Privacy Policy

The Pending — operated by The Pending GmbH
Document version: 6 November 2026

1. Who we are

The Pending GmbH, Nestroystraße 13, 81373 Munich, Germany, is responsible for the processing described here unless we identify a customer as the controller. Our managing directors are Tim Kriegler and Niklas Kornel. Contact us about privacy or your rights at service@thepending.app or our postal address.

This policy covers our Agency, community, iOS and Android apps, public portfolios, partner programme and websites, including thepending.com, agency.thepending.com, app.thepending.com, thepending.app, portfolios.thepending.com, partnerships.thepending.com and go.thepending.com.

Features are introduced in stages and can differ between the website, apps, plans and countries. Descriptions of a feature apply when it is available and you use it, or when information about you is otherwise processed through it. Publishing this policy does not activate an unavailable feature or give permission for optional processing.

We control account administration, our community, billing, security, moderation and our own marketing and analytics. When a customer manages applicants, talent records or CRM contacts for their purposes, we process that information on their instructions. That customer is responsible for their own privacy notice and lawful processing; our data processing terms apply to our work for them.

2. Information we receive

Information comes from you, your devices, selected sign-in and payment providers, other users, customers submitting information about you, and public professional sources. It can include:

• Account identifiers, names, email addresses, authentication records, age confirmation, declared country, roles, settings and acceptance or consent records.
• Profiles, portfolios, CVs, skills, experience, availability, locations, interests, photographs, recordings and other material you provide.
• Applications, form answers, attachments, professional contacts, correspondence, notes, ratings and customer workspace activity.
• Posts, drafts, comments, Echoes, Scenes, polls, votes, reactions, saves, follows, connections, Circle membership, events, attendance choices, voluntary check-in timestamps, pins, Page administration and audience choices.
• Messages, recipients, attachments, delivery/read information, notification preferences, reports and moderation records.
• AI prompts, relevant contextual information, outputs, search results, embeddings, recommendations, scores and feedback.
• Orders, receipts, transaction references, subscription entitlements, Pen balances and usage, billing information, refunds and cancellations.
• IP addresses, request and device information, access/security logs, push tokens and the usage or advertising information described below.

Required information is identified in the relevant flow. Without information necessary for an account, purchase or requested feature, we may be unable to provide it. Optional analytics, advertising consent and optional AI memory are not required for basic account access.

3. Accounts, portfolios and collaboration

We use account data to register and authenticate you, provide requested features and communicate about your account, under Article 6(1)(b) GDPR. Security and abuse prevention also rely on Article 6(1)(f), our interest in protecting users and the service.

When you hide a recurring tip, we save the tip identifier, the time and, where relevant, the Pen amount shown, with your account so the choice applies across signed-in devices and web surfaces. Earlier browser or device preferences can be transferred once to this account setting. “Show all tips again” clears these saved display choices. They otherwise remain with your account and are removed when that account is erased; they are included in your account export. These settings use our existing account infrastructure to provide the display behaviour you request, under Article 6(1)(b). They are not advertising consent, a change of audience or proof that you accepted a different price. Resetting tips does not cancel a contract or erase a separate record of a rate agreement.

When your account is created, we record the AI usage rate schedule that the sign-up page or app linked to with it: the listed services and amounts, a checksum of that schedule, the checksum in force at completion, the sign-up channel, the time and, for reference, the Terms revision served. If a rate changes between the moment the schedule was shown and the moment your account is created, the schedule shown is recorded, not the newer one. Where the sign-up did not tell us which schedule was shown (for example an older app version or a sign-in that did not pass the sign-up page), the record is marked as unconfirmed and is not treated as evidence of an agreed rate. This record documents your initial conditions under Article 6(1)(b); it is not a purchase or payment record and implies no acceptance of any later change. It stays with your account and, as explained in Section 11, can remain as unlinked contract evidence for a limited time after the account is erased.

If you choose Google, Apple or Microsoft sign-in, we receive the provider identifier and supplied identity/profile information, such as name and email, including an Apple relay address. We retain the account association needed for sign-in. This integration does not grant access to your cloud documents or retain provider tokens for ongoing document access. The provider's own privacy notice also applies.

For Sign in with Apple, we also store an encrypted refresh token so we can request revocation of that sign-in authorisation when you delete your account. We use it for this account-management purpose under Article 6(1)(b) GDPR, not to access your Apple documents or other services. A failed revocation can be retried after the Pending account is erased; it does not prevent deletion of that account. If The Pending remains listed in your Apple Account, you can also remove it in your Sign in with Apple settings. Section 11 explains the token's retention.

We use a local IP-geolocation database for regional availability and country checks. We record your declared country, declaration time and the corresponding country comparison. Availability and purchasing restrictions can differ. A separately requested availability email uses consent. Linked accounts require verification and retain their relationship and verification information.

Portfolio, profile and collaboration information is processed to provide the features you request. Public profiles, portfolios, contact cards, download links and public posts can be viewed and copied outside your contacts. Public listings may be exposed to search engines and job feeds. Check audience, discoverability and sharing settings before publishing.

People listing and tagging by non-contacts can be enabled by default. Disabling People listing does not disable a direct profile link. Portfolio-to-community synchronisation can copy basic profile fields and can be disconnected. Studio collaborators receive the access you grant; you can revoke it. Whether AI tools may read your portfolio content (Studio suggestions, the portfolio check-up and Job Finder, including the portfolio text and photos Job Finder reads) is a separate Studio setting that only you as the owner can switch on; we record the wording and version you confirmed and the time, a collaborator cannot grant it, and an earlier tick made before this record existed, or a confirmation of an earlier wording, is treated as unconfirmed until you confirm it again. Switching it off stops these tools from using your portfolio content from their next use; content already sent for a run that had started cannot be recalled. Spotty's search of your own works, which only your account can use, follows your Spotty setting instead (section 5).

Customers can create or import records about applicants and professional contacts, including people without accounts. They may share selected records, notes, attachments and AI scores with authorised colleagues or external reviewers. Review links use passwords and expiry; other share links may be accessible to anyone possessing the link. Protected-link access uses necessary cookies and can record access counts, times and an IP-derived binding.

Shared application records may also show an applicant picture from a linked portfolio, an agency submission, a file submitted with the application or a photo added by the listing's manager. Turning off agency visibility or password-protecting the main portfolio link stops external review links from selecting the picture directly from that portfolio. It does not remove a picture included in an agency submission or application, or added by the manager, even if it shows the same image. The listing's own managers may continue to see the linked portfolio picture. Changing these settings does not recall image links or copies that reviewers have already received.

Applications received by email may be forwarded, including attachments within delivery limits, to the customer's configured email address. The customer and its email provider receive the delivered copy under the customer's own arrangements. Deleting a platform record does not recall copies already delivered by email.

For projects, switching off the Application Manager disables its custom application form but does not stop applications and their attachments from being stored for that project. Automatic AI evaluation is controlled separately and remains subject to the application-analysis notice described in Section 5. These records follow the application retention rules in Section 11.

4. Community, messaging and recommendations

We process content, audience choices, social connections and membership information to deliver community functions, under Article 6(1)(b). Safety and moderation use Article 6(1)(f), and Article 6(1)(c) where a specific legal duty applies. Private feedback is named, not anonymous. Page content may remain with another authorised administrator after an individual closes their account. Scenes normally leave the active display after 24 hours; Encores and permitted reshares can remain.

Scene polls and rating sliders store the author's prompt, options and layout choices, and link your selected option or rating from 0 to 100 to your account. Only members allowed to view the Scene can answer, and you can change your response while the sticker is open. The author and authorised Page administrators see totals, averages or a rating distribution; other eligible viewers see percentages or an average after answering, or once the sticker closes. Sticker results do not disclose responder names, account identifiers or individual responses to other members. These interactions use Article 6(1)(b) to provide the feature you use. Your votes and ratings are not used for recommendations, interests, profiling, Spotty or search.

A sticker closes when the Scene's 24-hour period ends. The author can receive an hourly summary when new responses arrive, without responder names. In-app notices and permitted push delivery follow the notification settings and provider arrangements below. Individual responses and retained aggregate results have different deletion rules, explained in Section 11.

To help you choose a place, the composer offers city and country labels aggregated from public-audience posts only where at least two different authors have posted from that city. Suggestions contain no account identifiers. This reuse relies on Article 6(1)(f), our interest in making public place labels easier to select. The shared suggestion list is cached for one hour. It is separate from precise GPS metadata that may already be embedded in an uploaded photo.

Entered places can also be resolved through OpenCage. If an ordinary lookup cannot resolve a place name, we may send that text and its country context to AWS Bedrock to interpret the name, then verify the proposed place through OpenCage. We do not add an account identifier to those requests. This supports the location feature you request under Article 6(1)(b). Verified names and contextual aliases can be reused as reference records; their retention is described in Section 11.

Posts shared with a Circle audience in an Open Circle can also be opened outside that Circle through links or chat shares, appear through Echoes or Scene reshares, and be displayed on public share pages without an account. This applies to existing and new posts, subject to any active “First in Circle” period and publication restrictions. They do not enter other feeds merely because the Circle is Open. On-request and Private Circle posts remain restricted to Circle members. The current access setting is checked again when a shared post is opened; changing an Open Circle to On-request or Private restricts further outside access. Authors retain access to their own content. This setting cannot recall copies already saved outside The Pending.

