Informativa sulla privacy

Who is responsible

Pinns — «Pins & Inns», «we» — decides why and how the data described here is used. Questions about this notice, and any request about your data, go to privacy@pinns.io.

Pinns is a marketplace: hosts and activity providers use it to offer their own services. For their own bookings and messages, they decide things independently of us, so both of us are responsible for our own part.

What we collect and why

• Account — email, username, password (stored only as a hash), and the provider identifier if you sign in with Google or GitHub. Needed to give you an account.
• Profile — whatever you choose to add: avatar, languages, interests, countries visited, social links.
• Bookings — dates, guest count, and the guest name and phone the host needs to receive you. Without them a booking cannot be made.
• Messages — chats with hosts and with our assistant, kept so the conversation survives and so we can look into a dispute.
• Payments — amounts, currency and status. Card numbers never reach us: they go straight to the payment provider. Crypto payments carry a public wallet address.
• Verification — for hosts, the identity documents required to pay out earnings.
• Technical — IP address, device and browser, and a device fingerprint used to keep sessions apart and to stop account takeover.
• Usage — pages opened and steps completed, but only if you accept analytics. See the Informativa sui cookie.

On what legal basis

• Performing our contract — accounts, bookings, payments, messages, support.
• Legal obligation — tax and accounting records, and identity checks where the law requires them.
• Legitimate interest — keeping the service secure, preventing fraud and abuse, and defending legal claims.
• Consent — analytics and session recording. You can refuse, and refusing changes nothing about your ability to book.

Who else sees it

We do not sell personal data. It reaches the parties below only to the extent each of them needs.

A payment settled on a public blockchain cannot be erased or hidden afterwards. Consider that before paying with crypto.

Sending data abroad

Pinns operates across Europe and South-East Asia, so data crosses borders by design: a booking in Thailand made from Germany is visible to a host in Thailand. Where a recipient sits outside the European Economic Area, transfers rely on the European Commission's standard contractual clauses or an adequacy decision. A copy of the safeguards is available on request.

How long we keep it

• Account and profile — while the account exists, then 30 days after you close it.
• Bookings, payments and invoices — for as long as the tax and accounting law that applies to us requires. This one we cannot shorten on request.
• Messages — while the account exists, or until you delete the conversation.
• Analytics — 12 months from the event.
• Session recordings — 30 days, with every form input masked.

Your rights

You can ask for a copy of your data, correct it, have it deleted, restrict or object to its use, take it elsewhere in a portable form, and withdraw consent at any time. We answer within one month.

Write to privacy@pinns.io. If our answer does not satisfy you, you may complain to a supervisory authority — in the EU, the one where you live or work; in Thailand, the PDPC; in Indonesia, Komdigi; in Singapore, the PDPC; in Vietnam, the Ministry of Public Security; in the Philippines, the National Privacy Commission.

Deletion has limits we cannot lift: an entry already written to a public blockchain stays there, and records we must keep for tax purposes stay for their statutory period.

Children

Pinns is not for people under 18. If you believe a child has created an account, write to us and we will remove it.

Changes

When this notice changes materially we say so in the product before the change takes effect. The date above always shows the current version.