At PinNido (a product developed and operated by PinSolutions S.A.S.), the privacy, confidentiality, and security of your personal and family financial data are our top priority.
This Privacy Policy explains clearly, transparently, and in compliance with Colombia's Statutory Law 1581 of 2012, Decree 1377 of 2013, and the Google Play Developer & User Data Policies, how we collect, process, store, protect, and delete your personal information across our web platform (https://www.pinnido.com and https://pinnido.app) and our mobile applications for Android.
1. Data Controller
The entity responsible for processing personal data collected through PinNido is:
- Company Name: PinSolutions S.A.S.
- Legal Jurisdiction: Colombia
- Privacy and Rights Inquiries Email: contacto@pinsolutions.co
- Official Website: https://www.pinnido.com
2. Personal Data We Collect and Purposes
To provide PinNido's family financial management and planning services, we collect the following categories of information:
A. Account and Registration Information
- Identity and contact data: Full name, email address, and password protected using secure cryptographic key derivation algorithms (salted password hashing).
- Federated authentication (OAuth): If you choose to sign in using Google, Microsoft, or Apple, we receive your name, email address, and unique user identifier from that provider to authenticate your session securely.
B. Financial and Household Information (User-Provided)
- Household structure: Family workspace name and invitations sent to household members.
- Family finances: Financial accounts and funds (cash, bank accounts, cards), manual transaction entries (incomes, expenses, transfers), periodic category budgets, recurring fixed expenses, savings goals, family finance meeting agendas, and financial commitments with deadlines.
- Shared visibility: This information is visible exclusively to members who have been explicitly invited and authorized into your specific household space in PinNido.
C. Technical and Diagnostic Data
- Crash diagnostics (Firebase Crashlytics): In the event of an application error or crash on Android, we collect device model information, operating system version, crash stack traces, and your PinNido User ID solely to investigate, troubleshoot, and fix application stability issues.
- Abuse prevention (Google reCAPTCHA Enterprise): We evaluate interaction risk signals to prevent automated brute-force attacks and bot abuse during registration and login. The verification token is evaluated in-flight and is never stored in our databases.
3. Prominent Disclosure: Android Wallet Notification Capture Service
Access to the Notification Listener Service
PinNido offers an optional financial automation feature (available for Pro plan subscribers) that creates transaction drafts when you make purchases using digital wallets. To operate this feature on Android devices, the application requests the special system permission BIND_NOTIFICATION_LISTENER_SERVICE (Notification Access).
We believe in complete transparency regarding how this permission operates and the rigorous technical constraints we implement:
- Strict on-device filtering: The PinNido notification listener service only inspects notifications originating from two specific digital wallet packages:Google Wallet (package
com.google.android.apps.walletnfcrel) and Samsung Wallet (packagecom.samsung.android.spay). - Immediate local discard of all other notifications: Any notification originating from messaging apps (e.g., WhatsApp, Telegram, SMS), social media, incoming phone calls, emails, and even general banking apps or wallets like Nequi, is discarded immediately in the device's volatile memory before reading, analyzing, storing, or transmitting its content.
- No server storage of filtered notifications: PinNido servers never receive, store, or log any data from notifications rejected by our local on-device filter.
- 30-day automatic purge of raw notification text: When an eligible wallet notification creates a transaction draft, the raw notification message text stored on the server is automatically and permanently purged after 30 days. Only the structured transaction fields (transaction amount, merchant name, timestamp, and status) are preserved in your family financial ledger.
- 48-hour local buffer expiration: If your mobile device is offline, pending captured notifications in the local phone buffer have a maximum lifespan of 48 hours, after which they are either synchronized or permanently dropped.
- User choice and revocation: This feature is completely voluntary. You can enable or revoke notification access at any time via Android Settings > Apps > Special app access > Notification access, or within PinNido's settings. Revoking permission stops all notification capture immediately.
4. Bank Statement Processing (PDF / CSV)
PinNido allows you to upload bank account statements in PDF or CSV format to help you reconcile funds and generate transaction drafts:
- No permanent file storage: Uploaded PDF or CSV files are processed in ephemeral server memory and are never stored permanently on our servers.
- Immediate deletion of extracted text: Extracted transaction text is permanently deleted as soon as you review and confirm the draft transactions or discard/cancel the import session.
- Explicit user validation required: Extracted entries are never posted to your accounts automatically; every transaction draft requires your prior review and approval.
5. Use of Artificial Intelligence (NidoIA)
PinNido incorporates artificial intelligence through NidoIA to assist with household financial insights, budget projections, savings goals, and statement draft structuring:
- AI Model Providers: We integrate enterprise API services from OpenAI LLC and Anthropic PBC (Claude).
- Strict contextual scope: Only the specific text fragments required to answer your query or structure the statement lines you selected are submitted to the AI provider.
- Zero model training on your data: Under our enterprise API terms of service with OpenAI and Anthropic, user data sent via PinNido is never used to train, fine-tune, or improve public or proprietary foundation models.
- Advisory only: NidoIA functions strictly as a financial organization and budgeting assistant; it cannot execute actual bank transfers or manipulate real funds.
