Privacy Policy
Contents
1. Introduction
This Privacy Policy explains what data Pingr Intelligence Limited ("Pingr Intelligence", "we", "us", or "our") collects through PennyWall, why we collect it, and what rights you have over it. It applies to our website, dashboard, and API (together, the "Service"). This policy should be read alongside our Terms & Conditions, which govern your use of the Service more broadly.
2. Data we collect
Account data
When you sign up, we collect your email address and a password, which we store only as a one-way bcrypt hash, never in plain text. We also generate a session token when you log in, so you don't need to re-enter your password on every page.
API keys
When you create an API key, we store a one-way hash of it, a short prefix (enough for you to recognise it in your dashboard), a label you choose, and timestamps for when it was created and last used. We never store the full raw key after the moment you create it.
Payment check data
Every time your agent sends a payment to PennyWall for review, we process the agent identifier you supplied, the payment amount, and any description, reason, or resource URL text included with it, in order to scan that text for personal information and check it against your spending limits. We keep a record of each check (the amount, whether it was allowed, and which categories of personal information, if any, were found) so it can appear in your dashboard's activity log.
Spending settings
We store the daily limit and per-payment limit you configure, along with a running total of how much each of your agents has spent, per day, so limits can be enforced accurately across restarts.
3. Data we deliberately don't keep
This is the whole point of the product, so it's worth stating plainly.
When PennyWall's scanner finds something that looks like an email address, phone number, card number, or similar identifier inside a payment description, we redact it before the payment goes through. Critically:
- We do not store the actual personal information our scanner detects. Our audit log only records which categories were found (for example, that an email address was present), never the email address itself.
- We do not store raw passwords or raw API keys. Both are one-way hashed before they ever touch our database, so even we can't recover them.
The entire reason PennyWall exists is to stop personal information from spreading. It would defeat the purpose if our own database became a place where it accumulated instead.
4. How we use your data
We use the data described above to:
- Create and secure your account, and let you log in.
- Screen the payments your agents submit, and enforce your configured spending limits.
- Show you your dashboard, activity log, and API key list.
- Respond to you if you contact us with a question or issue.
- Maintain the security and reliability of the Service, including detecting abuse.
We do not use your data to train third-party advertising products, and we do not sell it to data brokers or advertisers.
5. Cookies and local storage
PennyWall doesn't use tracking or advertising cookies. When you log in, your browser stores your session token in local storage so you stay logged in as you move between pages. This is functional, not tracking, it identifies your session, not you as an individual across other sites, and it's cleared when you log out.
6. Sharing and third parties
We don't sell your personal data. We share data only in the following limited circumstances:
- Infrastructure providers. We use third-party hosting and database providers to run the Service. They process data on our behalf and under our instructions, not for their own purposes.
- Legal requirements. We may disclose data if required by law, court order, or to protect the rights, safety, or property of Pingr Intelligence, our users, or others.
- Business transfers. If Pingr Intelligence is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction, subject to the same protections described here.
7. Data retention
We keep your account data for as long as your account is active. If you delete your account, we delete your account data, API keys, and settings within a reasonable period, except where we're required to retain something for legal or security reasons. Activity log entries (which never contain raw personal information, only category names, as described above) may be retained for a limited period for security and product-improvement purposes even after related data changes.
8. Security
We take reasonable technical measures to protect your data, including one-way hashing for passwords and API keys, encrypted connections between your browser, our servers, and our database, and access controls limiting who can reach production systems. That said, no method of transmission or storage is completely secure, and we can't guarantee absolute security. See our Terms & Conditions for more on what PennyWall does and doesn't guarantee.
9. Your rights
Because Pingr Intelligence is based in Ireland, you have rights under the EU General Data Protection Regulation (GDPR) and Irish data protection law, regardless of where you're located. These include the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Request deletion of your data (you can also delete your account directly).
- Object to or restrict certain processing.
- Receive your data in a portable format.
- Lodge a complaint with the Irish Data Protection Commission, or your local data protection authority, if you believe we've mishandled your data.
To exercise any of these rights, contact us using the details in Section 13.
10. International transfers
Our infrastructure providers may process or store data in countries outside your own, including outside the European Economic Area. Where that happens, we rely on appropriate safeguards, such as standard contractual clauses or a provider's own adequacy protections, to keep your data protected to a standard consistent with this policy.
11. Children's privacy
PennyWall is not directed at, and is not intended for use by, anyone under the age of 16. We don't knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we'll delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we'll take reasonable steps to notify you, such as posting a notice on the Service or emailing the address on your account. The "Last updated" date at the top of this page always reflects the current version.
13. Contact
Questions about this Privacy Policy, or requests relating to your data, can be sent by post to Pingr Intelligence Limited, County Laois, Ireland.