Privacy Policy

Last Updated:

1. Introduction

Welcome to Pineway ("we," "our," or "us"). We provide a marketplace platform that allows Coaches ("Sellers") to sell digital products, services, or memberships to Customers ("Buyers").

We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains what information we collect, how we use it, and your rights in relation to it.

2. Definitions

  • Coaches: Users who register to sell products, services, or content on the platform.
  • Customers: Users who purchase products, services, or content from Coaches.
  • Users: Refers collectively to both Coaches and Customers.

3. Information We Collect

We collect information that you voluntarily provide to us when you register on the specific website or apps, together with information generated automatically as you use the platform.

A. Personal Information

  • Account Registration: When you sign up (as a Coach or Customer), we collect identifiers such as your name, email address, and username.
  • Profile Content: Coaches may add a profile picture, biography, social links, and other public page content. Anything you publish on your Pineway page is visible to the public by design.
  • Coach Business Info: Coaches may provide additional information required for payouts and tax compliance (business name, address), which is handled securely by our payment partners.
  • Booking and Order Details: When a booking or purchase is made, we record what was bought or booked, when, the amount, and any information the Customer submitted at checkout or in a Coach's intake form.

B. Payment Information

We do not store or collect your payment card details.

All payments are processed by third-party payment processors (such as Stripe). That information is provided directly to our third-party payment processors whose use of your personal information is governed by their Privacy Policy.

C. Usage Data (Product Analytics)

We use PostHog as our product analytics, feature flagging, and error monitoring platform. It records how the platform is used so we can fix problems, measure whether features work, and release changes safely. This is described in detail in Section 4A.

  • PostHog sets first-party cookies and uses a persistent identifier so repeat visits from the same browser can be recognized.
  • When you are signed in, product usage is attributed to your account and includes your name and email address.
  • Analytics traffic is routed through our own domain (pineway.io) before reaching PostHog, and is processed in PostHog's European Union region.
  • We do not use this data for advertising, and we do not share it with ad-tech companies or data brokers.

4. Third-Party Services & Technology

To provide our service, we use specific third-party tools. We have configured these tools to prioritize your privacy. Our full list of authorized subprocessors, and the terms on which we process personal data on behalf of customers, are set out in our Data Processing Agreement.

A. Product Analytics, Feature Flagging, and Error Monitoring (PostHog)

We use PostHog to understand product usage, diagnose errors, and manage feature releases.

  • Feature flags let us switch features on or off, and release them to selected accounts, without deploying new code.
  • When you are signed in we send your account identifier, which is what features are released against, along with your name and email address so product usage can be attributed correctly.
  • We capture product usage events, error and exception reports, browser console output, and server-side logs and performance traces, so we can find and fix faults.
  • We capture session recordings, which replay how you interacted with our pages. PostHog's default input masking is applied, and card details are entered in our payment provider's own hosted fields, so they are not captured.
  • We record diagnostic information about our AI features (such as model, latency, token counts, and cost) with PostHog's privacy mode enabled, so prompt and response content is not sent.
  • Your data is processed in PostHog's EU region, and analytics requests are proxied through our own domain rather than sent to a third-party host directly.
  • For more information, please visit PostHog's Privacy Policy.

B. Payment Processors

We work with Stripe to process payments and payouts. Their privacy policy governs the handling of your financial data.

C. Bot Protection (Cloudflare Turnstile)

We use Cloudflare Turnstile to protect our platform from automated bots and abuse. Turnstile is a privacy-friendly CAPTCHA alternative.

  • Turnstile does not use intrusive tracking or build advertising profiles.
  • It may process limited technical data (such as browser signals) to verify that a visitor is human.
  • For more information, please visit Cloudflare's Turnstile Privacy Policy.

D. Google Services

We integrate with Google for the following purposes:

  • Authentication: We use Google Sign-In to allow users to log in to Pineway using their Google account. We only request the minimum permissions necessary to authenticate your identity (name, email address, and profile picture).
  • Google Meet (Calendar Links): Coaches may optionally grant Pineway permission to create Google Meet links on their behalf for scheduling sessions with clients. This permission is only requested when explicitly granted by the Coach, and is used solely to generate meeting links.
  • Google Calendar: Coaches may optionally connect their Google Calendar to allow Pineway to read free/busy availability (read-only access) and, when granted, to create calendar events on behalf of Coaches and their clients. We request only the minimum permissions required for these functions. We do not read, store, or share the content of your calendar events beyond what is necessary to create or display scheduling information.

