This Privacy Policy explains how Helmcraft GmbH ("Pinchy", "we", "us") collects, uses, and protects personal data in connection with the Pinchy software, the Pinchy websites at heypinchy.com, docs.heypinchy.com, and buy.heypinchy.com, and related services. We take your privacy seriously and process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (Datenschutzgesetz, DSG).
The controller responsible for personal data processing under this Privacy Policy is:
Helmcraft GmbH
Hietzinger Hauptstraße 101/1
1130 Vienna, Austria
Commercial Court of Vienna, FN 588989k
VAT identification number: ATU78631027
Email: privacy@heypinchy.com
This Privacy Policy applies to personal data that we process as a data controller, including in the following situations:
This Privacy Policy does not apply to personal data that you process within your own self-hosted Pinchy installation. In that context, you are the data controller, and Pinchy has no access to the data you process with the software.
We process the following categories of personal data.
Website visit data. When you visit one of our websites, our servers log technical information such as your IP address, browser type, operating system, referrer URL, and the pages you visit. This data is used to operate and secure the websites. The legal basis for this processing is our legitimate interest in operating a stable and secure service (Art. 6(1)(f) GDPR).
Trial request data. When you request a trial license key, we process your name and email address. This data is used to issue the trial key, to send it to you, and to follow up with you about your trial experience. The legal basis is the performance of pre-contractual measures at your request (Art. 6(1)(b) GDPR) and our legitimate interest in understanding trial usage (Art. 6(1)(f) GDPR).
Subscription and billing data. When you purchase a Pinchy subscription, we process your name, email address, company name, billing address, VAT identification number (if provided), and payment information. This data is used to conclude and perform the subscription contract, to issue invoices, and to comply with accounting and tax obligations. The legal basis is contract performance (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).
Communication data. When you contact us by email or through our contact form, we process the content of your communication, your name, and your email address. This data is used to respond to your enquiry and to maintain records of communication with customers. The legal basis is contract performance (Art. 6(1)(b) GDPR) or our legitimate interest in communication with interested parties (Art. 6(1)(f) GDPR).
Obligation to provide data. Providing the trial and subscription data is not generally required by law or contract, but it is necessary for the respective purpose. Without your name and email address we cannot issue and send you a trial license key. Without the subscription and billing data (in particular name, company name, billing address, and, where applicable, VAT identification number) we cannot conclude and perform the subscription contract and cannot meet our statutory invoicing and retention obligations. If you do not provide this data, the respective service cannot be provided.
License key metadata. Pinchy license keys are cryptographically signed tokens that contain the customer identifier, subscription identifier, plan, user seat limit, and expiry date. No personal data beyond the billing contact's identifier is embedded in the license key itself. License keys are validated offline by your Pinchy instance and no telemetry is collected from customer installations by default.
We use the following service providers to operate our business. These providers act as data processors on our behalf or as independent controllers, as indicated.
Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, processes payment transactions on our behalf. Stripe is a data processor under a Data Processing Agreement. Stripe may transfer data to Stripe, Inc. in the United States under the EU-U.S. Data Privacy Framework.
Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, provides static hosting for our websites (S3 and CloudFront, region eu-central-1 / Frankfurt). Data processed in this context remains within the European Union.
Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, provides server hosting for our Odoo subscription backend, which holds customer subscription and billing data and issues trial license keys, and for our own Pinchy application instances. Our infrastructure is operated in Hetzner's data centre in Nuremberg, Germany. All data processed on these servers remains within the European Union.
Migadu Mail GmbH, Lindenfeldstrasse 25, 8050 Zurich, Switzerland, provides email hosting for our business communication and transactional email delivery (such as trial license keys and subscription notifications). Email data may transit through Migadu's Swiss infrastructure. Switzerland benefits from an adequacy decision of the European Commission.
Self-hosted analytics (Umami). For aggregated website usage statistics we run a self-hosted instance of Umami, an open-source, cookieless, privacy-focused analytics software, on our own server (Hetzner Online GmbH, Nuremberg, Germany; see above). The analytics data is processed exclusively on our own infrastructure within the European Union. There is no third-party analytics provider and no transfer of analytics data outside the European Union. Umami does not use cookies, does not set persistent identifiers, and does not track individual visitors across sessions or websites.
We have concluded Data Processing Agreements with all processors where required by Article 28 GDPR.
Where personal data is transferred outside the European Economic Area, such transfers are safeguarded by an adequacy decision of the European Commission (e.g., Switzerland) or by the EU-U.S. Data Privacy Framework (e.g., Stripe, Inc. in the United States). Our website analytics are self-hosted within the European Union and no longer involve any transfer outside the EEA. A copy of the applicable safeguards may be requested from privacy@heypinchy.com.
We retain personal data only for as long as necessary for the purposes described in this Privacy Policy or as required by law.
Under the GDPR, you have the following rights regarding your personal data:
Separate notice of your right to object (Art. 21 GDPR). Where we process personal data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation, to such processing. If you object, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or unless the processing serves to establish, exercise, or defend legal claims. Please address your objection to privacy@heypinchy.com.
To exercise any of these rights, please contact us at privacy@heypinchy.com.
You also have the right to lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, Austria, www.dsb.gv.at.
Our websites use only technically necessary cookies required to operate the website and the checkout flow.
For website analytics we use a self-hosted instance of Umami, an open-source, cookieless, privacy-focused analytics software that we operate on our own server within the European Union (Hetzner Online GmbH, Nuremberg, Germany). Umami records aggregated information such as page views, referring domains, browser language, and the country derived from your IP address; the IP address itself is not stored. Umami does not use cookies, does not create persistent identifiers, and does not track you across sessions or websites. The analytics data is processed exclusively on our own EU infrastructure, with no third-party analytics provider and no transfer outside the European Union. Our legal basis is our legitimate interest in understanding aggregate website usage to improve our content and offering (Art. 6(1)(f) GDPR).
We do not use third-party analytics cookies, marketing cookies, retargeting pixels, or cross-site tracking technologies. Should we introduce technologies that require consent under § 165 Telekommunikationsgesetz 2021 (TKG 2021) in the future, we will obtain your consent via a cookie banner before activation.
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, in accordance with Article 32 GDPR. These measures include encryption in transit via TLS, encrypted storage of credentials, access controls on our systems, and regular security reviews.
We may update this Privacy Policy from time to time to reflect changes in our processing activities or in legal requirements. Material changes will be communicated to active customers by email to the billing contact. The current version is always available at heypinchy.com/privacy.
For any questions regarding this Privacy Policy or the processing of your personal data, please contact:
privacy@heypinchy.com
Helmcraft GmbH
Hietzinger Hauptstraße 101/1
1130 Vienna, Austria