Circle events can include a title, description, dates, city, venue and online meeting link. Visibility depends on the Circle's access settings: some event details and attendance counts can be public, while the venue, meeting link and attendee list are restricted to members. Choosing to attend can appear in that member-only list; showing attendance on your profile is a separate choice. A voluntary check-in records a timestamp, not your device location, and the check-in indicator is visible to members while the event is running. The end of that display does not itself delete the stored timestamp. We also store your Circle pins and selected reminders, and can add an event to your own platform calendar when requested. You can withdraw your attendance or check-in and change your profile-display choice through the available controls.

Community recommendations use expressed and inferred interests, semantic and media similarity, follows and connections, reactions, comments, saves and other eligible interactions, location, recency and previously displayed content. Interest relevance and activity by your network carry more weight than overall popularity. Inferred interests have less weight than interests you chose. Repeated exposure reduces priority, and diversity rules limit repeated authors and topics. Eligible paid plans can add a limited feed boost; it does not override audience restrictions or guarantee a position. We may derive up to five suggested interests from a 30-day activity window. This is profiling. For non-advertising recommendations we rely on Article 6(1)(f), our interest in relevant professional discovery, subject to necessity and balancing your rights. Choose “Latest” in the main feed for newest-first ordering without personalised ranking there. Spotlight and other recommendation surfaces keep their own ordering. You can edit interests, dismiss suggestions and contact us to object.

Opening a member's profile while signed in can record your identity, visit time and count. Depending on feature access, the member may see visitor names. Private browsing stops new named visit recording; it does not erase earlier visits. This feature and content insights use Article 6(1)(f), our interest in professional-network feedback and measurement.

Messages and attachments are stored to deliver conversations. Read receipts can be disabled per conversation. Messages are access-restricted but are not end-to-end encrypted. Authorised operational access can occur when necessary to deliver the service, investigate a report, prevent abuse or meet a legal duty. Removing a message from view does not mean every retained copy is immediately erased.

Administrative AI access to non-public posts and the report-based review of messages are described in Sections 5 and 6. These are separate from the optional private-content search and memory functions of your own Spotty.

Push delivery uses Apple Push Notification service or Google Firebase Cloud Messaging. Payloads may include sender information, identifiers, an avatar URL, group name and a message preview of up to 180 characters or an attachment filename. Apple or Google processes the payload; previews may appear on your lock screen. Manage permissions in device settings and notification categories in the app.

Meet video calls
Our team can invite you to a video call in Meet. A host opens a room and shares a signed, time-limited guest link (by default valid for seven days) directly or by email; the addresses typed for an invitation are used for that email and are not stored with the room. When you join, you enter a display name; it is kept in a signed cookie on your device for 12 hours and is shown to the other participants, who receive your name and, while you share them, your camera, microphone and screen content. Audio and video travel encrypted between the participants' devices. Our own signalling and relay servers coordinate the connection and, where a direct connection is not possible or relaying is enforced, forward the encrypted media without being able to read it. Meet does not create recordings of calls or retain copies of in-call chat or shared-board views. In-call chat and reactions are passed on live and not stored; an existing shared board follows its own storage rules. A host can keep you in a waiting room, admit, mute or remove you, and lock or end the room; a waiting-room notification tells the host that a guest with your display name is waiting. A board the host puts on the table can be read by admitted participants. Archiving closes and hides a room but does not itself erase its stored record (name, schedule, host and settings). Archived room records currently have no automatic expiry and remain subject to necessity and applicable erasure rights. We also keep daily aggregate usage counters (calls, joins and duration) without names or room references; the relay's technical connection logs follow our infrastructure log retention. Meet pages load no analytics. We rely on Article 6(1)(f), our interest in holding video calls with the people we work with, and on Article 6(1)(b) where the call is part of a contract with you.

5. AI assistance, discovery and application analysis

Member-facing Spotty and our finders use prompts and relevant profiles, applications, contacts, documents, messages or other authorised context to answer requests, find opportunities, draft material and propose actions. We retain conversation and tool records to operate and troubleshoot these features. Actions requiring approval are presented for confirmation. Spotty shows a short activation notice describing what is sent and to whom, and we record the version you confirmed. You can stop using Spotty at any time in Spotty’s settings; the stop takes effect immediately for Spotty chat, Spotty email and the search over your own content. A request that was already sent to a provider when you stop cannot be recalled; its answer is discarded rather than stored or sent to you, and the Pen for that message is refunded. Text already displayed on your screen before the stop can remain visible there. Requested AI features generally use Article 6(1)(b); proportionate safety and quality improvement use Article 6(1)(f). We process customer-controlled content on that customer's instructions.

AI tools for listings, projects and application forms
When you choose Generate or Update with AI, we send your instructions and relevant editor content to Claude through AWS Bedrock to draft or revise fields. Update with AI includes the values currently on your screen, including unsaved changes and any client or person names you entered. Generate can also process an image you supply; when you generate from a website, Jina Reader receives the URL and retrieves its content for the AI request. These tools do not retrieve submitted applications or their attachments. Suggestions fill the editor and are saved to the listing, project or form only when you save. We retain usage and billing records separately. Technical diagnostics can include the supplied source URL and a short excerpt of an invalid AI response. Necessary processing of your own information to perform a contract with you for the service you request relies on Article 6(1)(b); customer-controlled information about other people is processed on the customer's instructions as described in Section 1.

AI inference and embeddings for the product features described here use Amazon Web Services' Bedrock service, including Anthropic Claude, Amazon Titan and TwelveLabs Marengo models. The separate developer tools described below have their own providers and processing locations. Claude and Titan support language tasks and text search. Marengo describes audio and video through numerical representations used for content matching. Inference is configured in EU regions; Marengo media jobs run in Ireland and its text requests can be routed between EU regions. Model names identify the technology; using these models through Bedrock does not mean that we send your inputs directly to Anthropic or TwelveLabs. Short-lived prompt caching may occur. We do not use your content to train foundation models. Interaction and feedback signals can improve recommendations and assistant behaviour; that is separate from foundation-model training.

Community content analysis can process post text, selected images, audio/video and explicit interests to describe content, generate keywords and create search and recommendation vectors. We use these representations to match eligible content to relevant queries and interests. Audio, visual and speech-related representations are kept separately; they are not a voice-identity or facial-identification system. Media analysis is part of operating the available community service, rather than a separate member switch. This does not remove optional settings or rights of objection, and it is separate from advertising personalisation. Content analysis for discovery relies on Article 6(1)(f), our interest in making the professional community searchable and relevant.

Audience restrictions control who can see content; a followers-only or Circle audience does not by itself exclude the content from backend analysis needed for those features. Access to resulting search and recommendation information must respect those audiences. Spotty search over your own content: when you start using Spotty, after confirming its activation notice, we keep a search index over content you created on The Pending — posts (including posts visible only to some people), comments, portfolio works (including hidden works), Job Finder results and, if you use the CRM, the names and notes you keep there. To build it, the text is sent to AWS Bedrock (Amazon Titan). New own-content indexing requires a current activation. Earlier index copies cannot be searched through this feature without that activation. Only your account can search the index; it does not make restricted posts or hidden works visible to anyone else, and each result is checked against its source so deleted or changed content is not returned. If you stop using Spotty, indexing and searching stop immediately; the index copies are kept inactive for 90 days and then deleted. Your original content is not affected. Spotty memory and private search are separate settings with their own deletion rules. Processing your own information that is objectively necessary for the personal search you activate uses Article 6(1)(b). For customer-controlled CRM information, we act on the customer’s instructions under our processing terms; the customer must establish a basis for information about its contacts. Where we independently control necessary retrieval of other people’s information in your own content, we rely on Article 6(1)(f), the interest in providing your account-restricted retrieval without making that content available to others. The inactive 90-day recovery period serves continuity if you restart and relies on Article 6(1)(f); you can request earlier erasure. Activation does not establish a lawful basis for every piece of third-party or sensitive information supplied. Private-message and unpublished-draft indexing follows the separate choice below. Where external-AI sharing requires a separate permission, the relevant explanation and affirmative action are separate from general acceptance of our Terms.

For Marengo media jobs, we create temporary processing copies in our Ireland working storage and delete them and their results after the job attempt. A one-day storage-expiration rule provides a backstop for interrupted jobs and late results; it is not a guarantee of physical deletion within exactly 24 hours. Stored matching vectors follow the source content's applicable lifecycle. A file may be excluded from semantic analysis because of technical or processing limits; this does not exempt it from applicable publication checks.

Web research sends search terms and requested page URLs to Jina Search/Reader. Queries can contain personal information from your instructions or context, even though we do not add a separate account identifier. Talent and client discovery can collect public names, professional summaries, business contact details, location and source URLs from websites, directories and professional-network pages. For discovery we control, we rely on Article 6(1)(f), our interest in professional discovery. Contact us with a source URL to request access, correction, removal or to object. Minimal suppression information may remain to respect an objection. Public availability does not remove privacy rights.

Application analysis can run automatically unless the customer disables it, and only after the responsible customer has confirmed the current version of our application-analysis notice. It processes application information, form answers, the extracted content of attachments and role requirements to produce professionalism and fit scores, recommendations and summaries. The scoring model receives a job-relevant representation of the application: contact details, the applicant's name and statements about personal characteristics protected under anti-discrimination law are removed from that representation first, and visual descriptions of photographs are never a scoring input. The listing's own requirement text is reduced the same way: criteria about such characteristics are removed before scoring. The original application and documents remain stored unchanged for the customer's own review; extracting their text is still processing of personal data. Where the model reports insufficient evidence, or its reasoning refers to such a characteristic, the application is marked for human review and receives no automatic score, ranking position or recommendation; Spotty's application evaluations list such applications separately, unscored. Rationale text that mentions contact details is discarded and flagged. Scores can influence optional sorting and visibility. A score does not itself change an application's status: managers can decide individually or in batches, including by confirming an action proposed by Spotty. Our Terms require substantive human review for significant applicant decisions; a confirmation button alone is not a substitute for that review.

