We act solely as an intermediary — your AI queries and generated code are processed through your API provider under their terms and privacy policy.

API keys and tokens you provide (for AI providers, GitHub, Cloudflare) are stored encrypted in your browser's local storage and transmitted securely to our servers only when necessary to facilitate the services you request. They are never used for any other purpose.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption at rest and in transit (TLS 1.3)
• Encrypted storage of API tokens and secrets
• Regular automated backups to Cloudflare R2 and GitHub
• Access controls and authentication for administrative access
• Data minimization: we only collect data necessary for service provision

11. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by Article 33 of the GDPR and Article 12 of the KVKK.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or through the Platform. We encourage you to review this policy periodically.

13. Contact

Email: info@pinealos.com
Response time: We will respond to your request within 30 days (or as required by applicable law).