Google's handling of your data is governed by Google's Privacy Policy. You may revoke Pineway's access to your Google account at any time via your Google account settings.

E. Apple Calendar (iCloud)

Coaches may optionally connect Apple Calendar (iCloud) so that session times stay in sync with their own calendar. Apple does not offer an OAuth flow for calendar access, so this connection uses your Apple ID together with an app-specific password that you generate in your Apple account. We store that app-specific password encrypted and use it only to reach your iCloud calendars over CalDAV. We never ask for, receive, or store your main Apple ID password.

  • Availability (reading): iCloud does not reliably answer free/busy requests, so Pineway reads the events in the calendars you select for conflict checking (all calendars on the account, unless you choose specific ones) within the scheduling window being viewed, and converts them into busy time ranges. Those ranges are used only to work out when you are free; we do not store your calendar events or their contents.
  • Session events (writing): When a session is booked, rescheduled, or cancelled, we create, update, or delete a calendar entry in the calendar you selected. That entry contains the session title and description, the meeting link, the start and end time, and the other participant's email address as an attendee.
  • Scope: We access your iCloud calendars only for the scheduling purposes described above, and we do not read, store, or share other data in your Apple account.

Apple's handling of your data is governed by Apple's Privacy Policy. You may end Pineway's access at any time by disconnecting Apple Calendar in your Pineway settings, or by revoking the app-specific password in your Apple account settings.

F. Video Conferencing (Zoom)

We integrate with Zoom so Coaches can host session calls:

  • Zoom (Meeting Links): Coaches may optionally connect their Zoom account so Pineway can create Zoom meeting links on their behalf for scheduling sessions with clients. This permission is only requested when explicitly granted by the Coach and is used solely to generate meeting links. We also read the Zoom account's user identifier to associate the connection with the Coach's Pineway account.

Zoom's handling of your data is governed by Zoom's Privacy Policy. You may revoke Pineway's access at any time by disconnecting Zoom in your Pineway settings, or by removing the Pineway app from your Zoom account settings.

G. Transactional Email and Notifications

We use Resend to deliver transactional emails, such as purchase receipts, payout notifications, and account security alerts. Deciding which notifications to send, and on which channel, is handled by a self-hosted notification platform running on infrastructure we control.

  • We share only the minimum information necessary to deliver emails (recipient email address and the content of the notification).
  • Resend does not use your email address for marketing or third-party advertising.
  • For more information, please visit Resend's Privacy Policy.

H. Marketing and Newsletter Email

We use Customer.io to send product and lifecycle marketing emails. Blog newsletter subscriptions are managed by our self-hosted blog platform, running on infrastructure we control.

  • We share your name and email address with Customer.io only where you have not opted out of marketing emails.
  • Blog newsletter subscribers can unsubscribe from any newsletter emails.
  • Opting out of marketing emails does not stop transactional emails, which are essential to operating your account.

I. Infrastructure and Background Processing

We rely on the following providers to run the platform:

  • Supabase for our database, authentication, and file storage.
  • Fly.io for application hosting and compute.
  • Trigger.dev for background jobs, such as sending scheduled reminders and processing transcripts.

5. International Data Transfers

Pineway operates globally with team members and users across multiple countries. Our primary application data is stored on servers in the European Union: our database, authentication, and file storage in Zurich (eu-central), and our application hosting in Frankfurt. Product analytics data is processed in the European Union.

Some of our service providers are based in the United States or process data globally. Those providers are listed in our Data Processing Agreement.

If you are located in the European Economic Area (EEA), the United Kingdom, or other regions with data protection laws, your personal information may be transferred to and processed in countries outside your region. We ensure adequate protection through Standard Contractual Clauses and other legally approved mechanisms to safeguard your data during international transfers.

