Privacy policy
What information the service handles, why it is used, who receives it and the rights available to you.
Last reviewed 2026-10-19
1. Who is responsible
WE ARE HEY, S.L., Spanish tax identifier B27645472, operates pineapi. We are responsible for the personal information we use to manage website enquiries, customer relationships and our own service security.
Our registered address is Calle Gas, 28, piso 0, puerta 1, 08800 Vilanova i la Geltrú, Barcelona, España. For privacy and support enquiries, contact contact@heytalent.app. Do not send identity documents, passwords or sensitive information unless we have agreed a suitable channel.
2. Information we handle
When you contact us, we receive your name, email address, optional company name, expected usage, intended use and any explanation you enter. The submission includes the page from which you contacted us. Providing the required fields lets us respond to your request; you can leave optional fields blank.
Operating the website involves request and device information, including IP addresses used for abuse prevention. Vercel BotID checks submissions for automated abuse. Vercel Web Analytics and Speed Insights collect website usage and performance information, such as visited pages, browser and device characteristics, and loading measurements.
The API service handles account and team information, authentication credentials, search filters or profile URLs, run status, returned professional-profile records, usage and billing records, and webhook destinations you configure. Payments are handled through Stripe. Do not include secrets or unnecessary personal information in search inputs or webhook URLs.
3. Why we use information
We use enquiries to answer questions and take steps you request before entering a contract. Where you act for a business, our legitimate interest is communicating with its representative and administering that business relationship. We use customer information to provide the contracted service and maintain its accounts.
Our legitimate interests in preventing fraud, protecting the service and understanding its reliability support proportionate security and operational measurement. Applicable accounting, tax and other legal duties require certain transaction records. These purposes do not justify collecting more personal information than needed.
Submitting the contact form does not subscribe you to a newsletter. We do not use the enquiry form to obtain consent for unrelated marketing. Any future consent-based processing must explain its purpose and provide a way to withdraw consent.
4. Professional-profile data and customer responsibilities
The service retrieves LinkedIn profile information through a professional-profile retrieval provider in response to customer searches or URL lookups. Depending on the source record, results can include names, professional profile identifiers and links, photographs, location, work history, education and other professional-profile content. Being visible online does not remove the protection personal information receives under data-protection law.
The parties’ responsibilities depend on the actual processing. Where pineapi processes information on a customer’s behalf, a data processing agreement must govern that activity. You can request the agreement and applicable provider information at contact@heytalent.app. Where we determine our own processing purposes, our own controller obligations apply.
Customers are responsible for the lawful basis, notices and rights requests associated with their own use of results. Their acceptance of our terms does not supply a lawful basis for processing someone else’s information. If your profile information is involved, contact contact@heytalent.app to request access, raise an objection or ask for deletion. We will assess the request and coordinate with the relevant customer where appropriate.
6. How long information is kept
We delete commercial enquiries from our business records after 12 months without further interaction, provided there is no active customer relationship. Where an enquiry becomes part of an active relationship, we retain the relevant correspondence to administer that relationship, subject to the exceptions below.
Results have a 30-day retention window measured from run creation. Expired runs are eligible for deletion once they have completed, returned partial results, failed or been cancelled, together with their associated result records. Work still running or queued is not removed by that expiry process. Download results you lawfully need before the window ends.
We delete account information and saved search inputs, including filters and profile URLs, within 30 days after account closure, except for records that must be retained for a legal obligation or to establish, exercise or defend a legal claim. Saved search inputs are separate from run results and are not deleted merely because a result expires.
Transaction and other legally required records are retained separately from downloadable results. Any information retained for legal obligations or claims is restricted to that purpose and is not reused for unrelated purposes.
Security logs, backups and copies held by service providers have separate retention arrangements. The result window and account-closure period are not a promise that all such copies are erased within 30 days. Copies downloaded by customers are subject to those customers’ own responsibilities.
Access and deletion requests are handled by our team at contact@heytalent.app; the process does not require a self-service account-deletion feature. We assess the records concerned, coordinate the necessary action and explain any lawful reason that prevents deletion.
7. Cookies and browser storage
The website does not persist advertising click identifiers or campaign attribution in browser storage. Vercel describes Web Analytics as using no third-party cookies; this does not mean that all website requests are anonymous or that no provider processes technical information.
The separate service dashboard uses an authentication cookie for sign-in. Security features may process device and request signals. If optional tracking is introduced, the notice and consent controls must be updated before that tracking starts.
8. Your rights
Depending on the processing and applicable law, you may request access, correction, erasure, restriction or portability of your information, and object to processing based on legitimate interests. You may withdraw any consent without affecting processing that was lawful before withdrawal. These rights are subject to the conditions set out in the GDPR.
Send requests to contact@heytalent.app, identifying the information concerned and how we can reply. Our team handles these requests manually. We may request proportionate information to verify identity; do not send an identity document unless it is necessary and we have agreed a suitable channel. The normal response deadline is one month, with a permitted extension for complex or numerous requests and notice of the reason.
You can complain to the Spanish Data Protection Agency (AEPD) or the competent supervisory authority in the place where you live or work. You do not need to contact us first to exercise that right. If a request concerns a customer’s independent use of results, we may need to direct it to that customer or assist them, depending on our role.
9. Changes to this notice
We will update this notice when relevant practices change and identify the revision date. Material changes requiring a separate notice or consent will be handled accordingly.
Privacy policy · Terms of service · Request a data processing agreement