Article 28 DPA

Controller: the organisation or person that creates the account and uses PineMail to send or receive email, or PineKeep to store files and application data, or both. Processor: PineCore Systems, a trading name of Bröderna Saxin AB, company registration number 559379-4364.

The processor processes personal data in email messages and attachments, files, objects stored in buckets and their earlier versions, calendars and contacts, file shares and transfers (including recipients' addresses and access codes), metadata, domains, API and access keys, and delivery events (including opens and clicks when the controller turns tracking on) to provide the service. Processing lasts while the account is active and then until the data is deleted.

Collection, storage, forwarding via the email provider, display in the web app, in mail and calendar apps (IMAP, SMTP, CalDAV), through the API and, for buckets, through the S3 API, through an assistant or app the controller or its users connect with a sign-in (OAuth), to mail, calendars, attachments and the user's own files for reading, with the access the user allows, within the limits the controller sets and with personal data masked unless the controller turns masking off (see Security), sharing files with the people the controller chooses, and deletion. Shares stop giving access at the end date the controller sets. A bucket the controller makes public can be read by anyone who has its address. Deletion happens on instruction, when a transfer's time runs out, and by the automatic rules in the terms: mail and files in the trash after 30 days, and unstarred, unpinned mail attachments older than 30 days when storage is full. When the controller turns on protection against deletion for a bucket, objects deleted or replaced in it are kept as earlier versions for the number of days the controller sets (7 to 365, at most twice that plus one), and cannot be removed before then, except when the account is deleted. When the controller turns on open or click tracking for a project, the processor adds an image to the HTML of email the project sends and passes its links through pinemail.app, and records when the image is loaded and which link is clicked and when, for that email. No IP address or device details are recorded. Categories: identifiers, contact details, and the content the controller puts in. Data subjects: the controller's staff, customers, and other senders and recipients, and anyone whose data the controller stores.

The processor processes data only on the controller's documented instructions, given through use of the service, and by law. The processor informs the controller if an instruction conflicts with the GDPR. An assistant or app that the controller or its users connect with a sign-in is an instruction from the controller, and the app is the controller's own recipient: what it reads leaves the service to that app's provider under the controller's terms with it, and the provider is not a sub-processor of the processor. The controller decides in the account settings which mailboxes and correspondents such apps reach, whether they may send and whether personal data is masked, and each user disconnects their own apps under Account → Connected apps.

The processor does not process the data for its own purposes. In particular, it does not use the data to train, test or improve AI or machine-learning models, does not use it for advertising or profiling, and does not sell it or make it available to anyone who would. Sub-processors may only process the data to provide their part of the service.

The processor is run by one person, who is bound by confidentiality and opens the controller's data only when it is needed to run the service, to fix a fault, or on the controller's instruction. No other person has access to it, apart from the sub-processors in the list, which are bound by confidentiality in their own agreements. Anyone given access later is bound by confidentiality before access is given.

The service and its database run on a dedicated server in Helsinki, Finland, which also holds the keys. Attachments, original messages, files and bucket objects, of PineMail and of PineKeep, are stored encrypted on a server the processor runs itself in Sweden, on mirrored disks with hourly and daily snapshots kept up to two weeks. Every six hours an encrypted backup (restic, AES-256) of the database is copied over an encrypted connection to that server, which can add backups but not change them; backups older than 30 days are removed daily through a separate, password-protected service, and the backup disk's own snapshots of the last seven days guard against a removal from a compromised server. Connections to the service use TLS, which ends on that server. Message text, original messages, attachments, files, transfers, the state of documents edited together and thumbnails are encrypted at rest with AES-256-GCM by the application. Objects in buckets are encrypted by the storage service on the Helsinki server (S3 server-side encryption) before they are sent to Sweden. The search index holds keyed hashes of words, not the words. Subjects, addresses, dates, file and object names, calendars, contacts and other metadata are not encrypted at rest, so the service can sort, show and search them. The application's key and the storage service's key are held on the server in Helsinki, separately from the database and from the stored files; the servers' disks are not encrypted as a whole. Mail is not end-to-end encrypted. Incoming mail is checked for spam and malware on the server; for this, the sending IP address and domain names in the message are looked up in public DNS blocklists, and nothing else leaves the server. When masking for assistants is on, which it is unless the controller turns it off, personal data in what a connected assistant reads, in mail, calendar entries and the text of attachments and files alike (email addresses, phone numbers, identity and organisation numbers, payment card and account numbers, and the names the service recognises), is replaced by placeholders on a server the processor runs itself within the EU before it leaves the service; that analysis keeps no text. The values stay with the processor, encrypted like message bodies, and are put back in what the assistant writes; HTML bodies are left out. Masking covers what the service recognises; other personal data in the text passes as written. The same analysis shows the account's users, in the mail and file views, what is masked; the controller chooses whether it also runs on new mail and files when they arrive. Its results are kept as positions in the text, without the text, for 90 days. A log of which assistant read or wrote what, without the content, is kept for 90 days. Sign-in can be protected with an authenticator app. Administration requires a fresh security code and is logged. The security page describes this in full.

The controller approves the sub-processors in the list. Each is bound by a written agreement that requires at least the protection this agreement gives. A new or replaced sub-processor is added to the list and announced to the account owner by email at least 30 days before it receives personal data. The controller may object to contact@pinemail.app within that time; if the objection cannot be met, the controller may end the account before the change takes effect, without cost for the time not used.

Stored data stays on the servers in Finland and Sweden, both in the EU. Outbound mail is relayed via Amazon SES in Stockholm, which processes message content in transit. Inbound mail is received directly by the Helsinki server. Cloudflare also answers DNS. Cloudflare, Inc. and Amazon Web Services are US-owned and can be subject to US law on access to data they process. Standard contractual clauses and the EU-US Data Privacy Framework apply.

The processor assists with data-subject rights, security, impact assessments and prior consultation, and incident notification. Personal-data breaches are reported without undue delay, at the latest within 48 hours of awareness. After termination, data is deleted or returned on request except where law requires retention; deleting the account also removes versions under protection against deletion. Backups are kept 30 days and are gone for good within 40 days of being taken, and files deleted in the service stay in the storage server's snapshots for up to 15 days, so deleted data remains in them for that long.

The processor makes available the information needed to show that it meets this agreement and Article 28 GDPR, first in writing on request. If that is not enough, the controller, or an auditor bound by confidentiality whom it appoints, may audit the processor, including by inspection, with 30 days' notice, at most once a year unless a supervisory authority requires more, and at the controller's cost. An audit must not give access to other customers' data.

The version and date are at the top. A new version is announced in the app or by email to the account owner and applies from the date it states, at least 30 days after the announcement unless the law requires a change sooner. A controller that does not accept a new version may end the account before it applies, without cost for the time not used. This version applies to accounts made from 2026-10-22 at once, and to accounts made before that from 2026-11-22.

Liability follows the terms and Article 82 GDPR. Swedish law. Ordinary courts. Contact: contact@pinemail.app.