6. How We Use Your Information

We use the information we collect to:

  1. Facilitate the Marketplace: Allowing Customers to buy and Coaches to sell.
  2. Account Management: Managing your registration, login, and account preferences.
  3. Communication: Sending you transaction receipts, payout notifications, and critical service updates.
  4. Platform Improvement: Analyzing product usage data to fix bugs and improve user experience.
  5. Feature Releases: Deciding which accounts see a new or changed feature, so we can roll changes out gradually.
  6. Security and Fraud Prevention: Detecting abuse, blocking automated attacks, and protecting accounts.
  7. Legal Compliance: Meeting tax, accounting, and other legal obligations.
  8. Marketing & Product Updates: We may send you occasional emails about new Pineway features, tips, or creator success stories. You can unsubscribe from marketing emails at any time via the link in any message. Transactional emails (receipts, payout notifications, security alerts) cannot be disabled as they are essential to operating your account.

7. Data Sharing

We do not sell your personal data. We share data only in the following circumstances:

  • Between Coaches and Customers: When a Customer purchases from a Coach, the Coach receives the Customer's name and email address to fulfill the order and provide support. Coaches are responsible for their own legal compliance regarding the data they receive.
  • Service Providers: With vendors (listed in Section 4) who help us operate the platform.
  • Legal Obligations: If required by law (e.g., to comply with a subpoena or legal process).

Important Note for Customers:

When you purchase from a Coach on Pineway, that Coach becomes an independent data controller for your information (name, email, and any details you provide during checkout). The Coach is responsible for how they use, store, and protect your data in compliance with applicable privacy laws. Pineway acts as a data processor to facilitate the transaction, but is not responsible for how Coaches handle customer data after the sale.

8. Cookies and Tracking Technologies

We use two kinds of cookies and similar technologies:

  • Essential cookies, which the platform needs in order to work. These include authentication cookies to keep you logged in securely, and session cookies to remember your preferences during a single visit.
  • Product analytics cookies, set by PostHog on our own domain, which let us recognize repeat visits from the same browser and understand how features are used. See Sections 3C and 4A.

We do not use advertising cookies, cross-site tracking cookies, or third-party ad-tech trackers, and we do not sell the data these cookies generate.

You can manage cookies through your browser settings, and most browsers also let you send a "Do Not Track" or "Global Privacy Control" signal. Disabling essential cookies may prevent you from using certain features of Pineway.

9. Data Retention

We retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your information to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

In the event of a data breach affecting your personal information, we will notify you and relevant authorities within 72 hours or as required by applicable law.

10. Business Transfers

If Pineway is involved in a merger, acquisition, asset sale, or other business transaction, your personal information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website before your data is transferred and becomes subject to a different privacy policy. You will have the opportunity to delete your account before the transfer if you do not wish your data to be included.

11. Data Security

We care about the security of your data. We use commercially reasonable safeguards to protect your personal information. However, no method of transmission over the Internet is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

12. Your Privacy Rights

Depending on your location (e.g., if you are in the EEA, UK, or California), you may have certain rights regarding your personal information, including:

  • The right to access the personal data we hold about you.
  • The right to request the correction of inaccurate data.
  • The right to request the deletion of your data ("Right to be Forgotten").
  • The right to object to processing based on our legitimate interests, including product analytics and session replay.

To exercise these rights, please contact us at hello@pineway.io.

For California Residents:

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

  • Right to Know: Request details about the personal information we've collected about you in the past 12 months.
  • Right to Delete: Request deletion of your personal information (subject to certain exceptions).
  • Right to Opt-Out: We do not sell personal information, but you have the right to opt out if our practices change.
  • Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise these rights, contact us at hello@pineway.io.

13. Children's Privacy

Our Service is not intended for anyone under the age of 13. We do not knowingly collect personally identifiable information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at hello@pineway.io. If we learn we have collected information from a child under 13 without parental consent, we will delete that information promptly.

14. Automated Decision-Making and AI Features

As we introduce AI-powered features, we may use automated tools to enhance your experience. These tools help us suggest content, streamline processes, or personalize your dashboard.

You have the right to:

  • Understand when automated decision-making is being used
  • Opt out of automated decisions that significantly affect you
  • Request human review of automated decisions

If you have concerns about how automated tools are being used in your account, contact us at hello@pineway.io.

15. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.

16. Contact Us

If you have any questions about this Privacy Policy, please contact us:

By email: hello@pineway.io