For new applications, we also record whether a custom form applied at submission and which fields were included and required. We use this record to limit form-completeness checks; applications recorded as having no custom form are not evaluated for missing answers to that form. This record follows the application's retention and access rules.

Matching considers skills, experience, availability, location and role requirements. A Job Finder gender filter uses only an express Search Profile preference, not an inference from pronouns or portfolio gender fields. Without that preference, this filter does not exclude opportunities. Submitted documents and free text may nevertheless contain sensitive information. Supplying information is not blanket consent to evaluate sensitive characteristics. Where Article 9 GDPR applies, an additional lawful condition is required.

You may ask us or the responsible customer for an explanation, correction or human review, express your position and contest an outcome. Article 22 GDPR protections apply where its conditions are met. We do not treat all filtering or ranking as consequence-free.

Private-content search: indexing your own private chat messages and unpublished drafts is off by default and separately optional. Activation creates account-restricted text/vector search copies using AWS Bedrock. Switching it off stops further indexing and removes those derived copies; originals remain under their own lifecycle.

Spotty memory: cross-conversation memories and retrieval are separately optional and off by default. When enabled, Bedrock can derive notes and search copies from your Spotty conversations. You can inspect or forget notes. The optional weekly brief states facts counted by the platform; its single model-written sentence, which compares a Job Finder result with one of your memory notes, is only generated while memory is enabled. Disabling memory removes memories and Spotty-conversation search copies without deleting original conversations. Reactivation does not automatically reconstruct deleted memories from earlier conversations. In-progress processing may finish before withdrawal completes. These two optional functions rely on Article 6(1)(a).

Optional Companion helpers retain permissions, schedules, tasks and results under the permissions you activate. When you agree, we record the version of the statement you were shown; an outdated screen cannot record a new agreement, and withdrawal is always possible. A scheduled search checks again that your account is active and the schedule still switched on before it is charged and before it runs; a charged search that cannot start is refunded once. You can pause or delete them. A public Spotty preview sends entered text to our AI infrastructure; please avoid unnecessary personal information.

Administrative AI assistance
Where enabled, authorised administrators use Admin Spotty, an internal assistant using Claude through AWS Bedrock, to answer operational questions, investigate service issues and assist moderation. Its permitted context includes member names, email addresses, contacts, profiles (including age, gender and city/country), applications, portfolios and posts of every audience, including non-public posts. Relevant query results are sent to Bedrock to produce the answer; they are not shown to other members through this assistant. Its administrative tools can also return short input/output previews of AI runs and session titles. Reading private message content is subject to the separate report-based scope in Section 6.

Internal analysis using AI developer tools
Our developers use Cursor, Claude and Codex to investigate product behaviour and analyse business operations. Permitted database results can become prompts or tool context processed by Anysphere (Cursor), Anthropic (Claude) or OpenAI (Codex), and the model providers used by the selected tool. The data includes structured product and business records, account identifiers, account email addresses, city/country, permitted business and catalogue text, and public post text. This is identifiable information, not anonymous statistics. Our restricted developer readers exclude member first-name/last-name fields, non-public post text and private message bodies. These are also outside the permitted scope of those developer analyses. These technical restrictions describe the restricted readers, not every administrative or database connection. Business records are not necessarily public, and permitted text or an email address can itself identify a person or contain information about others.

The restricted internal readers exclude password and authentication-secret fields and exact personal coordinate fields; these fields are not permitted inputs for these internal analyses. Health information and precise personal addresses are not intended inputs for these internal analyses. Field restrictions are not a guarantee that permitted free text contains no names, addresses, health information or other sensitive information. Such information can occur in a post, application, business text or message; its processing remains subject to the additional legal requirements that apply to it.

For our own administration, proportionate service diagnosis, product/business analysis and abuse prevention, the GDPR basis is Article 6(1)(f): our interests in operating, understanding and protecting the service. This basis requires necessity and a balancing of your rights; it does not permit unrestricted access merely because an AI tool is available. Article 6(1)(c) applies only where a specific legal duty requires the processing. Customer-controlled applicant, talent and CRM data remain subject to the instructions and processing terms described in Section 1. This notice does not authorise their reuse for unrelated purposes, override communications confidentiality or supply an additional condition for sensitive data. Your own Spotty activation, memory and private-search settings govern those member features; they do not control these separate internal processes. Your rights, including objection, are explained in Section 12.

6. Moderation and media checks

We process reports, content, evidence, explanations and decisions to enforce our rules, protect people and meet specific legal duties, relying on Article 6(1)(f) or, where applicable, Article 6(1)(c). Posts, Scenes, comments, Echo captions, profiles, Circles, events and chat messages can be reported. When a report is closed you receive an in-app notice of the outcome with the case reference; it never discloses our internal notes or the identity of the person you reported, and the reported person is not told who reported them. A person whose content is removed or whose account is restricted receives a statement of reasons that says whether automated means were involved and how to contest the decision. Report, outcome and statement records are kept as case records for the moderation retention period.

Child safety
Reports of suspected child sexual abuse or exploitation can create a separate restricted safety case. A report is an allegation, not a finding. We use the report, relevant content and account references, review decisions and necessary access records to assess the concern, restrict prohibited content and protect people. Only specifically authorised staff with additional authentication can access retained evidence. Restrictions are explained to the affected member through the existing moderation-notice route. A notice may be delayed only where a specific applicable legal restriction or lawful authority order permits or requires it; we document the basis and review the delay.

Where the law requires it, we promptly provide relevant information to the competent law-enforcement or judicial authority. These duties include Article 18 of the Digital Services Act where its reporting conditions are met; the German Federal Criminal Police Office (BKA) is a designated receiving authority. Necessary compliance processing relies on Article 6(1)(c) GDPR; proportionate safety review and enforcement otherwise rely on Article 6(1)(f), our interest in protecting people and the service. Sensitive information and information about suspected offences require the additional conditions of Articles 9 and 10 where applicable; a general legitimate-interest basis does not replace them. Section 11 explains retention. Contact our child-safety contacts, Niklas Kornel and Tim Kriegler, at report@thepending.app. Do not attach or forward suspected illegal material to make a report.

Report-based review of private messages
Where report-based access is enabled and a report naming a member remains open, Admin Spotty can retrieve messages authored by that member from 30 days before the report onwards, including messages they send while the report remains open, to assist moderation and detect abuse. The scope follows the author across their chats; it is not restricted to the conversation mentioned in the report. Results include message text, its account and conversation references, timestamps, reply/quotation references and message/file type information. This access does not provide attachment files or their storage keys. Messages authored by the other participants are not independently retrieved through this access, although their words or information may appear in text the reported member quoted or copied.

The report-based access ends when the report is resolved or dismissed, unless another open report still brings the message within this scope. Closing a report does not itself erase source messages or copies already used in an administrative conversation or case record; Section 11 explains retention. A report is an allegation, not proof of wrongdoing. The assistant supports review and does not make an allegation true. The confidentiality of communications and any additional requirements for sensitive information continue to apply; describing this access is not consent to it.

For generated-media checks of community post attachments and their uploaded video posters, we use Sightengine as our primary image and video analyser and Detesia as a second analyser. The checking process submits media to both services. Sightengine's result determines the automated visual assessment; Detesia's result is recorded to compare detector performance and does not change that assessment. A pending check or technical failure can delay or prevent a completed analysis. IRCAM Amplify checks audio, including extracted video soundtracks. These checks support our legitimate interest in enforcing the human-made-media rule and reviewing possible detection errors, under Article 6(1)(f) GDPR. Profile, Page and Circle pictures, portfolio uploads and private-chat files are not sent to these providers through their ordinary upload flows. Republishing a file as a community post attachment brings it within the community checks. Other portfolio AI tools and processing needed to provide those features remain separate. Merely saving a draft does not trigger these publication checks. Submitted media can contain personal information and embedded metadata; replacing a filename does not remove that information.

For photo checks, we use the original, uncropped upload where available so that camera and file-provenance information remains available to the detectors. Sightengine and Detesia receive the checked image and its embedded metadata, which can include camera details, capture time and precise GPS coordinates if present. We do not remove GPS before this transfer, to preserve potential signals about the image's origin and authenticity. HEIC photos may be converted to JPEG while preserving EXIF metadata for the check. These coordinates come from the file; they are not the city or audience you select for a post. Before a photo is stored for display, we remove its embedded metadata, such as GPS coordinates, camera details and capture time; a photo that cannot be cleaned this way is not uploaded. A deferred check or retry of a stored photo uses the available cleaned copy, so it may no longer include the original metadata. Later cropping or metadata removal does not undo an earlier provider transfer.

Sightengine receives the video file used for checking or smaller, silent video copies made from frames sampled across it. A video sent as a whole can include its soundtrack and metadata remaining in that file. Detesia receives the video file used for checking rather than Sightengine's sampled copy. We use generated-content analysis through our server, without sending a separate member name, email address or profile record in the request. The media itself can still identify people. Our integration does not submit files to Sightengine's Feedback API for model training or to its human-review or duplicate-list features.

We also keep detector-comparison records, including for files that pass a check. These contain the uploader reference where available, a file checksum, media type, individual detector outcomes and scores, technical result details and references, and the publication result and hold status. They can be linked to the corresponding uploaded file. The comparison record contains no media bytes or original filename. Authorised staff use these records to assess detector reliability, investigate incorrect results and administer publication checks; they are not shown to other members. Their retention is separate from provider-held files and human-review cases, as explained in Section 11.

