Effective Date: August 14, 2026
1. INTRODUCTION AND SCOPE
1.1. Purpose of this Policy.
This Privacy Policy (the "Policy") describes how the Pinkdude Group and its affiliates (collectively, "Provider", "We", "Us", or "Our") collect, use, process, store, transfer, and protect Personal Data when you access or use our proprietary cloud infrastructure, websites, APIs, and related services (collectively, the "Services").
This Policy is incorporated by reference into the Master Terms of Service (Document 2.1) and forms an integral part of the agreement between you and the Provider. By accessing or using the Services, you acknowledge that you have read and understood this Policy.
1.2. Role of the Provider (Controller vs. Processor).
To ensure clarity under the General Data Protection Regulation (GDPR) and other data protection laws, we act in two distinct capacities:
(a) Data Controller: We act as a Data Controller for the Personal Data we collect about You (the Customer) and your account administrators (e.g., registration details, billing information, usage logs, and device fingerprints). We determine the purposes and means of processing this data to manage your account and protect our Platform.
(b) Data Processor: We act as a Data Processor (or "Service Provider") for the content, files, emails, and databases you upload to our Services ("Client Data"). We process Client Data strictly on your behalf and in accordance with your instructions as defined in the Data Processing Agreement (Document 2.3). You are the Controller of Client Data.
1.3. The Contracting Entity (Data Controller).
The specific Pinkdude legal entity acting as the Data Controller for your Personal Data is determined by your billing location and currency, as strictly defined in the Contracting Entity Matrix within the Platform Framework (Document 0). For example, if you are located in the European Economic Area (EEA), your Controller may be Pinkdude Europe Ltd., whereas if you are in the United States, it may be Pinkdude Inc.
1.4. Business-to-Business (B2B) Context.
As established in Section 1.3 of our Master Terms, our Services are strictly for Trade, Business, or Professional Use. We do not knowingly market to or solicit consumers. While we protect the Personal Data of your Authorized Users (employees, contractors, agents) in accordance with applicable laws, our relationship is fundamentally commercial.
2. DATA WE COLLECT (DETAILED BREAKDOWN)
We collect data to provide the Services, enforce our Terms, prevent fraud, and comply with legal obligations. We categorize this data as follows:
2.1. Account & Identity Data (Provided by You)
When you register for an account, upgrade to a paid plan, or contact support, you provide us with:
(a) Profile Information: Full legal name, business email address, phone number, company name, job title, and password (hashed and salted).
(b) Identity Verification Data (KYC): To prevent fraud, money laundering, and platform abuse, we may require:
Government ID: A high-resolution copy of your Passport, Driver’s License, or National ID Card.
Biometric Data: A live video selfie or facial scan used solely to verify that your live face matches your ID photo. This biometric data is processed by our accredited third-party identity providers and is deleted immediately after verification, unless required for legal defense.
Business Proof: Incorporation documents, VAT/GST registration certificates, articles of association, or beneficial ownership information.
(c) Billing Information: Billing address, tax identification number (VAT/GST/EIN), and payment method details (e.g., credit card last-4 digits, expiration date). Note: We do not store full credit card numbers; payments are processed by PCI-DSS compliant payment gateways (e.g., Stripe, PayPal).
2.2. Technical Usage & Device Data (Automated)
When you access the Services via our website, API, or CLI tools, our systems automatically collect technical data to ensure security and performance:
(a) Device Fingerprinting: IP address, device type (Desktop/Mobile), operating system version, browser type, screen resolution, time zone setting, and unique device identifiers (UUID/MAC address).
(b) Network Logs: Timestamps of access, pages visited, API endpoints called, latency metrics, packet loss rates, and referral URLs (the site you came from).
(c) Traffic Pattern Data: We analyze the volume and nature of your data ingress/egress to detect anomalies such as Distributed Denial of Service (DDoS) attacks, Crypto-Mining signatures, or Botnet activity.
2.3. Referral & Behavioral Data
(a) Referral Chain: We cryptographically link your account to the user who invited you (and users you invite) to detect "Referral Abuse Rings" and enforce vicarious liability policies.
