Privacy policy

1.Who we are

PKJMB MEDIA PRIVATE LIMITED (“Pinnakle”, “we”) runs Pinnakle OS, software that video and content agencies use to run their work. Registered office: G-1 Keshav Krupa Apartment, Doddanekundi, Bengaluru, Karnataka 560037. CIN: U90009KA2023PTC182607.

Two roles matter in this policy. For the account details of the person who signs up and for billing, we are the Data Fiduciary (the DPDP Act’s word for the party that decides why and how personal data is used). For everything an agency puts into its workspace (its team, clients, files, messages), the agency is the Data Fiduciary and we are its Data Processor; our Data Processing summary covers that part.

2.What we collect

• Account data: name, email address, password (stored only as a hash, or held by our sign-in provider), phone number if you add one, job title, profile photo, time zone.
• Workspace content that you or your team add: clients, briefs, files and footage links, comments, chat messages, calendar entries, leads, reports, vault entries (encrypted).
• Billing data: plan, invoices, GSTIN and billing address you give us. Card and UPI details are entered on Razorpay’s page and never reach our servers.
• Technical data: sign-in times, IP address, browser type and error logs, kept to run and secure the service.

3.Why we use it (purpose limitation)

We use personal data only for these purposes, and not for anything incompatible with them:

• to create your account, sign you in and run the workspace you use;
• to take payment, issue GST invoices and keep the records the law requires;
• to send product emails you need (invites, receipts, approvals, daily digests you switch on);
• to keep the service secure, prevent abuse and fix faults;
• to answer your requests and complaints.

We do not sell personal data, do not show advertising and do not use workspace content to train AI models.

4.Consent and lawful use

We process your data on the basis of your consent given when you sign up or accept an invite (free, specific, informed, and with a clear notice, as section 6 of the DPDP Act requires), and for the “legitimate uses” the Act allows, such as performing a contract you asked for, complying with law and responding to a security incident.

You can withdraw consent at any time by emailing us or deleting your account. Withdrawing does not undo what was lawfully done before, and some features stop working because they need the data. If you are under 18, a parent or guardian must give consent; we do not knowingly offer the service to children.

5.AI features

When you press an AI button (an analysis, a summary, a drafted update, “Ask AI”), the text you ask about is sent to an AI model provider through our routing partner and the answer comes back. That is the only time workspace text leaves our own infrastructure for this purpose. Providers are listed in the sub-processor table below; we use providers whose API terms do not allow training on the content sent to them.

6.Who we share it with (sub-processors)

We share data only with the companies below, to the extent needed to run the service. Each is bound by a data-processing agreement or equivalent terms.

We may also disclose data when a court or authority lawfully requires it, or to protect people from harm. We will tell the affected workspace first where the law allows.

7.Where your data lives (cross-border transfer)

Our primary database and file storage run on Supabase in Tokyo, Japan. The application is served by Vercel from its global network, and some sub-processors operate from the United States. So your personal data is transferred outside India. The DPDP Act permits this to any country the Central Government has not restricted; if a restriction is notified for a country we use, we will move the affected data or stop using that provider. Transfers are encrypted in transit, and storage is encrypted at rest.

8.How long we keep it (retention)

• Active workspace: for as long as the account is open.
• After you delete a workspace or account: removed from live systems within 30 days and from backups within 90 days, except billing records.
• Invoices and tax records: 8 years, because Indian tax law requires it.
• Security and sign-in logs: up to 12 months.

9.Your rights as a Data Principal

Under the DPDP Act 2023 you have the right to:

• Access a summary of the personal data we process and who we shared it with;
• Correct inaccurate or incomplete data, and complete or update it;
• Erase data we no longer need for the purpose it was given;
• Grievance redressal: a response from us before you go to the Data Protection Board of India;
• Nominate another person to exercise your rights if you die or become unable to.

To use a right, write to the Grievance Officer below from the email on your account. We confirm within 48 hours and answer within 30 days. Most of this you can also do yourself: edit your profile under My profile, and workspace owners can export or delete the workspace from Settings.

10.How we protect it

Every workspace’s data is separated at the database level, traffic is encrypted, vault secrets are encrypted before they are stored, access is by role, and sign-ins are rate-limited. The details are on our Security page. These are the “reasonable security practices” that the IT Act 2000 (section 43A) and the SPDI Rules 2011 ask for; no system is perfectly secure, and we do not promise otherwise.

11.If something goes wrong (breach notice)

If we find a personal data breach, we will tell the Data Protection Board of India and each affected workspace owner or person without undue delay, in the form the law prescribes, with what happened, what data was involved, what we have done and what you can do. We aim to notify affected workspaces within 72 hours of confirming a breach. Report anything suspicious to pinnaklemedia@gmail.com.

12.Cookies

We use only strictly necessary cookies (to keep you signed in and remember your theme). No advertising or tracking cookies. See the Cookie notice.

13.Grievance Officer

In line with the Information Technology Act 2000, the SPDI Rules 2011 and the DPDP Act 2023, our officer for complaints and data-principal requests is:

• Name: Jayanth M B
• Designation: Director
• Email: pinnaklemedia@gmail.com
• Phone:
• Address: G-1 Keshav Krupa Apartment, Doddanekundi, Bengaluru, Karnataka 560037

If we do not resolve your complaint, you may approach the Data Protection Board of India once it is constituted and accepting complaints.

14.Changes to this policy

When we change this policy in a way that matters, we will email workspace owners and update the date above before the change applies. Older versions are available on request.