Required generated-media checks are a condition of publishing the affected new media; members cannot bypass them while publishing that media. A result requiring a hold, or an incomplete required check, hides the affected photo, video or audio. Normally, the post's text and cleared files remain visible to the selected audience. A Scene with a held file, an A/B test containing a held option, or a post with nothing else to show stays visible only to its author until it can be released. The hold does not automatically delete the post or its files. Detection is fallible. A result below our blocking threshold may be classified as uncertain and kept available for review instead of preventing publication. You can retry a failed check or request human review of the held file and provide an explanation. A review request does not itself publish the file. We retain the account reference, checksum, results and review decision to administer the rules and recognise an approved re-upload. Previously published unchecked media is not automatically removed merely because these checks were introduced. Private chats are excluded from this generated-media publication check; reports and other safety rules still apply. Files deliberately attached to Spotty can still be processed by its AI service as described in Section 5.

Review requests from the app and website use the same human-review process, including your account reference, the file under review and your explanation. When a held file or post is released, we send an in-app notice and, where enabled, a push notification identifying what is live. This is a service and moderation notice, not an advertising event; push delivery uses the providers described in Section 4.

Commercial-content checks may use disclosure tags, links, codes and AWS Bedrock analysis of text or selected images. Your own disclosure can apply an advertising label; other suspected advertising is referred for human review before a platform-applied label. You can contest moderation decisions at service@thepending.app.

7. Payments, support and business communication

Stripe processes direct payments made on our websites, including partner campaign checkouts, which are not offered in our iOS and Android apps. It collects the payment and billing information needed for checkout, including a billing address where required. We retain order, customer, subscription, invoice and transaction references and the Pen ledger. We can access billing information and limited payment-method details, such as the card brand and last four digits, through Stripe; we do not receive the full card number. Apple and Google handle their store purchases. RevenueCat receives account-linked app identifiers, receipt/transaction and technical information to validate purchases and synchronise entitlements, renewals, refunds and restores.

Our current purchase flow records the product or plan, quantity, purchase channel, the AI usage rates shown with the offer, the relevant Terms and Refund Policy revisions and timestamps. Verified payment records contain provider references, reported amounts, currency, discounts and tax information where supplied, and links to the resulting credit or subscription. After an in-app purchase, the app reports the transaction identifier returned by its store purchase call for that offer. We compare it with the verified provider event and the purchasing account and product; a client report alone does not prove payment. We record whether the purchase could be linked to its offer, any unresolved reason, retry count and error category. An unmatched purchase retains its paid entitlement without being assigned a different offer or today’s terms.

For a matched order we retain the confirmation text and attached contract versions, an integrity checksum and delivery status, attempts, times and mail-service reference so that a failed delivery can be retried without changing the agreed wording. These records are accessible to authorised staff for fulfilment, support, correction and evidence, not to other members. Confirmation emails use AWS SES and your account email address. A removed account link does not make provider references anonymous. Administrative rate-change records identify the rate, old and new value, time and responsible administrator, with aggregate exposure counts used to assess the change. We do not create a new advertising or analytics purpose from these records.

For a proposed change to your agreed AI usage rates, we record the affected service, old and proposed amounts and charging unit, the balances or service periods covered, the effective date, the offer version, a checksum and the exact wording, and whether and when your account expressly accepted it. The acceptance record names the earlier recorded rate it modifies — your purchase offer, an earlier acceptance or the schedule recorded at sign-up, or that none was on file — and the purchased and included Pens you held at that moment. For reference it also names the Terms revision that was in force when the offer was opened; accepting a rate change does not accept or change the Terms. It is separate from hidden-tip settings. We use it to apply the correct rate and prevent use at an unaccepted new rate, perform the agreed service under Article 6(1)(b), and retain necessary evidence for disputes under Article 6(1)(f); Article 6(1)(c) applies where a specific recordkeeping duty requires it. Authorised staff can access it for billing, support and legal administration. Copies and delivery records use our existing AWS storage and transactional email infrastructure, not a new advertising or analytics purpose. Necessary agreement evidence can remain after account erasure as explained in Section 11; the account link is removed, which does not by itself make the record anonymous. You may request access, correction, restriction or erasure under Section 12.

Purchases and support use Article 6(1)(b), payment security and claims handling use Article 6(1)(f), and required financial records use Article 6(1)(c). Service emails use AWS SES. Our general, support and reporting mailboxes are hosted by IONOS and contain correspondence, addresses and submitted attachments.

Our own sales records can contain public-source or directly supplied professional contact details, company information, source references, correspondence and notes. Contractual requests use Article 6(1)(b); proportionate business administration and direct-marketing preparation use Article 6(1)(f). Electronic-marketing permission requirements apply separately. You may object to direct marketing at any time. Optional newsletters and promotional messages use consent unless a lawful exception applies.

8. Advertising and campaign measurement

For partner applications, offers and campaigns, we process representative contact and account details, company and tax-country information, submitted creatives and destination URLs, selected markets and restrictions, revision messages, approval times and the reviewing administrator's reference. Commercial records include company-specific campaign proposals and exact prices, the selected approved creative and version, campaign dates and seats, temporary reservation deadlines and status, accepted Terms revisions and confirmation times, checkout and invoice/payment references, booking confirmations and stops, and the staff, times and reasons associated with proposal changes, payment reconciliation or refunds. Earlier credit purchases and allocations remain recorded where needed to administer their existing rights and accounting history. We use these records to administer the requested advertising relationship, approve material, reserve the selected campaign inventory, confirm paid bookings and resolve payment or service issues. A reservation expiry releases inventory; it does not itself erase the associated order or payment evidence.

Advertising-file imports are processed on our infrastructure into previews and drafts. The source upload and extracted images initially use private storage. Import does not connect to a Google account, synchronise a campaign or send the file to Google for parsing. It does not use an AI parser or import audience lists, budgets, bids or historical measurement into the campaign. A file you upload can nevertheless contain that information, so please remove unrelated personal data and confidential material before uploading. Private originals and supporting documents can retain embedded metadata, including location information. New public copies of partner images are cleaned of identifying metadata, including GPS, before release; an image that cannot be cleaned is refused. This does not remove information visible in the picture, clean video-container metadata or automatically rewrite files published before this safeguard.

The existing functional browser session holds a draft-access reference, with a derived reference stored against unassigned drafts and imports. This lets the same browser privately edit the draft and claim it after signing in, including when the login rotates the session identifier. It is not used to select advertisements or measure viewers. Assigning a selected draft to a company does not assign every other preview from the import. A saved draft has its own image copy.

Authorised staff review submitted material. Approved media are copied to public asset storage and may be accessible through their public URLs; approval is therefore not a promise that the files remain private until the campaign starts. Booked campaigns reference their approved versions. Later edits do not silently replace those versions. Company contact details and internal review notes are not part of the public advertisement. AWS provides the existing hosting and storage, and Stripe processes online payments; the programme does not introduce a Google-account connection or a new import provider.

We keep a separate private archive of campaign booking confirmations, the accepted Partnership Terms and acceptance record, payment and available invoice records, corrections, necessary approved-creative evidence and stop records. It can also contain supporting business documents supplied by authorised staff. Records identify their source order or event, version, date, integrity checksum, retention deadline or hold and storage status; customer delivery records track the recipient and delivery outcome. Issued versions are preserved and a correction is recorded separately. Authorised partnership staff can administer the archive; an authorised company account can access its customer-facing documents, but not internal review evidence merely because it bought a campaign. Downloads require an access check and use short-lived links. The archive uses existing AWS storage and transactional email services and is separate from public creative files and advertising measurement.

For individuals requesting or performing their own business contract, necessary processing relies on Article 6(1)(b) GDPR. For company representatives and necessary creative review, access protection, dispute handling and business evidence, we rely on Article 6(1)(f): our legitimate interests in administering lawful advertising contracts and securing and evidencing their performance. Identified tax and accounting duties rely on Article 6(1)(c). The draft-access session uses the necessary-functionality exception in § 25(2)(2) TDDDG for the editing/import service you request. These purposes are separate from optional advertising measurement. Section 11 explains retention; Section 12 explains access, correction, erasure, restriction and objection rights.

Partner advertisements can appear in the Community feed and Spotlight on our website and in the app. The app can also show an advertising page between fullscreen videos or after a shorter group of videos. Advertisements are labelled. Their explanation identifies the selection basis and provides a way to report the ad.

Eligible partner ads are selected using campaign country restrictions, available page context and general rotation. Matching your expressly chosen interests requires advertising consent. We do not infer interests from your browsing or interactions for this partner matching. Booked seats affect an eligible partner's selection weight. Repetition limits can remove a partner from the available choices. Without advertising consent, the website uses weighted random selection without adding advertising session state. The app uses the separate daily serving state described below.

On the app's Community surfaces, we use short-lived server-side records to limit repeated partner ads and rotate eligible partners. These records contain serving counts by partner and a rotation position under a pseudonymous account reference for the current UTC day. They expire shortly after that day ends. A selection prepared for a later video swipe can count towards this limit even if you do not reach the ad. This state is not anonymous, is not used to infer interests and is not shared with partners. It adds no advertising cookie or identifier to your device. We rely on our legitimate interest in limiting repetitive advertising and operating the rotation, under Article 6(1)(f) GDPR. You can object by contacting service@thepending.app. Support records the objection and switches off this counter for your account. Ads can still appear. Separate advertising consent is still required for interest matching and account-linked advertising measurement.

