LEGAL
Privacy policy
Last updated: 28 September 2026
This policy explains what personal data Pinoda holds, where it comes from, why we use it, who else handles it, how long we keep it, and how to have it removed. It covers visitors to this website, people who write to us or book a call, and professionals we contact about our services.
1. Who is responsible
Pinoda, part of AIDA Growth, is operated by MF HANDEL DEVELOPMENT SRL, Romania. It is the controller of the personal data described here. For anything in this policy, write to hello@pinoda.io.
2. Visiting this website
This website sets no cookies, runs no analytics and loads nothing from other companies: even its fonts are served from our own server. Our servers do not receive your IP address, because the load balancer in front of them replaces it with its own, and we build no profile of visitors. See the cookie policy.
The website is hosted in Germany. Links to Calendly and AIDA Growth take you to other websites, which have their own policies.
3. When you write to us or book a call
If you email us, we receive your name, email address and whatever you write. If you book a call through Calendly, we receive your name, email address, the time you chose and any notes you add.
We use this to answer you and to hold the call. The legal basis is taking steps at your request before a possible contract (Article 6(1)(b) GDPR), or, for a general question, our legitimate interest in replying to it (Article 6(1)(f)). We keep it for 24 months after our last contact.
4. If we contacted you first
We contact business professionals whose role makes our services relevant to them, on LinkedIn and, where the law allows, by business email. If we contacted you, this is what we hold and why.
What we hold: your name, job title, company, location, the URL and professional content of your public LinkedIn profile, your business email address if we found one, the messages we exchanged, and our own notes, including a fit score.
Where it came from: your public LinkedIn profile, LinkedIn searches (including Sales Navigator), and your company’s public website. Public profile data is collected with the help of Apify.
Why, and on what basis: to offer our services to businesses. The legal basis is our legitimate interest in business-to-business prospecting (Article 6(1)(f) GDPR). We keep this limited: only professional information, a short sequence of messages, which stops as soon as you reply, and an easy way to say no.
AI: an AI model helps us judge how well your company fits and reads the intent of replies. A person decides what happens next. No decision with legal or similarly significant effects on you is made automatically.
You can object at any time, without giving a reason. Reply “stop” to any message or write to hello@pinoda.io. We will stop contacting you and delete your data within 30 days. We keep only your LinkedIn profile URL on a do-not-contact list, so that we never contact you again.
Until we finish removing it, our team receives internal alerts through Telegram that can include a prospect’s name and reply. We are removing personal data from these alerts.
5. Campaigns we run for our clients
When we run outreach for a client, the client decides who is contacted and why. It is the controller of that data, and we process it on its behalf under a data processing agreement. The client’s own privacy notice applies. If you were contacted on a client’s behalf, you can ask that client, or write to us and we will pass your request on promptly.
6. Who handles the data for us
We use these service providers. Each processes personal data only to provide its service to us:
| Provider | What it does for us | Where |
|---|---|---|
| Hetzner Online GmbH | Hosts this website, our automation and our database | Germany |
| Cloudflare, Inc. | Routes email sent to our address | USA |
| Google LLC | Email inbox and spreadsheets holding prospect lists | USA |
| Calendly LLC | Call bookings | USA |
| LinkedIn Ireland | Source of professional profiles; where we send messages | Ireland |
| Apify Technologies s.r.o. | Collects public professional profile data | Czech Republic |
| HeyReach | Sends and tracks LinkedIn messages | USA and North Macedonia |
| Instantly | Sends and tracks business email | USA |
| Airtable, Inc. | Records of prospects and conversations | USA |
| Anthropic, PBC | AI that scores fit and reads replies | USA |
| Telegram | Internal alerts to our team (being removed, see section 4) | Outside the EEA |
We do not sell personal data, and we do not share it with anyone else, unless the law requires us to.
7. Transfers outside the European Economic Area
Several of these providers are outside the European Economic Area. Where a provider is certified under the EU–U.S. Data Privacy Framework, the transfer relies on that framework; otherwise it relies on the European Commission’s Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply.
8. How long we keep it
| Data | Kept for |
|---|---|
| Emails you send us and calls you book | 24 months after our last contact |
| A prospect who does not reply, or says no | 90 days after our last contact |
| Our do-not-contact record | Indefinitely, but only your LinkedIn profile URL, a status and a date, so that we never contact you again |
| If you ask us to delete your data | Deleted within 30 days; only the do-not-contact record is kept |
| Contact lists in our outreach tools | 90 days after the campaign ends |
| Raw results of data collection | 7 days |
| Run history of our automation | 14 days |
| Database backups | 30 days, after which they expire; backups are not edited |
| If you become a client | For the business relationship, and for as long as Romanian accounting law requires for invoices |
9. Your rights
You have the right to access your personal data, to have it corrected or deleted, to restrict how we use it, to receive it in a portable format, and to object to our use of it, including for direct marketing, where your objection always wins. Write to hello@pinoda.io. We reply within one month.
You can also complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or to the authority in the EU country where you live or work.
10. Keeping it secure
Our systems run on our own servers in Germany. Access is limited to the people who need it, credentials are stored encrypted, and backups expire after 30 days.
11. Changes to this policy
When we change this policy, we update the date at the top. If a change affects how we use data we already hold, we tell the people concerned.