Privacy Policy — Pinpoint SEO

This Privacy Policy explains how Pinpoint SEO ("Pinpoint," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit pinpointseo.co, use the Pinpoint application at app.pinpointseo.co, or use related services (collectively, the "Service").

1. Scope and Contact

Pinpoint SEO is a Canadian software business. The public website provides information about Pinpoint, while the application provides Google Business Profile management and related tools. This policy covers both.

Questions, access requests, and privacy complaints may be sent to admin@pinpointseo.co.

2. Information We Collect

Information from the public website

We may collect information you choose to provide, such as your name, email address, business details, newsletter preferences, or the contents of a message you send us.

We may also collect limited technical information needed to operate and understand the website, such as IP address, approximate location, browser and device type, referral source, pages viewed, and page-view timestamps.

Account and business information

When you sign in with Google, we receive account information such as your name, email address, profile image, Google account identifier, and authentication/session information. Pinpoint does not maintain a separate account password.

We collect the business information and preferences you provide, including business name, address, phone number, website, services, service areas, keywords, brand voice, media, and automation or approval settings.

Google Business Profile data

With your authorization, Pinpoint requests the Google OAuth scope needed to manage your Google Business Profile. Depending on the features you enable, we may access, use, and store profile and location identifiers, listing details, posts, reviews and replies, photos or other media, performance metrics, and OAuth access and refresh credentials.

Pinpoint may take actions on your behalf according to your settings, including creating or publishing posts, replying to reviews, updating listing information, uploading media, and reading performance information for reports.

Optional social integrations

If you choose to connect a supported social or video account, we may receive account and channel identifiers, profile information, content and publishing data, and OAuth credentials needed to provide the integration. These connections are optional and may be disconnected separately.

Billing information

Stripe collects and processes payment-method information. Pinpoint receives and stores related billing records such as Stripe customer, checkout, and subscription identifiers; subscription status and dates; location quantity; invoices or payment-event information; and limited payment status details. Pinpoint does not receive or store your full payment-card number.

Service content, usage, and diagnostics

We collect content and instructions you submit to the Service, content generated or published for your business, feature usage, job and activity records, support communications, and error or diagnostic information.

3. How We Use Information

We use information to:

• provide, secure, maintain, and support the Service;
• authenticate users and manage accounts, businesses, permissions, and connected services;
• perform the Google Business Profile and optional social actions you configure;
• generate content, review replies, reports, alerts, media, and other requested features;
• process subscriptions, payments, taxes, cancellations, and billing support;
• send service messages such as approvals, reports, receipts, alerts, and security notices;
• understand non-advertising website traffic and improve user-facing features;
• prevent abuse, diagnose errors, enforce our Terms, and comply with legal obligations; and
• send marketing communications when we have the consent or other lawful basis required to do so.

We do not sell personal information. We do not use personal information for targeted advertising or remarketing.

4. Analytics, Cookies, and Marketing Communications

The application uses essential cookies or similar technologies for sign-in, session security, and core functionality.

The public website uses Vercel Web Analytics, a privacy-focused, cookie-free service that provides anonymized, aggregated page-view analytics. It may process a timestamp, the page or route visited, referrer, filtered query parameters, approximate location, and browser, operating system, and device information. Incoming request information, which can include an IP address, may be processed to derive approximate location and a daily rotating visitor hash; the hash changes each day and is used to count visits without following a person across days.

We use this information to understand non-advertising website traffic and improve the website. We do not use Vercel Web Analytics for targeted advertising or remarketing, and it does not use advertising cookies.

We also use Vercel Speed Insights to collect anonymous, aggregated Web Vitals that help us understand and improve website performance. A measurement may include the route or URL, network speed, browser, device type, and operating system, country, the Web Vital and its attribution, SDK information, and the time Vercel's server receives the event.

Vercel states that Speed Insights measurements are not associated with an individual or IP address and that the service does not reconstruct a visitor's session across page views. These statements describe Speed Insights specifically and do not change the other information practices described in this policy.

If you opt in to newsletters or product updates, we may send commercial messages in accordance with applicable anti-spam laws. Each such email will identify Pinpoint and include a working unsubscribe mechanism. You may unsubscribe at any time without affecting necessary service messages such as receipts, security notices, or actions you request through the Service.