The current advertising choice also covers personalised suggestions of member posts marked as advertisements. This additional use needs permission for that scope; an earlier choice limited to partner offers and advertising measurement does not cover it. Without the additional permission, those posts are excluded from personalised suggestions unless they come from you or an author you follow. They can still appear in the chronological “Latest” feed, on profiles, in Circles and in search, subject to their audience restrictions. With the additional permission, these member posts can be ordered using the community recommendation signals described in Section 4. This differs from partner-interest matching, which uses expressly chosen interests.

The community welcome and, for members past the welcome, a feed card can ask about personalised advertising and measurement. The current choice includes partner offers, recommendations of member posts marked as advertisements and advertising measurement as described above. Choosing “No thanks” does not remove access to the free service or require payment. The welcome requires an answer, not agreement. A member who has not answered this question can receive it once even after declining in the cookie banner; no permission is inferred from seeing it. A member who previously allowed the narrower partner-offer and measurement scope can be asked once about the additional use. “Keep my current setting” leaves the earlier scope unchanged. An answer to the welcome or feed question is recorded with its offered scope so that question does not repeat; members who declined that question are not asked to upgrade it. This choice remains separate from analytics, campaign-link attribution and Apple's tracking permission. You can change it in Settings → Data & ads on the website or in the app's privacy settings.

Country restrictions and programme availability also apply to Brand Pages.

Feed and Spotlight deliveries are counted when the server supplies the ad, with or without advertising consent. We also keep aggregate partner link-request counters. For advertising pages in the app's fullscreen video viewer, counting instead requires current advertising consent and a report that the ad page is current on screen. That report identifies the partner, campaign run, placement, selection basis and any matched interests. The request is associated with your signed-in account; it is not an anonymous request. The server checks permission again before counting. Without that permission, the report creates neither an individual impression nor an aggregate count. The ad can still appear without being measured. A page becoming current does not establish how long you watched it or that you paid attention.

The stored aggregate counters identify the partner, placement, UTC day, event type and a traffic-classification flag, with totals and technical creation/update times. They contain no viewer account, session, IP address, visitor hash, device, browser or country. Ordinary request headers may be examined transiently to classify apparently automated or suspicious traffic; their values are not stored in these counters. Partners see aggregate totals, with traffic classified as automated or suspicious separately identified. Repeated requests can count more than once. These totals do not establish unique people, certified viewability or complete coverage, and are not used for ad selection or pricing. The additional app report is distinct from server-only delivery counting and from the website's consent-based visibility signal.

Partner booking and dashboard pages can also show platform-wide counts of members active in the previous 30 days, split by recorded advertising permission, and how many consenting members chose a campaign interest. The split is not shown below 20 active members. An interest-match count below five is displayed as “fewer than 5”; the two permission-group totals do not have that additional threshold. Results can be cached for one hour. They do not identify members by name, promise campaign reach or guarantee that no individual can be inferred. We use these summaries to explain the difference between contextual and interest-based eligibility, not to give partners access to individual profiles. Our basis for producing the summaries is Article 6(1)(f), the interest in proportionate commercial transparency, subject to necessity, balancing and safeguards.

Account- or session-linked advertising measurement remains subject to the existing permissions. Brand Pages can use the website’s visibility signal; equivalent native-app visibility measurement is not promised. Those reports cover eligible measured activity in the retained history. Audience thresholds use distinct measurement identities and do not guarantee anonymity or unique people across devices.

With advertising consent, impression and click records can include an account/session reference, placement, page, declared interests, role, plan, signup cohort, language, device/browser category, country and referrer. While you are signed in, with advertising consent and any required platform permission, partner links routed through go.thepending.com can transmit our campaign parameters, configured affiliate parameters and a click reference to the partner. Without these permissions, or on our other redirect hosts, our partner redirects remove these parameters and do not create an attributed click record. Opening a partner's website still connects your device to that website and is subject to its own processing and privacy notice. A participating partner may return an order/lead reference, conversion type, currency and value, linking an attributed click to activity on its website. The partner may associate this with information it holds. Partner dashboards receive aggregated reports.

Without advertising consent, we do not create the individual advertising measurement records or attributed redirects described here. The separate daily app serving state still operates unless you have objected to it. The existing platform-permission requirements for cross-company attribution also continue to apply. In the iOS app, cross-company conversion attribution additionally requires Apple's App Tracking Transparency permission. Missing permission blocks attribution. A session-scoped permission record can remain for 90 days after its last update. Changes made while offline reach us when the app next communicates. We do not collect IDFA for this feature.

Optional advertising relies on Article 6(1)(a) GDPR and, where applicable, § 25(1) TDDDG. Consent is separate from PostHog analytics. Withdraw it in cookie preferences or the website/app privacy settings. General contextual advertising and necessary business administration rely on Article 6(1)(f) or the relevant contract. For transient request processing used to provide the page and classify delivery counts, we rely on Article 6(1)(f), our interest in operating the service and limiting misleading automated-traffic totals. This does not replace a permission required for access to information on your device.

When you report a partner advertisement, we record your account reference, the partner, placement, selected reason and timestamps to investigate misuse and protect the service, under Article 6(1)(f). This report is not advertising consent. The report form does not ask for free-text personal details; internal report summaries use counts by partner and reason. Reporting is not a promise of automatic removal or hiding of the partner.

Visits through our own campaign links
When we use our own campaign links, we measure arrivals using the campaign link, visit time, a daily pseudonymous identifier, traffic category, device and browser category, country and referring website. The visit record does not contain an account reference or the raw IP address. These records are not anonymous. For proportionate first-party campaign measurement we rely on Article 6(1)(f), our interest in understanding which communications bring visitors to the service; you can object. Visit records are kept for 400 days.

Optional campaign-to-registration attribution
Campaign-link attribution is a separate optional choice, called “Campaign links”; “Accept All” in the main website’s cookie notice includes it. Only while this choice is on do we remember the campaign link and information identifying your decision in your existing session and associate the link with your newly created account. The choice must already be on when the link is opened and the same decision must still be valid when you register. A choice made later does not retrospectively attribute an earlier visit. A withdrawn or expired decision cannot be revived for an old visit by choosing again: that is a new decision and needs a new visit through the link. We use the association to understand which of our campaigns led to registrations. It is accessible to authorised staff, not shown as a public profile field, and uses our existing AWS-hosted application infrastructure. This optional association relies on Article 6(1)(a) GDPR and, where device storage or access is involved, § 25(1) TDDDG. Turn off “Campaign links” in cookie preferences or in the website’s Settings → Data & ads. Turning off personalised partner advertising alone does not change this separate choice. The link and registration still work without attribution. Section 11 explains the separate retention of visit statistics and completed account associations; Section 12 explains your rights, including erasure.

Shared listings
Listing-share statistics are separate from our campaign-to-registration attribution. We record visits and arrival channels for shared listings and can keep the source link or channel with an application submitted through that listing. Listing owners can see channel-level visit and application statistics. The visit records follow their visit-retention rule; an application's source information follows the application's own lifecycle. These records are not made anonymous merely by omitting a tracking cookie.

Invitation programme
The following membership-time invitation programme applies when it is offered at signup. It is separate from advertising and analytics choices. An invitation link or code shows the invitation at signup together with a short notice. Your new account is linked to the inviter only if you choose “Use invitation”; if you ignore it or remove it with ×, you register without crediting anyone. The inviter may earn Club or Pro time; the invited person receives no reward from the invitation. Any general free-plan Pens are separate.

An invitation code can travel in a profile or Join link, a signup form or an app signup request. The app keeps a pending code in process memory until it is removed, sign-in completes or the process ends. To identify the inviter, a public code lookup returns their display name, handle and avatar; requests are rate-limited by IP address. App invitations use a directly opened link or a code you enter. Invitation codes and notice versions in links are removed from analytics URL data.

If you choose Google, Apple or Microsoft sign-in after “Use invitation”, a random reference to that sign-in attempt travels in the sign-in’s own security state, which our sign-in system keeps in your server-side session; the selected code, the notice version shown and the chosen provider are kept in our server cache for at most 30 minutes and can be used only to complete that same attempt with that provider. They are removed when that attempt finishes — by a signup or by an existing account signing in — and otherwise expire after 30 minutes; another sign-in attempt, even in another tab, can neither use nor remove them. We do not set a dedicated referral cookie for this programme and remove the old tp_ref cookie when the updated website receives it.

From day 14 through day 60 after signup, we check pending invitations on relevant post or onboarding events and through a daily check. An invitation qualifies once the account is active, has a verified email, has completed community onboarding, has at least one live post, and shows a login, post, comment or applause event on or after day 14. We check account-state flags and event existence or time, not what you write. Chat messages are not used at all. The activity can be private or restricted-audience; this does not make its contents available to the inviter. Checks stop after qualification, an objection or expiry; an invitation still pending after day 60 is voided. No additional interest profile is built from these checks.

We record the account relationship, programme offer, signup-notice version, qualification status and dates, and any objection or void reason. Reward records identify the inviter, rung, plan, days, frozen list value, review status and entitlement. The inviter sees pending and counted totals and reward progress, not a list of invited accounts or what an individual did. Counts or a reward can nevertheless let an inviter infer that a particular invitation qualified. Authorised staff can administer referrals and review rewards. In-app notifications tell the inviter about reward progress and approaching expiry.

For the invited person's attribution and bounded qualification checks, we rely on Article 6(1)(f) GDPR: our and the inviter's legitimate interests in crediting genuine introductions and administering the invitation programme. Choosing “Use invitation” is a request for the invitation service, not consent. For the inviter, administering the agreed programme and providing earned membership time relies on Article 6(1)(b).

Your right to object: choose Settings → Privacy → “Stop counting me”, or contact service@thepending.app. You do not need to explain your reasons, and your account remains available. A pending invitation is voided and future checks stop. If it has already counted, we stop using it for new reward calculations; the inviter keeps membership time already granted or banked, with the necessary record of that grant. We do not switch to another legal basis to continue invitation qualification after your objection.

