Privacy policy
What data we process, what for, who sees it (and who doesn't) and how to exercise your rights.
1. Who is responsible
WONDERRED S.A.S., a company incorporated in Ecuador, is the controller of the data of PinApprove accounts. Contact: legal@wonder.red.
For the content you upload and the data of your clients (reviewers), you decide what is shared and with whom: we process that data on your behalf and only to provide the service to you.
2. What data we process
- Account: name, email, password (stored irreversibly), studio name and WhatsApp, preferences.
- Content: files, versions, comments, decisions and the names you give to projects and clients.
- Reviewers: the name they enter when reviewing and, if requested, their email.
- Security and audit: public IP, browser and device, date and action performed, for both professionals and reviewers. They serve as evidence of who approved what and to protect accounts.
- Billing: plan, subscription status, amounts and payment provider references. Card details are received and stored by Polar, not by us.
- Website visits (pinapprove.com): which sections are viewed, which buttons and questions are used, time on the page, country, device type, operating system and browser (only the family, for example "iOS · Safari"), the referring site or campaign and whether the visit ended in an account. They are anonymous: we do not store the IP or the full browser. To count unique visitors we use a code that changes every day and cannot be linked to anyone.
- Platform usage: country, device type, operating system and browser of the people who use the app, derived from the security logs, for aggregate metrics.
- Service security: IP, country, requested path, response and browser of each request to our servers, to detect and stop attacks (brute force, scanners, traffic floods).
3. Purposes and legal basis
- Providing the service and billing for it (performance of the contract).
- Protecting accounts, preventing fraud and keeping evidence of approvals (legitimate interest).
- Complying with legal and tax obligations.
- Sending you email notifications that you can turn off at any time (consent; account security notifications are always sent).
- Understanding how the product is used through aggregate metrics, without looking at your content.
- Improving the website with anonymous visit statistics (legitimate interest). If your browser asks not to be tracked (Global Privacy Control or Do Not Track), we do not record your visit.
- Protecting the service against attacks with security logs of requests (legitimate interest).
We do not sell your data or use it for advertising.
4. What our team sees
The internal dashboard only shows usage metrics (for example, how many projects or versions an account has), account data and billing data. It does not show project or client names, and it does not allow opening files or entering your account.
Files are stored encrypted, with a separate key for each account. Access to the dashboard requires two-step verification and every action is logged.
5. Who we share data with
Only with providers we need to operate, under contract and with security guarantees:
- Contabo GmbH: servers where the service runs.
- Polar Software, Inc.: payments, taxes and receipts.
- Resend, Inc.: sending emails.
Some of these providers are outside Ecuador; those transfers are made with the safeguards required by law. We may also hand over data if a competent authority lawfully orders it.
6. How long we keep it
- While your account is active.
- When you close it: 30 days in case you want to recover it; after that, the content and account data are deleted.
- Audit logs and approval records: up to 5 years, as evidence.
- Billing data: the period required by tax law.
- Website visit statistics: 13 months.
- Security logs of requests (with IP): 30 days.
7. Your rights
You can ask to access your data, correct it, delete it, take it to another service (portability), object to or restrict a processing. Write to us at legal@wonder.red from your account's email address; we reply within 15 days at most.
If you believe we did not handle your request properly, you can file a complaint with Ecuador's Superintendencia de Protección de Datos Personales or with the data protection authority of your country.
If you are a reviewer for a professional who uses PinApprove, you can also contact that professional.
9. Security
Encrypted connections (HTTPS), files encrypted at rest, passwords stored irreversibly, two-step verification, attempt limits and access logs. If an incident affecting your data occurs, we will notify you without undue delay.
10. Minors
The service is not intended for people under 18.
11. Changes to this policy
If we make material changes to it, we will notify you by email or within the service before the change takes effect.