Privacy Policy

Last updated: 2 July 2026 · Unpinned B.V. · Utrecht, Netherlands

This Privacy Policy describes how Unpinned B.V. ("we", "us", "our") collects, uses, and protects personal data when you use FieldNotes ("the Service"). We operate under the General Data Protection Regulation (GDPR) and its Dutch implementation (AVG).

1. Who we are

The data controller is:

Unpinned B.V.
Utrecht, Netherlands
Email: azadali@unpinned.nl

2. What data we collect

Category	Data	Purpose
Account	Username, display name, hashed password, email address	Authentication and account management
Research data	Transcript content, codes, decisions, memos you upload or create	Providing the Service
Usage	Login timestamps, feature usage logs	Security and service improvement
Technical	IP address, browser type, session cookie	Security, rate limiting, session management

We do not collect payment card data directly — payments are processed by third-party processors subject to their own privacy policies.

3. Legal basis for processing

• Contract performance (Art. 6(1)(b) GDPR) — processing your account data and research data to provide the Service you signed up for.
• Legitimate interests (Art. 6(1)(f) GDPR) — security logging, fraud prevention, and service stability.
• Consent (Art. 6(1)(a) GDPR) — where we ask for your consent (e.g. optional analytics). You may withdraw consent at any time.

4. Your research data and AI processing

When you run the AI proposer, excerpts from your transcripts are sent to a large language model (LLM) provider to generate code proposals. The following applies:

• Your data is transmitted to the LLM provider solely to generate proposals and is not used to train AI models.
• We use API agreements with providers that include data processing terms compliant with GDPR.
• You can configure your own LLM API key (BYOK) if your institution requires data to remain within a specific provider agreement.
• All data is stored on EU-based servers.

5. Data retention

• Account data is retained for the duration of your subscription plus 30 days after termination (to allow reactivation).
• Research data (transcripts, codes, decisions) is retained until you delete it or your account is terminated.
• Security logs are retained for 90 days.
• You may request immediate deletion of all your data at any time (see Section 7).

6. Third-party processors

We share data with the following categories of sub-processors, all operating under GDPR-compliant data processing agreements:

• Hosting infrastructure — EU-based server provider for application and database hosting.
• LLM API provider — for AI code proposal generation. The specific provider depends on your configuration; the default is disclosed in the application and in your export files.
• Payment processor — for subscription billing (institutional plans).
• Website analytics — Plausible, a cookieless analytics provider, for aggregate traffic statistics on our public marketing site only. No personal data is processed; see our Cookie Policy for details.

We do not sell your data to third parties. We do not use your data for advertising.

7. Your rights under GDPR

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate data.
• Erasure — request deletion of your personal data ("right to be forgotten").
• Portability — receive your data in a machine-readable format (XLSX export is available directly from the application).
• Objection — object to processing based on legitimate interests.
• Restriction — request that we restrict processing in certain circumstances.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any right, contact azadali@unpinned.nl. We will respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

8. Cookies

We use a session cookie for authentication (httpOnly, samesite=lax). We do not use tracking, advertising, or analytics cookies by default. Our public marketing site uses Plausible, a cookieless, privacy-first analytics tool that collects no personal data and sets no cookies. See our Cookie Policy for full details.

9. Security

We implement appropriate technical and organisational measures including: password hashing (bcrypt), httpOnly JWT cookies, rate limiting on authentication endpoints, HTTPS-only communication, and EU-based server infrastructure. No system is 100% secure; in the event of a data breach affecting your rights, we will notify you and the relevant authority within 72 hours as required by GDPR.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email to registered users at least 14 days before they take effect. The current version is always available at this URL.

11. Contact

Questions about this policy or your data:
azadali@unpinned.nl
Unpinned B.V. · Utrecht, Netherlands