Legal
What Pinsta collects, why, and what it deliberately does not.
Last updated 23 September 2026. What changed: this notice now covers two services, Pinsta Lock and Pinsta Mail, and says plainly which applies. If your practice uses Pinsta Lock only, which is every practice today, nothing about what we hold has changed.
Pinsta is operated by Pinsta Ltd, of BizSpace, Belvedere House, Basing View, Basingstoke, RG21 4HG.
We are the data controller for the information described here.
Any question about this notice: secure@pinsta.co.uk.
Your clients’ documents never reach us, with Pinsta Lock. Encryption happens in the browser on the machine that exported the file. We do not receive it, store it, or have any way to read it. This is how every practice uses Pinsta today.
With Pinsta Mail, they do. Pinsta Mail is optional and separately enabled, and it locks attachments as they leave your mailbox, which cannot be done without reading them. They are processed in the United Kingdom, held in memory only for the moments that takes, never written to disk and never kept. An attachment that is already protected is passed through untouched. If your practice has not enabled Pinsta Mail, none of this applies to you.
We cannot read the PINs either. They are encrypted before they are written down, and our own staff can see that a PIN exists and when it changed, not what it is.
There is no tracking. No analytics, no advertising pixels, no third-party trackers on any of our pages.
If you join the waitlist: your email address, and optionally your name, practice name, which software you use and roughly how many clients you look after. Whether you asked for occasional updates is stored alongside the exact wording you agreed to.
If you have an account: your name, email address, your role in the practice, and any additional email addresses you add so that your accounting software can recognise you.
About your clients: the name of each client organisation your accounting software lists, and an encrypted PIN for each. We do not hold your clients’ documents or their contents. If your practice enables Pinsta Mail, we additionally receive the messages you send through it and the contents of their attachments, for as long as it takes to protect them and no longer. We do not store them and we do not keep a copy.
A record of what happened: when a PIN was created, changed, viewed or sent, and by whom, together with the IP address and browser the action came from. This is the log a practice can be asked to produce, so it is deliberately kept.
If you write to us: anything you send through the suggestion box, with your email address and practice name so we can reply.
If you subscribe: billing details are handled by Stripe. We receive confirmation of a subscription and its status. We never see or store card numbers.
The Chrome extension is the part of Pinsta that does the locking, and it is the part people most often want to know about. This is everything it touches.
Where it runs. Only on the accounting sites named in its permissions: Xero, Karbon and QuickBooks Online, and our own service. It does not run on any other website, and it cannot see any other tab you have open.
What it reads on those pages. Enough to work out which client organisation the page belongs to, and no more. For Xero and Karbon that is in the address bar. For QuickBooks Online it is in the page’s own configuration, which is why a content script is needed there. It does not read the contents of your clients’ documents, your reports, or anything else on the page.
What it keeps on your computer. Your signed-in session, your own preferences such as whether locking is automatic, and a short-lived copy of your client list so it does not have to fetch it on every page. Anything sensitive is held in session storage, which does not survive the browser closing.
What it sends us. Which client a document belongs to, so we can return the right code, and a note of the machine it is installed on so your practice can see which computers are covered. It does not send us the contents of the pages you visit, your browsing history, or anything about sites outside the ones listed above.
What it never does. There is no analytics, no advertising, no tracking and no telemetry of any kind in the extension. It does not run any code that is not inside the package you installed.
The folder you choose. Automatic locking needs somewhere to save locked copies, and Chrome will not give an extension access to a folder unless you pick one yourself. The extension can write files into that folder and read the ones it has just written. It cannot see anything else on your computer.
We use a small number of services to run Pinsta. Each processes data only on our instructions.
Pinsta Mail will add to this list. A service that receives your mail needs somewhere to run and something to receive it from, and neither is named above because neither exists yet. Both will be named here, with their region, before Pinsta Mail processes anything of yours.
Your accounting software, such as Xero or Karbon, is connected by you and remains yours. We read from it with your permission; we do not send your data to it.
Our database and server functions are hosted in London and your data is stored there. Where a provider processes data outside the UK in the course of delivering its service, that transfer relies on the UK’s adequacy regulations or on standard contractual clauses with the UK addendum.
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on consent you can withdraw it at any time.
Write to secure@pinsta.co.uk and we will respond within one month.
If a practice uses Pinsta on documents belonging to you as their client, that practice is the controller for that information and you should contact them first. We will help them answer you.
You can also complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you told us first so we can put it right.
We use no analytics, advertising or tracking cookies, so there is no consent banner on this site.
When you sign in to the app, your browser stores a session so that you stay signed in, and remembers a device you have marked as trusted. These are necessary for the service to work and are not used for anything else. Cloudflare’s bot check on our sign-up form sets a cookie for the same reason.
If we change this notice we will update the date at the top, and if the change matters we will tell account holders by email rather than quietly amending the page.