5. How We Share Information

We disclose information only as reasonably necessary for the purposes described in this policy, including to service providers that help us operate the Service. Depending on the feature used, these providers may include:

• Google and YouTube: Google sign-in, Business Profile management, and optional video features;
• supported social platforms, including LinkedIn: optional account connection and publishing;
• Stripe: checkout, subscriptions, payment processing, and billing portal;
• OpenAI: AI-assisted content generation;
• Resend: transactional and consent-based email delivery;
• Vercel, Neon/PostgreSQL, Upstash/Redis, and Cloudflare R2: website and application hosting, website analytics and performance measurement, database, job infrastructure, and media storage;
• Sentry: error monitoring configured not to send default personally identifiable information;
• Firecrawl and Serper: website analysis and search/ranking features;
• ElevenLabs and Creatomate: optional audio and video generation; and
• professional advisers and authorities: legal, accounting, security, fraud prevention, and lawful requests.

A provider receives only the information reasonably necessary for the feature or service it performs. Some providers process information outside Canada, including in the United States, where it may be subject to local laws and lawful access requests.

We may also disclose information in connection with a financing, merger, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality and legal safeguards.

6. Google API Data

Pinpoint's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

We use Google user data only to provide or improve the user-facing features you request, maintain security, comply with law, or as otherwise permitted by Google policy and your consent. We do not sell Google user data; use it for advertising, remarketing, lending, or credit decisions; or use it to train or improve generalized artificial intelligence or machine-learning models.

Pinpoint does not train AI models on customer content or Google API data. When the Service sends content to an AI provider to perform a feature you request, we use business/API services whose data is not used for model training by default, and Pinpoint will not opt customer or Google data into provider training programs.

Authorized personnel may access Google user data only with your specific permission for support, when necessary to investigate security or abuse, when required by law, or in an aggregated and de-identified form for permitted operational purposes. We will not transfer Google user data in a corporate transaction unless Google's policy requirements are satisfied, including obtaining explicit prior consent where required.

Stored Google OAuth credentials are encrypted using AES-256-GCM. You may revoke Pinpoint's access through your Google account permissions. Where an in-product disconnect control is available, you may use it to remove a connection; you may also contact us for assistance.

7. Retention and Deletion

We retain personal information only as long as reasonably necessary to provide the Service, maintain security and business records, resolve disputes, enforce agreements, and meet legal, tax, accounting, or regulatory obligations.

Retention depends on the type of information and why it was collected. Connected-account credentials are kept while the applicable connection is active or as needed to complete a valid disconnect or deletion request. Billing and transaction records may be retained longer where law or legitimate accounting requirements apply. Soft-deleted content, security records, logs, and backup copies may remain for a limited period before deletion or anonymization.

You may request account or personal-information deletion by emailing admin@pinpointseo.co. After verifying the request, we will delete or anonymize information that we are not required or permitted to retain. Disconnecting a third-party account does not delete information held by that third party.

8. Your Privacy Choices and Rights

Subject to applicable law, you may ask us to:

• explain whether we hold personal information about you and how it is used;
• provide access to that information;
• correct inaccurate or incomplete information;
• withdraw consent for future processing where consent is the applicable basis;
• disconnect an integration or request deletion of information; and
• provide information about service providers or processing outside Canada.

We will respond within the period required by applicable law. Certain information may need to be retained, and withdrawing consent may prevent us from providing some Service features.

You may raise a concern with us at admin@pinpointseo.co. You may also contact the Office of the Privacy Commissioner of Canada or another privacy regulator that has jurisdiction over your concern.

9. Security

We use administrative, technical, and organizational safeguards appropriate to the sensitivity of the information. These include TLS for data in transit, access controls, provider and environment separation, and AES-256-GCM encryption for stored OAuth credentials.

No method of transmission or storage is completely secure. Please contact us promptly if you believe your account or connected services have been compromised.

10. Children's Privacy

The Service is intended for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from minors through the Service.

11. Changes to This Policy

We may update this policy to reflect changes to the Service, providers, or legal requirements. We will post the updated version and its effective date and provide additional notice where required. If we propose a new use of Google user data that was not previously disclosed, we will update the policy and obtain any consent required before using the data for that new purpose.

12. Contact

Pinpoint SEO

Email: admin@pinpointseo.co

Website: pinpointseo.co