(b) Feature Usage: We track which tools you use (e.g., "User created a new VM," "User exported a report") to improve the user experience and identify popular features.
2.4. Client Data (Content)
(a) Hosting Utility: We host the files, emails, databases, code repositories, and media you upload to the Proprietary Infrastructure.
(b) Passive Processing: As a passive infrastructure provider, we do not access, view, or scan the content of your private Client Data for advertising or marketing purposes.
(c) Automated Hash Matching: Notwithstanding the foregoing, we may use automated, non-invasive hashing technologies (e.g., PhotoDNA) to scan file hashes against known databases of illegal content (e.g., CSAM, Malware signatures, Terrorist Content) to enforce our Acceptable Use Policy and comply with the EU Digital Services Act (DSA).
2.5. Cookies and Tracking Technologies
We use cookies, pixels, local storage, and software development kits (SDKs) to recognize you and secure your account.
(a) Essential Cookies: Necessary for login authentication, CSRF security tokens, and load balancing. You cannot opt-out of these.
(b) Analytical Cookies: Used to aggregate anonymous statistics about site traffic (e.g., Google Analytics, Matomo). You may opt-out of these via our Cookie Banner.
(c) Marketing Cookies: Used to show you relevant ads for our products on other sites. You may opt-out of these.
3. PURPOSES AND LEGAL BASES FOR PROCESSING
Under the GDPR and similar laws, we must have a valid legal basis for processing your data. We rely on the following:
3.1. Performance of a Contract (Art. 6(1)(b) GDPR)
We process your data to fulfill our contractual obligations under the Master Terms of Service:
(a) Provisioning: Creating your Tenant, allocating storage/compute resources, and routing traffic.
(b) Billing: Calculating usage fees, generating invoices, and processing payments.
(c) Communication: Sending critical service alerts (e.g., "Maintenance Scheduled," "Payment Failed," "Password Reset").
(d) Support: Responding to your support tickets and diagnosing technical issues.
3.2. Legitimate Interests (Art. 6(1)(f) GDPR)
We process data where it is necessary for our legitimate business interests, provided these are not overridden by your rights:
(a) Security & Fraud Prevention: Detecting compromised accounts, blocking spam botnets, stopping credit card fraud, and preventing "ban evasion" by analyzing device fingerprints.
(b) Infrastructure Protection: Monitoring CPU/RAM usage to identify and terminate accounts engaged in Crypto-Mining, AI Training abuse, or High-Frequency Trading that degrades platform performance for others.
(c) Legal Defense: Retaining audit logs and "banned user" records to defend against potential lawsuits, regulatory fines, or chargeback disputes.
(d) Product Improvement: Analyzing aggregated usage trends to decide which new features to build.
3.3. Legal Obligation (Art. 6(1)(c) GDPR)
We process data to comply with statutory requirements:
(a) Tax Compliance: Retaining financial records for 7-10 years as required by local tax authorities (e.g., HMRC, IRS, EU VAT rules).
(b) Sanctions Screening: Checking customer names against "Denied Party Lists" (OFAC, EU Sanctions) to comply with international trade laws.
(c) Content Moderation: Responding to "Notice and Takedown" orders under the DMCA or DSA regarding illegal content.
(d) Law Enforcement: Assisting police or courts with valid warrants regarding criminal investigations (e.g., Terrorism, CSAM).
3.4. Consent (Art. 6(1)(a) GDPR)
In specific cases, we may ask for your explicit consent:
(a) Marketing: Subscribing to our newsletter or promotional emails (you can withdraw consent at any time).
(b) Biometrics: Where required by local law, we ask for consent before processing biometric verification data.
4. SHARING AND DISCLOSURE OF DATA
We do not sell your Personal Data to data brokers, advertisers, or third parties for their own marketing purposes. We only share data in the specific circumstances described below:
4.1. Service Providers and Sub-Processors
We engage trusted third-party companies and individuals to perform services on our behalf ("Sub-Processors"). We have entered into strict Data Processing Agreements (DPAs) with each Sub-Processor to ensure they process your data only pursuant to our instructions and maintain equivalent security standards.
