The privacy of your data is a big deal to us. In this policy, we lay out what data we collect and why, how your data is handled, and your rights with respect to your data. We never sell your data, and we never use it to train AI models.
This policy is split into sections:
- What we collect and why
- When we access or disclose your information
- Your rights with respect to your information
- How we secure your data
- What happens when you delete your account
- Data retention
- Location of site and data
- Children
- California disclosures
- Changes and questions
This policy applies to PineSpark Inc. ("PineSpark", "we", "us") and to the websites, apps, and services we run, including the PineSpark Agent Store at pinespark.com and the PineSpark app (together, the "Services"). It covers our handling of information about site visitors, prospective customers, and customers and their users. We refer collectively to these people as "you" throughout this policy. Your use of the Services is governed by our Terms of Service.
This policy does not cover information about other individuals that an Agent processes on a customer's behalf, such as people whose emails are in a connected inbox or contacts in a connected CRM. We process that information under the instructions of the customer who operates the Agent and under our Terms of Service. That customer is responsible for the information. If your information came to us through a PineSpark customer, please contact that customer.
What we collect and why
Our guiding principle is to collect only what we need. Here's what that means in practice:
Identity and access
When you sign up for PineSpark, we ask for your email address and, later, your name. We use this information to create and manage your account, sign you in, and send you essential information about your account, billing, security, and changes to the Services. We may also send you product news, and you can unsubscribe from it at any time.
We'll never sell your personal information to third parties.
Billing information
If you subscribe to a paid plan, you provide your payment details to our payment processor, Stripe. Stripe receives your card details; we do not store them. Stripe shares the information we need for billing, such as your name, billing address, and the last four digits of your card. We keep a record of each payment for account history, invoices, billing support, and tax purposes.
Agents, connected services, and your content
When you create, adapt, or run an Agent, we store its instructions and the settings you choose so it can use them when it runs.
When you connect a service, such as an email, chat, accounting, or CRM tool, we store the access credentials the service provides so your Agents can act in that service on your behalf. You can disconnect a service at any time.
When an Agent runs, it reads and sends data in your connected services according to your instructions and settings. An Agent can make mistakes and may read or send data in ways you did not expect. We store each run as part of the Agent, including the data the Agent read and produced, so the Agent can use it in later runs. We keep an Agent, with everything stored in it, until you delete the Agent or your account, or your account ends under our Terms of Service. When you delete an Agent, we delete or anonymize it and everything stored in it within 30 days, including the copies in our backups.
To run Agents, we send the data needed for each task to our AI model providers, OpenAI and Anthropic. They process it to produce the Agent's output. Under their standard API terms, they may keep this data for a limited time, for example, to detect abuse, but they do not use it to train their models. We never use your data, your Agents' instructions, or their output to train AI models.
We use information about how the Services and Agents perform, such as errors, timing, and usage counts, to maintain and improve PineSpark.
Website interactions
When you visit our websites, we record the pages you view, the website that referred you to us, and technical information such as your browser, operating system, and IP address. We use this information to understand how visitors use our websites and to keep them secure. We do not share it with anyone outside PineSpark except as described in When we access or disclose your information, and we never give it to analytics or advertising companies.
Account security and logs
Our servers log requests and the IP addresses they come from so we can keep the Services running, secure accounts, and prevent fraud.
Cookies
A cookie is a small piece of text stored by your browser. We use cookies to keep you signed in, remember your preferences, and record the choice you made in our cookie banner. We do not use advertising cookies. When you pay for a plan, Stripe's payment code, whether on our pages or on Stripe's own checkout page, may set Stripe's own cookies and collect information about your device and your activity on those pages, which Stripe uses to prevent fraud and keep payments secure. Apart from that, we do not allow third parties to track you on our websites. You can block cookies in your browser settings, but some parts of the Services will not work without them.
Voluntary correspondence
When you email us with a question or to ask for help, we keep that correspondence, including your email address, so that we have a history of past correspondence to reference if you reach out in the future. If you delete your account, we delete or anonymize that correspondence as described in What happens when you delete your account.
When we access or disclose your information
To provide the Services. We use service providers to run the Services: cloud hosting providers that operate our servers in the United States, Stripe for payments, and OpenAI and Anthropic for the AI models our Agents use. Each provider receives only the information it needs to provide its service to us.
