Privacy Policy

The controller responsible for processing on this website is the provider named in the Imprint. For personal data processed inside a customer's organisation on the platform, that customer is the controller and PIE acts as a processor under a data-processing agreement.

Account data (name, business email, organisation, role) to provide the service. Authentication data (password hashes, session and multi-factor records) to secure it. Usage and audit data (actions taken, timestamps, IP address, request identifiers) to operate the service, meet the audit obligations our customers have, and investigate abuse. Support correspondence when you contact us. Server logs, kept for a limited period for security and troubleshooting.

Separately from the account data described above, the service stores content that customers upload — product records, documents, and media such as photographs. For that content the customer is the controller and PIE is the processor: the customer decides what is uploaded, for what purpose, and who may see it, and we process it only on their documented instructions under a data-processing agreement.

Uploaded media can contain personal data. A product photograph may show an employee, a producer, or another identifiable person, and a customer may choose to publish such an image on a public brand portal. We have no means of establishing who appears in an image, and we do not attempt to: we operate no facial recognition and derive no biometric data, so we cannot search uploaded media by person. Building an index of that kind would itself be a new and considerably more intrusive form of processing, which is why we have not built one.

For that reason we cannot answer a request about a person depicted in customer content ourselves. If you believe an image or document held in this service concerns you, please contact the customer who publishes it — they are the controller, and they can identify and remove the material. If you contact us instead, we will forward your request and tell you which organisation is responsible, so that it is not simply lost. Our customers can delete any uploaded file at any time; deletion removes the original, the variants generated from it, and any copies published on a public brand portal. When a customer's account is closed, all of their uploaded content is deleted with it.

Performance of a contract (Art. 6(1)(b) GDPR) for account and service data; legitimate interests (Art. 6(1)(f)) for security, abuse prevention and service improvement; legal obligation (Art. 6(1)(c)) where retention is required; and consent (Art. 6(1)(a)) where we ask for it, which you may withdraw at any time.

PIE is self-hosted on infrastructure within the European Union. We use an email service provider to deliver transactional messages such as invitations, notifications and password resets. Where an organisation enables AI features using platform-funded credits, the content submitted for processing is sent to the configured model provider; an organisation may instead supply its own provider key. The current sub-processor list is maintained below and customers are notified before it changes.

Platform data is stored in the European Union. Where a sub-processor requires a transfer outside the EEA, it is covered by an adequacy decision or by standard contractual clauses; the current position is stated in the sub-processor list.

Account data is retained while the account exists and for a limited period afterwards to meet legal obligations. Audit records are retained for the period the customer configures or that the law requires. Server logs are kept for a short period. On termination, customer data is exported and then removed according to the offboarding process.

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Platform users can exercise access and erasure through the data-subject request tooling in the application. You may also lodge a complaint with a supervisory authority.

The public website sets no advertising or analytics cookies. The applications set a session cookie required to keep you signed in, and a preference cookie for interface settings. Both are strictly necessary and are not used to track you across sites.

For any privacy question or to exercise a right, contact us using the address in the Imprint.