(a) Infrastructure & Hosting: We use bare-metal and cloud providers (e.g., AWS, Google Cloud, Hetzner) to host the Proprietary Infrastructure, store Client Data, and provide Content Delivery Network (CDN) services.
(b) Payment Processors: We share payment tokens and billing details with PCI-DSS Level 1 compliant gateways (e.g., Stripe, PayPal) to process subscriptions and prevent fraud.
(c) Identity Verification: We share document images and biometric data with accredited identity verification providers (e.g., Stripe Identity, Veriff, SumSub) solely for the purpose of KYC/AML compliance.
(d) Customer Support: We use helpdesk software (e.g., Zendesk, Intercom) to manage support tickets and live chat functionality.
(e) Analytics & Performance: We use tools (e.g., Datadog, Prometheus) to monitor platform stability, latency, and error rates.
4.2. Affiliates within the Group
We may share your Personal Data with other companies within the Pinkdude Group (subsidiaries, parent companies, and joint ventures) for:
(a) Shared Operations: Centralized engineering, legal, and finance teams often support multiple regional entities.
(b) Security: A threat detected in one region (e.g., a DDoS attack on our EU nodes) allows us to update firewall rules globally to protect US customers.
(c) Intra-Group Transfer: All such sharing is governed by an Intra-Group Data Transfer Agreement incorporating Standard Contractual Clauses (SCCs).
4.3. Legal and Regulatory Requirements
We may disclose your Personal Data or Client Data if we believe in good faith that such disclosure is necessary to:
(a) Comply with Law: Respond to a valid subpoena, court order, warrant, or other legal process.
(b) Protect Rights: Enforce our Master Terms of Service, Acceptable Use Policy, or other contracts, including investigation of potential violations.
(c) Prevent Harm: Detect, prevent, or address fraud, security, or technical issues, or protect against harm to the rights, property, or safety of the Provider, our users, or the public as required or permitted by law.
(d) Emergency Situations: If we have a good faith belief that there is an imminent danger of death or serious physical injury to any person, we may disclose information to law enforcement without delay.
4.4. Business Transfers
If the Provider is involved in a merger, acquisition, bankruptcy, reorganization, sale of assets, or transition of service to another provider, your Personal Data and Client Data may be sold or transferred as part of such a transaction. We will notify you via email and/or a prominent notice on our website of any change in ownership or uses of your Personal Data.
5. INTERNATIONAL DATA TRANSFERS
As a global infrastructure provider, we operate a network of servers worldwide. Your Personal Data may be transferred to, stored, and processed in a country other than your own.
5.1. Transfers from the EEA/UK/Switzerland
If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, and we transfer your Personal Data to a "Third Country" (e.g., the United States), we ensure appropriate safeguards are in place:
(a) Adequacy Decisions: We rely on European Commission adequacy decisions where available (e.g., transfers to Japan, Canada, Israel).
(b) Data Privacy Framework (DPF): To the extent applicable, we comply with the EU-U.S. Data Privacy Framework, the UK Extension, and the Swiss-U.S. DPF regarding the collection, use, and retention of personal information.
(c) Standard Contractual Clauses (SCCs): Where no adequacy decision exists, we utilize the European Commission's Standard Contractual Clauses (Module 1 or Module 2) to legitimize the transfer. By using the Services, you explicitly authorize these transfers.
6. DATA RETENTION SCHEDULE
We practice Data Minimization. We retain Personal Data only for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.
6.1. Active Accounts
We retain your account data (profile, billing, content) for the entire duration of your Subscription Term.
6.2. Closed / Terminated Accounts
(a) Voluntary Closure: If you delete your account, your Personal Data and Client Data will be marked for deletion and permanently erased from our primary systems within thirty (30) days, and from our encrypted backups within ninety (90) days.
(b) Involuntary Termination (Non-Abuse): If we terminate your account for non-payment or inactivity, we may retain your data for a grace period of 30 days before deletion to allow for potential reactivation.