The 60-day checking window is not a deletion deadline for every referral record. An invitation that ends without counting — expired after day 60, objected to before it counted, or beyond the programme limit — is scheduled for erasure in the first daily cleanup after 90 days from when it ended; for expiry, the period starts at the end of day 60. If you object after an invitation counted, it stops counting for new rewards immediately and its link to the inviter is scheduled for erasure in the first daily cleanup after 90 days from your objection. Repeating the objection does not restart that period. A counted invitation without an objection keeps its link only while a further reward or an open review may still depend on it. This need is checked daily from programme and reward state, not from your activity; a quiet account does not lose earned progress.

Once every milestone of the inviter’s programme has a final decision and none is under review, the links are scheduled for erasure in the first daily cleanup after 90 days. The inviter keeps a total for display, which is not used for new rewards. A newly added milestone that still needs existing links prevents that cleanup. If an invited account is deleted after its invitation counted and without an objection, the link is removed and the inviter keeps one count towards future rewards with no reference to the deleted account. Keeping a total does not authorise further checks of that person’s activity. These are product retention rules, not statutory periods.

The inviter’s minimal reward records — milestone, plan, days, status and fixed list value — remain while that account exists to document earned rights, show milestones, prevent duplicate grants and enforce the programme’s value limit. They do not identify invited people. Banked or running membership time and rewards under review do not expire because of record age. The reviewer reference and link to the subscription receiving a settled reward are removed after the end of the third calendar year following fulfilment: the end of awarded membership time or a final refusal. A banked reward has not yet been fulfilled. The programme’s links and reward records are removed when the inviter’s account is deleted; separately required tax or accounting documents follow Section 11. Specific documented disputes or audits can hold affected records, with the original deadline applying again when the hold ends. You may request access, correction, restriction or erasure under Section 12; stopping counting is different from deleting your account.

9. Analytics, cookies and external content

Security logs can contain IP addresses and device/request information. Separate first-party page statistics use daily pseudonymous identifiers and coarse device, referrer and location information derived locally; their statistic rows do not retain raw IP addresses. These statistics can include city/region and are separate from the country-only PostHog configuration. We rely on Article 6(1)(f) for security, stability and proportionate service measurement.

PostHog: optional analytics, error diagnostics and session replay require analytics consent. They record product interactions, pages/screens, device/app information and technical events under a pseudonymous identifier that can be linked to your account. PostHog is not anonymous. The configuration limits its location information to country and filters advertising click identifiers.

With analytics consent, sticker-creation and first-answer events can record the sticker type and, at creation, the number of poll options. These events do not contain the prompt, option labels, selected option or rating value. They use the same pseudonymous analytics identifier and retention rules as the other PostHog events.

Replay records navigation and interactions. Web replay uses masking and media exclusions. Replay on native Android screens is disabled. Consented web analytics and masked web replay can run on our website pages opened inside either the Android or iOS app. Native iOS replay uses structural information without screenshots and shows a recording indicator while it is running; it pauses while a web page is open. Sensitive screens, including messages, billing, account settings and protected media, are excluded or paused. Console and network-payload recording are disabled. Masking is a safeguard, not a guarantee that arbitrary content can never appear in a recording.

The paid PostHog plan has a seven-year event/exception query window. This is not an automatic deletion deadline. Person profiles remain until deleted. New replay recordings are configured for 30 days; expiry does not mean immediate physical deletion, older recordings can retain earlier settings, and metadata or exported copies have separate lifecycles.

Decline optional analytics without losing core access, or withdraw in web cookie preferences or app account settings. Manage the choice on each surface you use. Withdrawal stops future consent-based collection; erasure of previously collected records can be requested separately. A previously granted consent-related Pen credit is not reclaimed on withdrawal. Legal basis: Article 6(1)(a) GDPR and § 25(1) TDDDG.

Storage
Purpose and duration

Session and security storage
Sign-in, request protection and requested access. Website sessions normally last seven days; request-protection cookies can last approximately one year.

Partner draft access
The existing functional session also holds the private access reference for an advertising draft you create or import. It survives the sign-in session rotation and is not used for advertising selection or measurement. Temporary draft/import access expires after 24 hours, even if the browser session lasts longer. Company drafts have the separate lifecycle described in Section 11.

Consent choices
Website consent cookies normally last 365 days; account records can retain the choice and evidence separately.

Own campaign links and registration
Campaign-link attribution is a separate optional choice, called “Campaign links”; “Accept All” in the main website’s cookie notice includes it. If it is on, the existing server-side session holds the campaign code and information identifying that decision. No separate campaign cookie is added. We use the existing session cookie to connect the permitted visit with a later signup only while that decision remains valid. A visit made without this permission, or one whose permission was withdrawn or has expired, is not attributed after a later opt-in. Without this permission, links still work and visits may still be counted without associating them with your new account. Turn off “Campaign links” in cookie preferences or in the website’s Settings → Data & ads. Turning off personalised partner advertising alone does not change this separate choice. This choice is also separate from the membership-time invitation programme and from PostHog analytics.

Protected-link cookies
Remember requested access; reviewed share/review flows use up to 12 hours.

Meet guest cookie
Joining a Meet video call as a guest sets a signed cookie (meet_guest) holding the room, the link version and your chosen display name for 12 hours. It admits you to that room's call page and connection and is strictly necessary for the call you requested; a host can revoke it by rotating the link or removing you.

Meet device preferences
Meet remembers your selected camera, microphone, speaker and layout in your browser's local storage (meet.prefs). The saved device identifiers and preferences are used locally for the call interface, not analytics. They have no automatic expiry and remain until replaced or cleared through your browser's site-data controls.

External-media preferences
The optional External media choice is valid for 180 days unless changed earlier. It is stored in local storage (tp_external_media_v1), in the tp_cookie_consent cookie (external_media and external_media_t) and, when signed in, in your account settings. The newer recorded choice takes precedence; the general consent cookie can have a different lifetime.

Invitation attribution
Where the membership-time invitation programme is offered, it does not set tp_ref. Codes travel through links and signup requests; the app uses process memory, not a persistent referral store. For provider sign-in, a random reference to the attempt travels in the sign-in’s own security state; the selected invitation is held in our server cache for at most 30 minutes, usable only by that attempt, and removed when it finishes or expires. The website's session cookie normally lasts seven days; that does not extend the hold's validity. See Section 8 for the account relationship and your right to object.

PostHog storage
Consented identifiers and SDK state use cookies, local storage or app storage; persistence depends on the deployed SDK settings, while local/app state can remain until cleared or reset.

App credentials, settings and caches
Until expiry, logout, reset, removal or cache eviction, depending on the item. Clearing the app does not cancel a subscription.

Strictly necessary device storage uses § 25(2) TDDDG where its conditions are met. Other device storage/access requires the applicable permission; an existing login session is not consent to advertising or analytics.

External media in portfolios covers YouTube, Vimeo, Spotify, SoundCloud, Instagram and TikTok. This optional category is off by default. Without permission, players remain local placeholders. Our server can fetch and cache permitted provider previews without forwarding your visitor IP, cookies or browser headers; Instagram is not fetched for a server-side preview.

You can choose Allow external media or Only necessary in the portfolio cookie notice. Allowing the category loads visible players and permits players to load on subsequent visits while the choice remains valid. Tapping a player is also an activation of this shared External media category: it loads that player and remembers permission for the listed providers, rather than only for that individual item. Once loaded, the provider receives your IP address, browser information and the site address through the browser request and may use cookies or similar storage.

Withdraw through the External media switch in the portfolio Cookie Policy or Turn off external media at any loaded player. This unloads the players and stops subsequent automatic loading. Analytics and advertising remain separate choices. Community/chat link cards use local previews; opening their external link connects to the external site. Withdrawal does not erase information already received by a provider.

10. Recipients and international processing

Provider or recipient
Function

Amazon Web Services
Application hosting, databases, file storage, CloudFront delivery, SES email and Bedrock inference/embeddings using Claude, Titan and Marengo, including the Admin Spotty context described in Sections 5 and 6; relevant account, content and connection information.

Anysphere (Cursor); Anthropic (Claude); OpenAI (Codex)
AI developer tools used for the internal product and business analysis described in Section 5. Selected queries, permitted database results and related context can be processed by the tool provider and its model-service providers. These are separate recipient relationships from Claude supplied through AWS Bedrock.

IONOS
Contact, support and reporting email hosting.

Stripe; RevenueCat; Apple; Google
Payments, purchase validation, subscription entitlements and store services; Apple/Google also deliver push notifications.

Google, Apple and Microsoft
The optional sign-in method you select.

PostHog
Consented analytics, replay and diagnostics.

Sightengine (Kozelo SAS, France); Detesia; IRCAM Amplify
Generated-media checks of community post attachments: Sightengine and Detesia analyse images and video; IRCAM Amplify analyses audio. The files can contain visible personal information, embedded metadata and, for whole videos, a soundtrack. Section 6 explains the scope and detector-comparison records.

Jina AI GmbH, part of Elastic
Web search and page retrieval, including queries, requested URLs and returned content.

OpenCage GmbH
Converting entered places to coordinates. We send place text with a request not to log query contents; technical logs are separate.

Cloudflare Turnstile
Bot prevention on protected forms, including forms opened inside the app. The widget sends connection and device signals to Cloudflare, including the IP address, TLS fingerprint, User-Agent, site key and associated origin. Cloudflare processes these signals on our behalf to secure our forms. It also acts as a separate controller when using them to improve Turnstile's bot detection, under its Turnstile Privacy Addendum. Our security purpose relies on Article 6(1)(f) GDPR, our interest in preventing automated abuse; Cloudflare identifies its own legitimate interests for its separate improvement purpose. This security service is separate from personalised advertising.

