DPA
Data processing summary
Last updated · PKJMB MEDIA PRIVATE LIMITED
Draft · not yet reviewed by a lawyer
A plain summary of how Pinnakle OS handles data on behalf of the agencies that use it. It is part of the Terms of service and applies automatically to every workspace.
1.Roles
For the content a workspace holds (its team, clients, leads, files, messages), the agency is the Data Fiduciary (it decides why and how that data is used) and PKJMB MEDIA PRIVATE LIMITED is its Data Processor. We process that data only on the agency’s documented instructions: using the product, and the settings the agency chooses, are those instructions. For account and billing data of the person who signs up, we are the Data Fiduciary, as the Privacy policy explains.
2.What is processed
- Subject matter and duration: running the workspace, for as long as the subscription or free plan lasts, plus the deletion periods below.
- Data subjects: the agency’s team members, its clients and their staff, and its leads.
- Types of data: names, contact details, job titles, photos, messages, files, briefs, reports, calendar entries, lead details, and any other content the agency adds.
- Purpose: to provide the service described in the Terms of service.
3.Our commitments as Processor
- Process the data only for the purposes above and on the agency’s instructions, unless the law requires otherwise (and tell the agency first where allowed).
- Keep everyone who can access the data bound by confidentiality.
- Apply the security measures on our Security page, which meet the “reasonable security practices” of the IT Act 2000 and the SPDI Rules 2011 and the safeguards the DPDP Act 2023 expects.
- Help the agency answer data-principal requests (access, correction, erasure, grievance). Owners can do most of it in the app; we help with the rest.
- Make available the information needed to show we follow these terms.
4.Sub-processors
The agency agrees we may use these sub-processors. We bind each to terms that protect the data to a similar standard, and we update this list, and email workspace owners, before adding one.
| Company | Service | Location |
|---|---|---|
| Supabase | Database, sign-in (authentication) and file storage | Tokyo, Japan (AWS ap-northeast-1) |
| Vercel | Application hosting and delivery | Global edge network; functions run in the region we choose |
| Razorpay | Payment processing for subscriptions and credit packs | India |
| Resend | Sending product emails (invites, digests, receipts) | United States |
| OpenRouter | Routing AI requests to the model providers below | United States |
| Anthropic | AI model provider: reads the text you ask the AI features to work on | United States |
5.International transfers
Data is stored in Tokyo, Japan and processed by sub-processors in India, Japan and the United States. The agency authorises these transfers. We will not transfer data to any country the Central Government restricts under section 16 of the DPDP Act.
6.Personal data breach
If we become aware of a breach affecting the agency’s data, we notify the workspace owner without undue delay, and aim to do so within 72 hours of confirming it, with what happened, the data and people involved, what we have done and what the agency should do. We help the agency meet its own duty to inform the Data Protection Board of India and affected people.
7.Audits
We answer reasonable written questions about our practices once a year, and after a breach. On-site audits are not offered while all data sits with our hosting providers; their independent certifications are available on request.
8.Return and deletion
On request or when the workspace ends, we provide an export of the agency’s data, then delete it from live systems within 30 days and from backups within 90 days, except what the law requires us to keep (such as tax records for billing).
9.Contact and a signed copy
Need this as a signed agreement for your own records or a client’s? Email pinnaklemedia@gmail.com. Notices to us go to the same address, or to PKJMB MEDIA PRIVATE LIMITED, G-1 Keshav Krupa Apartment, Doddanekundi, Bengaluru, Karnataka 560037.