6.3. Banned Accounts (Abuse & Fraud)
EXCEPTION TO DELETION: If your account is terminated for violation of our Acceptable Use Policy (e.g., Spam, Phishing, Fraud, Illegal Content), we retain specific "Hash Data" indefinitely.
(a) Blocklist: We retain a cryptographic hash of your email address, phone number, and device identifiers in a permanent "Blocklist".
(b) Purpose: This retention is strictly necessary for our Legitimate Interest in preventing "Ban Evasion" and protecting our Platform from repeat offenders. You cannot exercise a "Right to Erasure" on this Blocklist data.
6.4. Statutory Retention Periods
Notwithstanding the above, we retain specific records to comply with law:
(a) Financial Records: Invoices, payment history, and tax usage data are retained for seven (7) to ten (10) years (depending on jurisdiction, e.g., US IRS vs. UK HMRC vs. German GoBD).
(b) Legal Holds: If you are involved in a legal dispute with us or are the subject of a valid preservation order, we will retain your data until the matter is resolved.
7. SECURITY MEASURES
We implement robust technical and organizational measures to protect your data. However, you acknowledge that no system is impenetrable.
7.1. Technical Safeguards
(a) Encryption: We use AES-256 encryption for data at rest (on disk) and TLS 1.2+ for data in transit.
(b) Access Control: Access to production servers is restricted to authorized engineers via VPN and Multi-Factor Authentication (MFA). We follow the "Principle of Least Privilege."
(c) DDoS Protection: We utilize automated scrubbing centers to mitigate Distributed Denial of Service attacks.
(d) Vulnerability Scanning: We perform regular automated scans and third-party penetration testing of our infrastructure.
7.2. Organizational Safeguards
(a) Training: All employees undergo mandatory security and privacy training upon hire and annually thereafter.
(b) Confidentiality: All employees and contractors sign strict Non-Disclosure Agreements (NDAs).
(c) Incident Response: We maintain a dedicated Security Incident Response Team (SIRT) and a documented plan to handle data breaches.
7.3. Your Responsibility
You are responsible for:
(a) Credentials: maintaining the confidentiality of your password and API tokens.
(b) 2FA: Enabling Two-Factor Authentication on your account.
(c) Client Data: Ensuring that any sensitive data you upload (Client Data) is encrypted before uploading it if strict confidentiality is required ("Client-Side Encryption").
8. YOUR DATA PROTECTION RIGHTS
Depending on your location and applicable law (e.g., GDPR, UK GDPR, CCPA, LGPD), you have specific rights regarding your Personal Data.
8.1. The Right to Access (Article 15 GDPR)
You have the right to request a copy of the Personal Data we hold about you.
(a) Dashboard: You can view most account data directly in your User Dashboard.
(b) Request: For data not visible in the Dashboard (e.g., server logs), you may submit a Subject Access Request (SAR). We will provide this in a structured, commonly used machine-readable format (CSV/JSON).
8.2. The Right to Rectification (Article 16 GDPR)
You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete. You can update your billing and profile details directly in your account settings.
8.3. The Right to Erasure ("Right to be Forgotten") (Article 17 GDPR)
You have the right to request that we erase your Personal Data, under certain conditions:
(a) Voluntary: If you close your account and owe no fees.
(b) Objection: If you successfully object to our processing (see below).
(c) Unlawful: If the data was processed unlawfully.
CRITICAL EXCEPTION FOR ABUSE:
We reserve the right to DENY an erasure request if your account was terminated for violating our Acceptable Use Policy (e.g., Spam, Phishing, Fraud). We maintain a legitimate interest in retaining your "Hash Data" (email hash, phone hash, device fingerprint) in a permanent Blocklist to prevent you from creating new accounts and harming the Platform again. This exception is supported by Recital 47 of the GDPR (processing for network and information security).
8.4. The Right to Restrict Processing (Article 18 GDPR)
You have the right to request that we restrict the processing of your Personal Data (i.e., keep it but not use it) if: (a) you contest its accuracy; (b) the processing is unlawful but you oppose erasure; or (c) we no longer need the data but you require it for a legal claim.