At your direction. When your Agents work in a connected service, they send data to that service and to the people they contact, according to the instructions and settings you provide. Because an Agent can make mistakes, it may also send data in ways you did not expect. Data an Agent sends to a connected service is also held by that service under its own terms and privacy policy.
Employee access to your content. No PineSpark employee looks at your content except for limited purposes: to help you with a support request, with your permission; to fix an error that stops an automated process and requires manual intervention; to investigate a breach of our Terms of Service; or when required by law.
To investigate, prevent, or take action regarding restricted uses. Accessing a customer's account to investigate potential abuse is a measure of last resort. If we discover that someone is using the Services in a way prohibited by our Terms of Service, we will take action as necessary, including notifying the appropriate authorities where warranted.
Aggregated and de-identified data. We may aggregate or de-identify information about how the Services are used. We may use that aggregated or de-identified information to maintain, improve, and promote the Services, including in marketing and analytics, but never to train AI models.
When required by law. PineSpark is a U.S. company, and all our data infrastructure is located in the U.S. We disclose information when legally required, such as in response to a valid subpoena, court order, or warrant. Unless prohibited by law, we will notify the affected customer before disclosing its data in response to legal process, and we will try to notify any other affected person. If a tax authority audits us, we may be required to disclose billing information, and we will disclose only the minimum needed.
To protect our rights. We may share information with our lawyers, accountants, and auditors, and with an arbitrator, an arbitration provider, or a court, as needed to enforce our Terms of Service or bring or defend a legal claim.
In an acquisition or merger. If PineSpark is acquired by or merges with another company, we will notify you before any of your personal information is transferred or becomes subject to a different privacy policy.
Customer references. As our Terms of Service allow, we may name your business and show its logo as a PineSpark customer in our marketing.
Your rights with respect to your information
- You can review and update your account information at any time in your account settings.
- You can request a copy of the personal information we hold about you or ask us to correct it by emailing legal@pinespark.com.
- You can delete your account at any time. We then delete or anonymize your personal information as described in What happens when you delete your account.
- You can unsubscribe from product news at any time using the link in each message. You will continue to receive essential account messages for as long as you have an account.
- We will not treat you differently because you exercise these rights.
We may need to verify your identity before we respond to a request, for example by confirming that the request came from the email address on your account. If we cannot verify your identity, we may be unable to respond to your request.
How we secure your data
We encrypt all data transmitted between your browser and our servers using TLS. We use reasonable technical and organizational measures to protect your data, but no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
What happens when you delete your account
When you delete your account, we delete or anonymize your personal information and content within 30 days, including copies in our backups. If we have named your business as a PineSpark customer in our marketing, we stop using its name and logo in new marketing materials within the same 30 days. We keep records that the law requires us to keep, such as payment records for tax purposes, for as long as required by law.
Data retention
While your account is active, we keep your information for as long as we need it to provide the Services. After you delete your account, we delete it as described in What happens when you delete your account, except for records we must keep by law.
Location of site and data
We operate the Services in the United States and offer them only to businesses located in the United States. We store your information on servers in the United States. Our AI model providers may process the data an Agent sends them in other countries.
Children
The Services are intended for businesses and are not directed to children. You must be at least 18 years old to use them. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected such information, we delete it.
California disclosures
- We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
- We do not share personal information with third parties for their own direct marketing purposes.
- Our websites do not track you across other websites or allow third parties to do so. They therefore treat all visitors the same, whether or not their browsers send a Do Not Track signal.
Changes and questions
We may update this policy as needed to comply with relevant regulations and to reflect new practices. Whenever we make a significant change, we will update the date at the top of this page and notify users by email or within the Services. If a change would allow us to use information we already hold more broadly, we will ask for your consent before using that information in the new way.
Have any questions, comments, or concerns about this privacy policy, your data, or your rights with respect to your information? Please get in touch by emailing us at legal@pinespark.com.
This privacy policy is adapted from the Basecamp open-source policies / CC BY 4.0, namely the 37signals privacy policy, which 37signals LLC publishes under the Creative Commons Attribution 4.0 International License. PineSpark Inc. has modified it. 37signals does not endorse PineSpark or this policy.