Selected audiences, customer teams/reviewers and external content providers
Publishing, sharing, communication and external content you choose.

Advertising partners
Attributed clicks/conversions where consented, and partner administration.

Authorised personnel, professional advisers and authorities may receive information where necessary. Providers may act as our processors or, for their own payment, store, authentication or advertising activities, as independent controllers.

AWS application infrastructure is configured in EU regions, but global delivery and vendor support can involve other countries. PostHog uses an EU endpoint; its agreement also permits international processing, including the United States. Store, payment and other global services may process data outside the EEA. Our confirmed arrangements for Detesia, IRCAM and Jina restrict their processing and access to the EU/EEA.

We use Sightengine's global processing route. The images, videos and embedded metadata described in Section 6 may be processed in the EU, Canada or the United States; this service is not restricted to EU-only processing. The international-transfer safeguards below apply where required.

The AI developer tools are not covered by the EU-region statement for our AWS infrastructure. Their providers are partly based outside the EEA, and processing can take place outside the EEA, including in the United States. The applicable service agreement and configuration determine the recipients, locations and provider retention. The transfer safeguards described below apply where required. Contact us for details of the arrangements that apply to your information.

Transfers requiring safeguards must be covered by an applicable adequacy decision or appropriate safeguards, such as the European Commission's Standard Contractual Clauses with necessary supplementary measures. Data Privacy Framework coverage applies only to a certified recipient and covered transfer. Contact us for information or a copy of the safeguards applicable to your data. Using our service is not blanket consent to international transfers.

11. Retention and deletion

Retention depends on purpose, customer instructions, legal duties and necessary claims evidence. Deactivation, hiding content, scheduled erasure and expiry of backup copies are different steps. The following application retention rules apply, with documented exceptions for open reports, appeals, disputes and required legal records:

Records
Period or criterion

Account deletion
An accepted self-service deletion request from Agency Settings, the community or the app deactivates access immediately and schedules account purge after a 14-day recovery period. Contact support during that period to request recovery. The period is not a promise that all shared, customer-controlled, legally retained or backup copies are erased after 14 days; their applicable rules remain separate. If the account owns a project with another active co-administrator or an open co-administrator invitation, self-service deletion can be blocked before deactivation; the screen identifies the projects and the support route. If a previously accepted purge is later blocked or fails, its request stays open for resolution. Contact us if the self-service route cannot complete your erasure request; a technical block does not remove your rights.

Sign in with Apple revocation tokens
We retain the encrypted refresh token for the revocation purpose while the sign-in association exists. If revocation is still outstanding when the account is erased, a restricted retry record retains the encrypted token and the Apple client identifier without an account link. Successful revocation, or Apple's confirmation that the token is already invalid, erases that retry record. The current retry process makes at most 14 attempts, with delays between attempts; if that limit is reached, the token is erased and staff receive a failure notice. This is an attempt limit, not a fixed number of days if processing is interrupted. A token-free operational failure record can remain for investigation; it has no current automatic expiry and remains subject to necessity and erasure review. Failure is not represented as successful revocation.

Deleted posts, comments and Echoes
Content, unnecessary personal associations and linked reactions are scheduled for removal after 30 days, including individually deleted responses. Minimal empty references can preserve replies; required case identities remain for the case-retention period.

Scene polls and rating stickers
Deleted Scenes follow the 30-day content-removal schedule. Individual votes and ratings are also scheduled for deletion 30 days after the sticker closes; whichever applicable cleanup runs first removes them. Keeping a Scene as an Encore retains its aggregate result, not the individual responses beyond that period. Open reports and documented retention holds can delay deletion. Account purge removes that account's individual votes and ratings; aggregate results already frozen when a sticker closed can remain without those account-linked responses.

Replaced video originals
When a playable copy replaces an original video upload, deletion of the original is recorded together with the replacement and carried out no earlier than one hour later, so links already issued can continue working; it normally completes within about two hours. This is not a guaranteed maximum: a failed storage deletion is retried until the original is confirmed removed, which can take longer, and an original still used by a media record or a media review is retained. Earlier object versions and backup copies follow their separate rules below.

Spotty conversations
Until deleted or account closure. Deleted conversations have 30 days for recovery, then transcripts and exclusively used attachments are scheduled for erasure. Derived memories/search copies are removed separately; restoring a conversation does not restore those copies.

Spotty search copies of your own content
While you use Spotty, source checks exclude deleted or outdated content from results. A hidden or retired copy is not necessarily erased at that point: copies of deleted posts and comments follow their content-purge rules; other retired own-content copies currently have no uniform automatic expiry while Spotty remains active. After you stop, copies remain inactive for 90 days from the first stop unless you restart before expiry, after which their text and vectors are scheduled for erasure. Empty source-reference records can remain until account deletion. You can request earlier erasure of unnecessary copies. Memory and private-search copies have their own rules.

Purchase offers, rate-change acceptances, sign-up rate records and their confirmation copies
This paragraph consolidates the retention of the purchase offer, verified-purchase, rate-change acceptance and sign-up rate records described in Sections 3 and 7, which we keep to administer paid entitlements and agreed rates, resolve unmatched transactions and evidence the contract and its confirmation. The confirmation we sent you (order confirmation, accepted rate change) is kept as a copy of a commercial letter for six years from the end of the year in which it was first sent. The offer, acceptance and sign-up rate records are kept while they document a current right — purchased Pens not yet used, a running subscription, or the record that is still the latest recorded agreement for a service you use — and then for three years from the end of the year in which that need ended; a record is assessed per service, so an older record stays while it is the only record of your rate for one service, and a sign-up rate record is no longer needed once every service it lists has a later record. An offer that was never concluded documents no right and is kept for three years from the end of the year it was made; it is not subject to the statutory period of a completed transaction. Where more than one period applies to the same record, the later period applies. Provider payment facts are booking records and are kept for eight years from the end of the year of payment; the six-year period never shortens this. A concrete dispute, audit or other legal obstacle can suspend deletion through a documented hold with a review date. Shared records such as published Terms revisions and the administrative rate-change history are not deleted with your records. When your account is erased, the account link on these records is removed; they then remain as unlinked contract evidence for the periods above, transaction references can still be identifiable, and they are not anonymous by that step alone. Records whose start date cannot be established are reported for review rather than deleted on an assumed date. The daily cleanup for these records has been implemented but is not yet active; until it is, these records have no automatic expiry, which does not authorise indefinite retention — you may request review and erasure.

Confirmation, Spotty email and cancellation records
Records of statements you confirmed or withdrew (for example the Spotty activation and stop, Companion, Portfolio AI tools and the application-analysis notice): on account deletion the account link is removed and the email address recorded at the time stays with the record. Spotty email delivery records (message identifier, status, charge and sender-check results; no address, subject or message text): deleted with the account. Cancellation and withdrawal requests (name, email, receipt time): kept as records of receipt. There is currently no automatic expiry for these confirmation and cancellation records, or for Spotty email delivery records while the account remains. Their continued retention must be limited to what is necessary to demonstrate the relevant choice, fulfil an obligation or resolve an identified claim; a technical lack of expiry is not a reason to keep them indefinitely. You may request review and erasure.

Inbound-email processing records
We keep message identifiers, processing status, authentication results, hashed sender identifiers, service-inbox references and links to resulting application records to prevent duplicate processing and recover failures. These records can be linked to people even without message text. There is currently no automatic expiry; the seven-day retry-reconciliation window is not a deletion deadline. Retention must be justified by necessary duplicate prevention, recovery or identified evidence needs, and you may request review and erasure.

Drafts
Discarded drafts: 30 days. Staged media of untouched drafts: 90 days. Remaining live drafts follow their purpose and account lifecycle.

Applications and scores
Normally 180 days after process closure/deletion and no earlier than 180 days after submission. Inactive unclosed processes have a 540-day fallback with prior warning. Separate talent-pool permission or documented extensions can affect retention.

Customer CRM/manual records
For the customer's authorised use; eligible soft-deleted records normally have a 180-day cleanup period. Linked applications can affect deletion.

Human media-review files
Originals and submitted explanations: 90 days after decision. Open cases remain pending review. Minimal decision records/checksums: until account deletion.

Detector-comparison records
These records have no automatic time-based expiry at present. Deleting a post or file does not itself erase its comparison history; records linked to an uploader are removed when that account is permanently deleted. Any continued retention must be necessary for a specific detector-quality investigation, publication decision or justified evidence purpose. The lack of an automatic expiry does not permit indefinite retention. You can request access, review, restriction or erasure of unnecessary records under Section 12.

Moderation reports
Twelve months after closure, subject to necessary appeal/legal holds. Ongoing restrictions retain necessary separate records. The report record (reason, the reporter's name and contact details, the report text, decision and dates) is kept for that period even if the reported content or an involved account is deleted earlier; a deleted account is then referenced only by its identifier, and the reported content itself is not kept with it.

Child-safety evidence and case records
Media and text retained as evidence are separate from routine report records. They are accessible only to specifically authorised staff and are kept only while a documented, specific lawful purpose requires them, such as a necessary authority referral, preservation obligation or concrete legal claim. A review date does not authorise indefinite retention. When the purpose ends, text evidence is cleared and files enter the deletion process; storage failures are retried. The separate minimal case record and necessary access records are scheduled for erasure 12 calendar months after final case closure. Unnecessary content, storage references and personal details are removed when no longer needed, rather than retained merely because this period has not ended. A documented legal duty or concrete dispute can suspend erasure only for the necessary records, with a reason and review date. Account deletion, closure of an ordinary report or viewing the case does not restart the period. Earlier storage versions and backups follow the separate rules below; removing public access does not prove every copy is erased.

