Privacy policy

This is a courtesy translation. Only the German version is legally binding.

This page explains which personal data we process when you visit pintroai.com and use PintroAI, why we need it, who receives it and how long we keep it.

1) Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Georg Brünning, PintroAI
c/o Online-Impressum 1443, Europaring 90, 53757 Sankt Augustin, Germany
Phone: +49 171 640 1789
Email: info@pintroai.com
Contact form: pintroai.com/kontakt (topic "Privacy")

We are not required to appoint a data protection officer (Section 38 German Federal Data Protection Act, BDSG).

2) Summary

• We show no ads, use statistics (Google Analytics) only with your consent and do not sell data.
• We only use cookies that are technically necessary (sign-in, language), and for statistics only if you agree.
• The data of your account and your videos is stored in data centres in the EU (Microsoft Azure, Netherlands).
• To create videos, screens, copy and brand details go to AI services (Anthropic with processing in the USA, Microsoft in the EU) and – only with the voiceover switched on – the voiceover script goes to ElevenLabs in the USA.
• Payment is made at Dodo Payments. We never see your payment details.

3) Visiting the website

3.1 Delivering the pages. When you open pintroai.com, we process the data your browser transmits for technical reasons: IP address, date and time, page requested, amount of data transferred, referrer, browser and operating system. Without this data we cannot deliver the website or protect it against attacks. The pages run through Cloudflare's network (Section 10) and are delivered by our servers at Microsoft Azure.

In our own logs we only store shortened IP addresses (IPv4 without the last byte, IPv6 only the first 48 bits). Server logs are deleted after 30 days. The legal basis is our legitimate interest in a secure and working service (Art. 6(1)(f) GDPR).

3.2 Encryption. The connection is always encrypted with TLS (recognisable by "https://").

3.3 Cookies and local storage. We only set cookies that are strictly necessary for the service (Section 25(2) no. 2 German TDDDG); no consent is required for them (cookies for statistics only with consent, Section 3.5):

In your browser's local storage we temporarily keep the website address you enter on the home page so that it is not lost after you sign in. It is deleted as soon as the project has been created.

3.4 Fonts and content. We serve fonts, images and scripts from our own servers. No content is loaded from Google or other third parties – except for the checkout (Section 6) and Google Analytics after your consent (Section 3.5).

3.5 Statistics with Google Analytics (only with your consent). If you click "Allow" in the cookie notice, we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). It shows us how visitors find pintroai.com (for example via a search engine or an ad) and which pages they view. Nothing is loaded from Google before you consent.

• Data: pages viewed (we remove project IDs, access links and other parameters from the address first), where the visit came from, approximate location (country, region), device, browser, operating system, time and a random identifier in the cookie. According to Google, Google Analytics 4 does not store IP addresses; they are only used to determine the approximate location.
• Switched off: Google Signals, advertising features and personalisation. We do not link the data to your account.
• Cookies: _ga and _ga_<ID> distinguish visitors, lifetime at most 13 months.
• Legal basis: your consent (Section 25(1) German TDDDG, Art. 6(1)(a) GDPR).
• Transfer to the US: Google may transfer data to Google LLC in the US. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR). We have a data processing agreement with Google (Art. 28 GDPR).
• Retention: analytics data is deleted after 2 months.
• Withdrawal: at any time via "Cookie settings" at the bottom of every page. We then delete the Google cookies in your browser; data already collected is deleted when the retention period ends.

More in Google's privacy policy.

4) Account

4.1 What we store. For your account we store your email address (encrypted), a password hash (never the password itself), your language, your notification settings, the time and version of your acceptance of the Terms, and voluntary workspace details (name, company, VAT ID, country). For each sign-in we store the browser (user agent) and the shortened IP address so that you can see and end your active sessions.

4.2 Why. To provide the service under our Terms (Art. 6(1)(b) GDPR). We cannot create an account without an email address and password; the workspace details are voluntary.

4.3 Abuse protection at registration. We check email addresses against a public list of known disposable email services. So that the starter credit is granted only once per mailbox, we store an irreversible hash of the email address (spellings such as "name+1@…" are combined). This hash remains stored even after your account is deleted, for as long as we offer a starter credit; it does not allow the address to be recovered. The legal basis is our legitimate interest in preventing misuse of the free credit (Art. 6(1)(f) GDPR).

4.4 Deletion. You can delete your account at any time under "Account". After 14 days we delete the account with all projects, screens and videos; if you sign in before then, the deletion is cancelled. Data we are legally required to retain is excepted (Section 8).

4.5 Signing in with Google or Apple. If you choose "Continue with Google" or "Continue with Apple", we redirect you to the sign-in page of Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) or Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland). You sign in there; the provider processes your data as an independent controller under its own privacy policy (Google, Apple) – this may include a transfer to the USA. We only receive your verified email address (with Apple, if you wish, an address relayed by Apple, "Hide My Email") and use it to create your account or sign you in (Art. 6(1)(b) GDPR). We do not request your name, profile picture or contacts. Signing in this way is optional; you can always register with email and password.

PintroAI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use data from Google only to sign you in; we do not share it, use it for advertising or use it to train or improve AI models. PintroAI creates product videos from websites and web apps; it does not generate images or videos of people.

