Privacy policy

No account is needed. We count visits anonymously so shops can see how many people found them: page views and taps on Directions, Share and links. These counts are stored without any IP address, device information or identifier, so they are not personal data.

We use no advertising or tracking cookies. Your browser keeps a few small notes for convenience, on your device only: that you closed the welcome note, the shops you save with ♡, and, for the current visit only, which shop pages you've opened so a reload isn't counted twice. Clearing your browser's site data removes them. Signed-in shop owners' browsers also keep their sign-in session.

If you're signed in, the shops you save are also kept with your account, so the same list appears on the website and in the apps: the shop's name, category, place and position, and when you saved it. Remove a shop and it's removed everywhere; signing out clears the list from that device; deleting your account deletes it.

Pinmade passport (optional): if you sign in and tap Collect stamp at a shop, we keep which shops you collected a stamp from and when, with your account, so your passport shows on all your devices. To check you're at the shop, your device's position is sent once and compared with the shop's address; it isn't stored. Shops see only how many stamps were collected there, never who collected them. Deleting your account deletes your passport.

“Near me” uses your location only on your device to centre the map; it isn't sent to us.

Our hosting provider and the map-tile service receive your IP address when your browser loads pages and map images; it's used only to deliver them and for security.

Shop owner account: email address, sign-in times. Purpose: to let you sign in and manage your listing and to contact you about it. Legal basis: performing our agreement with you (the terms). Providing an email is required; without it you can't have an account.

Listing content: shop name, description, addresses, opening hours, links, photos (which may show people), and our review decisions and notes. Purpose: to publish your listing and keep the map trustworthy. Legal basis: our agreement with you; for listings the team adds from public sources, our legitimate interest in a useful directory (owners can object at any time).

Claims: the evidence you give to show you own a shop. Purpose and basis: verifying ownership, our agreement with you and our legitimate interest in preventing fraud.

Reports and suggestions: what you write, and your email if you add it. Purpose and basis: acting on your message, our legitimate interest in keeping listings accurate.

Automated checks: new listings are checked by rules (for example duplicates or chain names) and an AI assistant gives a suggestion from the listing's text, check results and shop-front photo. Your email is never sent to the AI. A person makes every decision, so no decision about you is made by automated means alone.

We don't send marketing, and we never sell or rent personal data.

Supabase (database, sign-in, photo storage; servers in Tokyo, Japan) · Vercel (website hosting and delivery; United States and a global network) · Resend (sign-in emails; United States) · OpenRouter and the AI provider it routes to (listing suggestions; we ask OpenRouter to use only providers that don't store or train on what we send) · OpenFreeMap (map tiles, loaded by your browser) · Geospatial Information Authority of Japan, Photon by komoot and OpenStreetMap Nominatim (turning an address into a map position, and a map position into its country; only the address or the position is sent).

They act on our instructions under contracts with data-protection terms. We may also disclose data when Georgian law, a court or a competent authority requires it.

Because these providers are in Japan, the United States and elsewhere, your data is transferred outside Georgia. Where a country isn't recognised by Georgia as giving adequate protection, we rely on the providers' contractual data-protection safeguards. By creating a shop account after reading this notice, you also consent to these transfers. You can ask us for details of the safeguards.

Account and listing data: while your account or listing exists; deleted or anonymised within 30 days after you ask us to close it, except what we must keep by law. Review records: up to 2 years after a listing is removed, to handle disputes and repeated abuse. Reports and suggestions: until handled, then up to 12 months. Anonymous visit counts: kept, as they identify no one.

You can ask us, free of charge, for information about and a copy of your data; to correct, update or complete it; to delete or block it (you can also delete your account yourself, under “Your shops” → “Delete account”); to object to processing based on our legitimate interests; to withdraw consent (this doesn't affect what was done before); and to receive data you gave us in a common format. Email help@pinmade.app or amikhailsmirnov@gmail.com. We'll reply as quickly as the law requires and within 10 working days at most, and tell you if we need to confirm your identity first.

You can complain to Georgia's personal-data supervisor, the State Audit Office of Georgia, or go to court. We'd appreciate the chance to fix things first.

Shop accounts are for people aged 16 and over.

Access to data is limited by database rules, sign-in uses one-time codes, and traffic is encrypted. If a breach puts your rights at risk, we notify the State Audit Office within 72 hours and tell you without undue delay.

For personal information of people in Japan: we use it only for the purposes in section 2; we entrust handling to the providers in section 3 under supervision; it is stored in Japan (Supabase) and also handled in the United States and Georgia, whose systems differ from Japan's and which we apply the safeguards above to; we don't provide it to third parties except as described here or as the law permits. Requests for disclosure, correction, suspension of use or deletion: email us.

Shops anywhere in the world can be listed. Where the EU or UK General Data Protection Regulation, or another country's data-protection law, applies to you, you have the rights it gives you on top of those above, including to restrict processing and to complain to your own country's data-protection authority. The purposes and legal bases in section 2 are the same everywhere: our agreement with you, our legitimate interests (which you can object to) and, where we ask, your consent.

Your data is handled by the providers in section 3, in Japan, the United States and Georgia, under their contractual data-protection safeguards (for EU and UK data, standard contractual clauses where they apply). Ask us for a copy of the safeguards.

We'll update the date below when this notice changes and email shop owners about material changes.