Advertising events
Individual impressions, clicks and conversion attributions: 90 days. The separate delivery counters contain no viewer identifiers and currently have no fixed deletion period. They are retained separately from individual advertising events. The answered-at marker for the offers question follows your community profile; the separate consent evidence follows its own retention rule. Accounting records are separate.

The app's daily partner-ad serving state expires shortly after the end of its UTC day. It is separate from the individual advertising-event history and the identifier-free aggregate delivery counters.

Partner imports and temporary drafts
Source uploads are queued for deletion after processing. Import previews and unassigned temporary drafts expire after 24 hours; an hourly cleanup clears their content and queues files for deletion. Interrupted processing is also cleaned up. Failed storage deletions are retried, so 24 hours is an access/expiry rule, not a guarantee that every storage or backup copy has already gone. The remaining emptied import or expired anonymous-draft records are due for erasure 90 days after their recorded expiry, unless a specific documented purpose requires a limited hold.

Company drafts and unsuccessful orders
A saved company draft has a lifecycle separate from its temporary import. An unbooked draft without an active proposal or other documented need is due for erasure after 365 days without a substantive edit and at least 30 days after a prior notice. Views, automatic jobs and reminders do not restart the period. Where an older record has no reliable edit date, it needs review rather than an invented deletion date. Unused expired or withdrawn proposals and released unpaid orders are due for removal of unnecessary creative payloads and detailed notes after 90 days from their evidenced ending; a minimal record required for a specific commercial or legal purpose is assessed separately.

Partner contract records and creative evidence
The private archive assigns core business documents — accepted orders and Terms, booking confirmations, invoices, payments and corrections — a ten-year period from the end of the calendar year of the relevant document or transaction event. This is our business archive rule, not a statement that every document has a statutory ten-year period. Applicable legal categories and the necessity of personal information must be assessed separately; information no longer needed for a duty or a justified evidence purpose can be erased earlier. A download, retry or account deletion does not restart the period. Necessary approved-creative and stop evidence is due for erasure after the end of the third calendar year following final campaign settlement, subject to a specific documented claim or other retention duty. A pending correction can postpone settlement.

Unused public partner files are queued for removal when no active or planned campaign, current partner record or live creative version still requires them and necessary private evidence has been preserved. Deleting a representative’s account removes their unassigned drafts and imports and clears nullable user references in retained company records. It does not erase the company’s financial history or every personal detail within retained documents. The 90-day advertising-event period does not govern these records.

The partner archive and business-record cleanup identifies due records for authorised erasure and can run automatically for enabled categories; it is not a guarantee that every record is physically erased on its due date. Records under a specific hold retain the reason, responsible person and review status. Releasing a hold restores the original deadline, rather than starting a new period. Storage failures are retried, and earlier object versions, backups and third-party copies have separate lifecycles. You may request review and erasure of unnecessary personal information.

Partner-ad reports
The account-linked partner, placement and reason record is scheduled for deletion after 90 days. A separate moderation or legal case, if opened, follows its own necessary evidence-retention rules.

Community insights
Named profile visits: 90 days; post impressions: 60 days; serving/ranking logs: 90 days.

Notifications and push addresses
Ordinary read/unread notifications: 180 days from creation. Push addresses: 180 days without app reconfirmation, or earlier on logout, invalidity or recorded permission withdrawal.

Technical records
Authentication records and outgoing email logs: 90 days. Site/portfolio/listing/campaign statistics: 400 days. Other AI run history: up to 365 days; AI cost telemetry: 400 days; retrieved raw public-source document records: normally deleted 90 days after their last fetch, so a renewed fetch of an unchanged page restarts that period; their page bodies are normally cleared earlier, by default 14 days after first collection, unless extraction is still pending or the body still feeds an active listing. Conversation-linked copies follow conversation deletion where linked.

Campaign registration associations
The 400-day visit-statistics period does not apply to a completed campaign-to-account association. Those associations currently have no separate automatic time-based expiry; they are removed when the linked account or campaign link is permanently deleted. Withdrawing consent stops new attribution, but does not by itself establish that every previously stored association has been erased. You may ask us to review and erase an existing association. Continued storage must be necessary and have an applicable legal basis; the absence of an automatic job does not authorise indefinite retention.

Meet video calls
Archiving closes and hides a room but does not itself erase its metadata. Archived room records currently have no automatic expiry; retention remains subject to necessity and applicable erasure rights. Guest display names: in the guest cookie for 12 hours and in temporary connection-presence data. Presence becomes inactive after missed heartbeats; cache copies can remain until their cache expiry, currently up to six hours. Meet device and layout preferences remain in browser storage until replaced or cleared. Waiting-room notifications to the host: as ordinary notifications, 180 days. Calls, in-call chat, reactions and shared-board views: not stored. Daily usage counters: aggregate numbers without names or room references. Relay connection logs: our infrastructure log retention.

Internal AI analysis and report-based message access
The 30-day period in Section 6 is a look-back limit for access, not a deletion deadline. Ending that access does not remove results already included in an administrative AI conversation, an analysis or a moderation case. Source records retain their own lifecycle; material retained as moderation evidence follows the case-retention rule. Admin Spotty conversations follow the conversation-deletion rule above, with erasure scheduled after the 30-day recovery period once the conversation is deleted. There is no verified common automatic expiry across undeleted administrative conversations, developer-tool histories, exported results and provider-held copies. Their retention must be limited to the operational investigation, analysis, case or necessary evidence purpose, subject to applicable legal duties and provider arrangements. Closing a report alone does not demonstrate their deletion. Contact us to request access, restriction or erasure of unnecessary copies.

Other operational records
Soft-deleted finder results: 180 days. Chat delivery/replay events: normally up to 120 days. Spam quarantine: 30 days unless restored. Export archives: seven days; download links: one hour.

Own sales prospects
Manual review is due after 24 months from the prospect's last substantive reply, or collection if there was no reply. Our own outgoing messages do not restart the period. Continued retention needs a concrete reason.

General contact/support mail
There is currently no fixed routine deletion schedule or regular mailbox review. You may request deletion; any continued retention must still be justified by the purpose, applicable duties or necessary claims evidence.

Financial and legal evidence
Applicable statutory periods; in Germany commonly eight years for accounting vouchers, ten for books/financial statements and six for business correspondence. Necessary consent, restriction and claims records follow their evidential purpose.

PostHog periods are described in Section 9. Detesia deletes submitted videos after 30 days. Other media-check data and providers follow their own contractual deletion processes; this is not a universal 30-day deadline for all provider-held data. OpenCage technical request logs can be retained for six months. Our shared geocoding-result cache lasts 30 days, and the composer city-suggestion cache lasts one hour. Verified place names and contextual aliases are kept as reusable reference records until retired, without an automatic expiry; no account identifier is attached to those reference records.

Sightengine states that submitted media are deleted after processing by default. Our integration uses its analysis APIs, not its optional file-retention features. This does not establish immediate deletion of every technical log, result or backup. Those records follow the applicable service agreement and deletion arrangements.

Automated production database backups currently use a seven-day retention setting. Historical manual snapshots are separate and have no uniform automatic expiry. Lifecycle rules for our versioned asset, community and portfolio storage make superseded file versions eligible for deletion after 30 days. Superseded versions inside the private child-safety quarantine have a one-day period; earlier source versions in other storage follow the general rule. These periods run from when a version becomes noncurrent, and storage cleanup is asynchronous, so they are not exact completion deadlines or a promise that all copies disappear at once. Restoring a backup does not remove the obligation to honour previous deletion requests. File-deletion failures require retries; removal from public view is not proof that every stored copy is erased.

12. Your choices and rights

Where the applicable conditions are met, you have rights to access, correction, erasure, restriction, data portability and protection against solely automated decisions with legal or similarly significant effects. You can withdraw consent without affecting earlier lawful processing. You can object to processing based on legitimate interests; objection to direct marketing and related profiling is unconditional.

Use account controls or contact service@thepending.app. We may request proportionate identity verification. We normally respond within one month; a legally permitted extension is explained within that month. Contact us if a self-service export is incomplete or you do not have an account. For customer-controlled records, we assist the responsible customer and can help identify them.

You can also use this contact route for internal AI processing, including to object on grounds relating to your particular situation where we rely on legitimate interests, or to challenge inaccurate information or an AI-assisted assessment. A member-facing export may not contain every internal analysis or provider-held copy. We assess access and erasure requests under the applicable law, including other people's rights and any justified preservation of case evidence.

Your self-service export includes retained records of your own Applause, Encore albums, poll votes and Scene ratings, and the stickers and text layout on Scenes you created or posted for a Page. It does not give you other members' individual sticker responses. Export archives remain available for seven days and download links for one hour. You can contact us for access, correction or erasure of an individual response, including where the interface offers changing an answer but no separate delete button. These rights are not limited to the fields currently covered by the self-service export.

You may complain to a competent supervisory authority, including the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA). Mandatory local privacy rights remain unaffected. This policy does not claim that the service satisfies every country's separate launch, representative or recruitment requirements.

We use access controls, encrypted transport and other safeguards appropriate to the service. No policy guarantees absolute security. Accounts are intended for adults aged 18 or over; contact us if you believe a child has registered.

We update this policy when processing changes and notify users of material changes. Optional consent remains separate from accepting our Terms. English is our source text; translated legal documents are provided where offered or required. A legal-document translation does not mean that the entire product interface is available in that language.