Why this exists
When your practice uses Pinsta on your clients’ information, you are the controller and we are your processor. UK GDPR requires a written contract between us. This is it, and it forms part of our terms of service.
You may need to show this to your own clients, your insurer or an auditor. It is written to be handed over.
Which parts apply to you
There are two sets of terms in this agreement, and which ones bind us depends on what your practice switches on. They are different in a way that matters, so it is said here rather than left to be discovered further down.
- Pinsta Lock is the product as most practices use it. Documents are encrypted in the browser on the machine that exported them. They are never uploaded and never reach us. Everything below marked Pinsta Lock applies to every practice.
- Pinsta Mail is optional, separately enabled and separately charged. It locks attachments as they leave your mailbox, which it cannot do without reading them. With Pinsta Mail, your clients' documents do pass through our servers. Everything below marked Pinsta Mail applies only if you have enabled it.
If you have not enabled Pinsta Mail, the Pinsta Mail terms do not apply to you and your clients' documents never reach us. You can check which is which on your billing page, and turning Pinsta Mail off returns you to the Pinsta Lock terms from that moment.
Pinsta Mail is not yet available. These terms are written ahead of it so that a practice can read them before deciding, rather than being asked to agree to something on the day.
What we process, and for how long
- Subject matter: protecting documents your practice exports, and recording that it happened.
- Duration: for as long as your practice has an account, and the retention periods in our privacy notice afterwards.
- Nature and purpose, Pinsta Lock: storing an encrypted PIN for each client, applying it to documents on your own machines, keeping an activity log, and sending one-time PIN links when you ask.
- Nature and purpose, Pinsta Mail: additionally, receiving mail your practice sends, examining its attachments, applying the client's PIN to any that are not already protected, and passing the message on. Attachments are held only for as long as that takes and are not stored.
- Data subjects: people at your practice, and the people your accounting software lists on your client organisations.
- Categories of data: names, email addresses, roles, client organisation names, encrypted client PINs, and activity records including IP address and browser. With Pinsta Mail, additionally: the messages your practice sends through it and the contents of their attachments, for the moments it takes to protect them.
- Special category data, Pinsta Lock: none is required or requested, and because documents never reach us, none reaches us in them.
- Special category data, Pinsta Mail: still none is required or requested, but this is a real difference and we will not pretend otherwise. A document you send through Pinsta Mail passes through our servers, and if it happens to contain special category data, that data passes through with it. We do not look for it, do not store it and do not keep the attachment. If your practice handles work where that is unacceptable, do not enable Pinsta Mail: Pinsta Lock protects the same documents without them ever leaving your machines.
What we will do
- Process your data only on your documented instructions, including these terms, unless the law requires otherwise, in which case we will tell you first unless prevented.
- Keep everyone who handles it under a duty of confidence.
- Take the security measures described below.
- Not engage another processor without telling you first and giving you a chance to object.
- Help you answer requests from data subjects, and help you with security, breach reporting and impact assessments.
- Tell you without undue delay if there is a personal data breach, and in any event within 24 hours of becoming aware of it.
- Delete or return your data when the service ends, and delete existing copies unless the law says we must keep them.
- Make available what you need to show we are meeting these obligations, and allow audits on reasonable notice.
The security measures
These are the controls this product is actually built on, not a generic list.
The first one differs between the two services, and it is the one everything else rests on.
- Documents never reach us, with Pinsta Lock. Encryption is performed in the browser on the machine that exported the file, using AES-256. There is no upload, so there is nothing on our side to lose.
- Documents do reach us, with Pinsta Mail. Locking an attachment in transit cannot be done without reading it, so this is not a limitation we can engineer away. What we do instead: attachments are processed in memory and never written to disk, they are not retained after the message is sent on, the processing happens in the United Kingdom, and an attachment that is already protected is passed through untouched rather than opened. A file you have already locked with Pinsta Lock is therefore never read by us even with Pinsta Mail enabled.
- PINs are encrypted at rest with a key held outside the database. A copy of the database yields no usable PINs.
- Our own staff cannot read a PIN. Support can see that a PIN exists and when it changed, not what it is.
- Every table denies access by default. Row level security is on and refuses everything; only our server functions, acting on an authenticated request, can read anything, and only for the practice that asked.
- Client links are single use. They are stored only as a hash, expire within an hour, and can be revoked.
- Everything is logged. PINs created, changed, viewed and sent, with who and when.
- Two-factor authentication is available on accounts, and sign-in is handled by our authentication provider rather than by us storing passwords.
Who else is involved
We use these sub-processors. We remain responsible to you for what they do.
- Supabase. Database, sign-in and the server functions. Personal data is stored here. Hosting region: London, United Kingdom (eu-west-2)
- Cloudflare. Website hosting, and the bot check on the waitlist form. Serves the pages and screens the sign-up form. No account data is stored.
- Stripe. Subscriptions and payment. Billing name, address and card details go directly to Stripe. Pinsta never sees or stores a card number.
- Resend. Sending email. The address a message is sent to, and the message itself. Used for sign-in emails and, when a practice asks, a one-time PIN link to their client.
If we add or change one, we will tell you before it starts processing your data, and you may object.
Pinsta Mail will add to this list. A service that receives your mail needs somewhere to run and something to receive it from, and neither is named above because neither exists yet. They will be named here, with their region, before Pinsta Mail processes anything of yours, and the obligation in the paragraph above applies to them exactly as it does to the four already listed.
Transfers outside the UK
Where a sub-processor processes personal data outside the UK, we rely on the UK adequacy regulations where they apply, and otherwise on standard contractual clauses with the UK international data transfer addendum.
The database and server functions are hosted in London. Where a sub-processor operates outside the UK in the course of delivering its service, that transfer relies on the UK’s adequacy regulations or on standard contractual clauses with the UK addendum.
Pinsta Mail will process attachments in the United Kingdom. That is a deliberate choice rather than an inherited one: it is the first part of Pinsta that holds a client document at all, so where it runs is a decision, and it is being made the same way as the database. If that ever has to change, it is a change to this agreement and you will be told before it takes effect.
If Pinsta changes hands
Pinsta is operated by Pinsta Ltd. If the business transfers to a company that acquires it, this agreement transfers with it and the new operator is bound by it on the same terms.
We will tell you by email before that happens. It is written this way deliberately: if our terms of service could move and this agreement could not, you would be left holding a processor contract with somebody who no longer runs the service.
Ending it
When your account closes you can ask for your data back, and we will delete it within the period in our privacy notice. Documents you have already protected are unaffected: they are yours, they are on your machines, and they keep working.