5) Creating videos

5.1 What is processed. When you create a video, we process the website address you enter, your details and wishes for the video, the captured screens, the website's name, logo, colours and fonts, a short product profile based on the website's texts, and the script, on-screen copy and voiceover script. If a sign-in on the website is needed for a capture, you take over the browser in the studio yourself; your input goes directly to the website and we do not store login details.

5.2 No third-party data. Under our Terms (Section 8.2), only demo and test data may be visible in the captures. Personal data of your users or customers should not reach us at all; we do not process it on your behalf.

5.3 AI services. To create videos we pass data to the following services:

• Anthropic (Claude): screens, page structure, brand details and copy – for steering the agent, the script, motion graphics and the voiceover script. Anthropic does not use data from its commercial API for training and deletes inputs and outputs after at most 30 days, unless they need to be reviewed for longer because of a usage policy violation.
• Microsoft Foundry (GPT): screens, brand details and copy – for the script plan, review and voiceover script. Processing takes place exclusively in the EU (Sweden region, EU data zone); Microsoft does not use the data for training.
• ElevenLabs: only the final voiceover script – and only if you switch the voiceover on. ElevenLabs receives no screens and no account or contact data. We have switched off the use of the data for training in our account.

5.4 Legal basis and storage. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). We store finished videos and scripts for as long as your account exists. Screens that have not been used for 30 days are deleted automatically. Intermediate files of a video build are deleted after 7 days, the progress history after 90 days.

5.5 Share links. If you share a video via a link, anyone with the link can see the video, its title and the name of your product. You can switch the link off in the studio at any time.

5.6 No automated decisions. The AI creates content for your video. It makes no decisions about you with legal effect and does not assess people (Art. 22 GDPR); we do not create profiles.

6) Buying credits via Dodo Payments

6.1 Credits are sold by our reseller Dodope Payments Limited, 3rd Floor Crown House, 151 High Road, Loughton IG10 4LG, United Kingdom ("Dodo Payments"). Dodo Payments is an independent controller for payment processing, tax, invoicing and fraud prevention and processes your payment, billing and contact data under its own privacy notice. We do not receive your payment details (such as your card number).

6.2 When you click "Order with obligation to pay", we create a checkout at Dodo Payments and send it the selected pack, an internal purchase number and – so you do not have to type it – your account's email address (Art. 6(1)(b) GDPR). We then redirect you to the Dodo Payments checkout. Nothing from Dodo Payments is loaded on our pages; what happens on the checkout (such as cookies to prevent fraud) is governed by Dodo Payments' privacy notice. After payment, Dodo Payments sends you back to PintroAI.

6.3 Dodo Payments sends us confirmation of your purchase: order number, pack, amount, tax, currency, country and payment status, and for refunds and chargebacks the respective transaction. We use this to add your credits (Art. 6(1)(b) GDPR). For each purchase we also store when and in which version you agreed to the Terms and to immediate performance – as evidence (Art. 6(1)(c) and (f) GDPR).

7) Emails

7.1 We only send emails that belong to the service: email confirmation, password reset, security notices, purchase confirmations, acknowledgements of withdrawals, cancellations and contact requests and – unless you unsubscribe – the message that a video is ready. The legal basis is Art. 6(1)(b) GDPR; for security notices our legitimate interest in protecting your account (point (f)). There is no newsletter.

7.2 Emails are sent via Microsoft's Azure Communication Services with data storage in Europe.

8) Contact, withdrawal and cancellation

8.1 If you write to us via the contact form or by email, we process your details (email address, topic, message) to handle your request (Art. 6(1)(b) GDPR, otherwise point (f)). Messages from the form are deleted after 12 months.

8.2 Declarations made via the "withdraw from contract" form (name, email address, order number, time) are stored as evidence for three years, i.e. until the end of the regular limitation period (Art. 6(1)(c) and (f) GDPR).

9) Security and operation

9.1 Abuse protection. To fend off attacks and automated misuse, we count requests per IP address or account (rate limiting, stored for 2 days) and log security-relevant events such as sign-ins, password changes and purchases in an audit log. We keep the audit log for 12 months and the shortened IP addresses it contains for only 7 days. The legal basis is our legitimate interest in the security of the service (Art. 6(1)(f) GDPR).

9.2 Error monitoring. We record technical errors of our servers with Microsoft Application Insights (West Europe region). Error messages and technical details of the request are recorded, no page views and no usage behaviour; IP addresses are not stored. Entries are deleted after 30 days (Art. 6(1)(f) GDPR).

9.3 Backups. The database is backed up automatically; backups are overwritten after 7 days.

10) Recipients and processors

We use the following service providers. We have concluded a data processing agreement under Art. 28 GDPR with all of them that process data on our behalf (for the providers listed, part of their terms of business). The full list with addresses is available under sub-processors.

We only disclose data to authorities if we are legally obliged to do so.

11) How long we keep data

12) Your rights

You have the right to

• access the data we process about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR) – you can download an export of your account data yourself under "Account",
• withdraw consent with effect for the future (Art. 7(3) GDPR), where we base processing on consent,
• lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).

Right to object (Art. 21 GDPR): If we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. We do not carry out direct marketing.

For all requests, a message to the address in Section 1 or via the contact form is enough.

13) Changes

We update this policy when the service or the legal situation changes. The version published here applies.

---

Last updated: 3 October 2026