8.5. The Right to Object (Article 21 GDPR)
You have the right to object to our processing of your Personal Data:
(a) Marketing: You have an absolute right to opt-out of direct marketing at any time.
(b) Legitimate Interests: You may object to processing based on "legitimate interests" (e.g., fraud detection). However, we may continue processing if we demonstrate compelling legitimate grounds (e.g., preventing a DDoS attack) that override your rights.
8.6. The Right to Data Portability (Article 20 GDPR)
You have the right to request that we transfer the data that we have collected to another organization, or directly to you, in a structured, machine-readable format.
Limitation: This applies only to automated information which you initially provided consent for or where we used the information to perform a contract with you. It does not apply to our proprietary logs or security data.
9. REGIONAL SPECIFIC DISCLOSURES
9.1. For Users in California (CCPA/CPRA)
This section applies solely to residents of California.
(a) "Do Not Sell or Share": We do not "sell" your personal information as defined by the CCPA. We do not "share" your personal information for cross-context behavioral advertising.
(b) Sensitive Personal Information: We use Sensitive Personal Information (e.g., Government ID for KYC) only for the specific purpose of identity verification and security, as permitted under the CPRA. We do not use it to infer characteristics about you.
(c) Shine the Light: California Civil Code § 1798.83 permits you to request information regarding the disclosure of your personal information to third parties for their direct marketing purposes. We do not share data for third-party marketing.
9.2. For Users in Brazil (LGPD)
We comply with the Lei Geral de Proteção de Dados (LGPD). You have the right to anonymity, confirmation of the existence of processing, and access to data. Our DPO for Brazil can be contacted at dpo.br@pinkdude.com.
9.3. For Users in the European Union (DSA Transparency)
Under the Digital Services Act (DSA), we are required to provide a Single Point of Contact for Member State authorities, the Commission, and the Board.
Single Point of Contact: legal@pinkdude.com
Languages: English, German, French.
Transparency Reports: We publish an annual Transparency Report detailing the number of removal orders received from authorities and the number of account suspensions due to illegal content.
10. CHILDREN'S PRIVACY
10.1. Age Restriction.
Our Services are strictly B2B and are not directed to individuals under the age of eighteen (18). We do not knowingly collect Personal Data from children under 18.
(a) Termination: If we become aware that a child under 18 has provided us with Personal Data, we will take steps to delete such information and terminate the account immediately.
(b) Guardian: If you are a parent or guardian and become aware that your child has provided us with Personal Data, please contact us immediately.
11. COOKIES AND TRACKING TECHNOLOGIES
We use cookies to distinguish you from other users of our Services. This helps us to provide you with a good experience when you browse our website and allows us to improve our site.
(a) Strictly Necessary: Required for the operation of the Platform (e.g., secure login).
(b) Functionality: Recognize you when you return to our site (e.g., language preference).
(c) Targeting: Record your visit to our site, the pages you have visited, and the links you have followed.
Full Policy: For detailed information on the cookies we use and the purposes for which we use them, see our full Cookie Policy.
12. CHANGES TO THIS PRIVACY POLICY
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Effective Date" at the top.
(a) Material Changes: If we make material changes (e.g., using your data for a new purpose), we will let you know via email and/or a prominent notice on our Service prior to the change becoming effective.
(b) Review: You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.
13. CONTACT US AND COMPLAINTS
13.1. Contact the Data Protection Officer (DPO)
If you have any questions about this Privacy Policy, the practices of this site, or your dealings with this site, please contact our Data Protection Officer:
Email: privacy@pinkdude.com
Subject Line: "Privacy Inquiry - [Your Tenant ID]"
13.2. Lodging a Complaint (EEA/UK)
If you are located in the European Economic Area (EEA) or the UK and believe we have unlawfully processed your personal data, you have the right to lodge a complaint with your local Data Protection Authority (DPA).
Lead Supervisory Authority: The specific DPA applicable to your Contracting Entity is defined in the Platform Framework (Document 0).
UK: Information Commissioner's Office (ICO).
EU: European Data Protection Board (EDPB) list of authorities.