6. Third-Party Processors & Service Providers
To deliver reliable, secure, and performant services, PinNido partners with industry-leading cloud infrastructure providers who act as data subprocessors under strict confidentiality and security agreements:
| Provider / Service | Purpose | Data Handled |
|---|---|---|
| Microsoft Azure | Secure cloud hosting, computing, and database infrastructure. | All application data, encrypted in transit (TLS) and at rest (AES-256). |
| Google, Microsoft, Apple Identity | Federated secure single sign-on (OAuth). | Name, email address, and federated account ID. |
| Firebase Crashlytics (Google LLC) | Application crash reporting and stability diagnostics. | Crash stack traces, device model, OS version, and PinNido User ID. |
| Google reCAPTCHA Enterprise | Bot protection, brute force, and abuse mitigation. | Technical interaction signals and IP address (ephemeral token not stored). |
| Google Play Billing (Google LLC) | In-app subscription management on Android. | Subscription confirmation and purchase token (no card numbers stored). |
| PayPal (PayPal Pte. Ltd.) | Payment and subscription processing for the web application. | Transaction ID and billing status (no financial credentials stored). |
| OpenAI LLC & Anthropic PBC | Natural language processing for NidoIA and statement parsing. | User prompt text and statement snippets (ephemeral, not used for training). |
| PinSend | Transactional email delivery and security notifications. | User name, email address, and notification email contents. |
Zero Data Sale Commitment: PinSolutions S.A.S. does not sell, rent, lease, or monetize your personal or financial data to advertising networks, financial marketing brokers, or any third party under any circumstance.
7. Android App Permissions
PinNido for Android requests only permissions that are strictly necessary for core functionality:
android.permission.INTERNET: Required to communicate securely with PinNido's cloud servers and keep family financial data synced.android.permission.POST_NOTIFICATIONS: Required to deliver budget threshold alerts, family commitment reminders, or import completion notifications. Can be turned off anytime in Android settings.android.permission.BIND_NOTIFICATION_LISTENER_SERVICE: Required for optional automated capture of payment receipts from Google Wallet and Samsung Wallet on the Pro plan (detailed in Section 3).
8. Data Retention & Account Deletion
In accordance with the Google Play Account Deletion Policy and statutory data protection standards:
How to Request Full Deletion of Your Account and Data
You hold the unconditional right to delete your user account and all personal and financial data associated with your family space at any time through either of these methods:
- Within the app: Navigate to your Profile > Account Settings and select the option to request account deletion.
- By web or email request: Review the step-by-step instructions on our dedicated Account and Data Deletion page or send an email to contacto@pinsolutions.co with the subject "Account and Data Deletion Request - PinNido".
Effects of the deletion process:
- Upon receipt and verification of your request, we permanently delete your user profile, authentication credentials, family workspace association, all transaction ledgers, accounts, budgets, meeting records, and goals.
- Raw notification text is purged automatically within 30 days or immediately upon account cancellation.
- The full deletion process takes no longer than 30 calendar days, after which your data is completely purged from active production systems and rotating backup cycles.
9. User Rights (Habeas Data - Law 1581 of 2012)
Under Colombian data protection regulations (Statutory Law 1581 of 2012 and Decree 1377 of 2013), you have the right to:
- Know, update, and rectify your personal data held by PinSolutions S.A.S..
- Request proof of the authorization granted for data processing.
- Be informed upon request about how your personal data has been utilized.
- File complaints before the Superintendency of Industry and Commerce (SIC) for violations of applicable laws.
- Revoke authorization and/or request deletion of personal data when processing does not adhere to constitutional and legal principles.
- Free access to your personal data that has been subject to processing.
To exercise any of these rights, contact us at contacto@pinsolutions.co. Inquiries are addressed within statutory timelines (maximum 15 business days).
10. Information Security
PinSolutions S.A.S. implements robust technical, administrative, and physical safeguards to prevent unauthorized access, loss, or alteration of your data:
- Encryption in transit: All communications between your web browser or mobile application and our servers use TLS 1.3 / HTTPS protocols.
- Encryption at rest: Databases and storage volumes hosted in Microsoft Azure are protected by AES-256 enterprise encryption.
- Isolation and access controls: Strict multi-tenant isolation ensures data from one household cannot be accessed by another, reinforced by role-based access control (RBAC).
11. Children's Privacy
PinNido is designed exclusively for individuals who are at least 18 years of age. We do not knowingly collect personal information from minors under 18. If a parent or guardian becomes aware that a child has provided us with personal information without parental consent, please contact us immediately at contacto@pinsolutions.co, and we will take prompt steps to delete such data.
12. Changes to this Policy & Official Contact
We may update this Privacy Policy from time to time to reflect product enhancements, new features, or evolving regulatory requirements. The date of the latest update will always be noted at the top of this document. Material changes affecting how your data is handled will be notified through the app or by email.
If you have questions, comments, or concerns regarding your privacy or this policy, please reach out to our privacy team:
- Email: contacto@pinsolutions.co
- Organization: PinSolutions S.A.S.
- Country: Colombia