Privacy Policy

Effective date: 8 May 2026 Last updated: 8 May 2026

1. About PinStaQ

PinStaQ is a lost-and-found recovery service that helps people register items, attach or use PinStaQ identifiers such as QR codes or tags, receive finder notifications, communicate safely about found items, and arrange item return through approved return channels.

This Privacy Policy explains how PinStaQ collects, uses, shares, protects, and retains personal data when you:

• visit our website;
• create or use a PinStaQ account;
• register an item or PinStaQ tag;
• scan a PinStaQ QR code or report a found item;
• communicate with an owner, finder, school, organisation, courier, locker network, or support team;
• pay for a subscription, recovery fee, return fee, delivery, postage, or related service;
• use our mobile application, web application, email, SMS, push notification, or customer support channels.

For data protection purposes, PinStaQ is usually the data controller of the personal data described in this policy. This means PinStaQ decides why and how that personal data is processed.

If PinStaQ processes personal data on behalf of a school, employer, corporate customer, or other organisation under a separate agreement, that organisation may be the controller and PinStaQ may act as processor for that specific processing.

2. Regulations and standards we aim to comply with

Where applicable to PinStaQ's services, users, and operating territories, PinStaQ aims to comply with the following privacy, electronic communications, consumer, ecommerce, and platform obligations:

UK privacy and data protection

• UK General Data Protection Regulation (UK GDPR).
• Data Protection Act 2018.
• Privacy and Electronic Communications Regulations 2003 (PECR), including rules on cookies, similar technologies, email marketing, SMS marketing, and electronic communications.
• Data (Use and Access) Act 2025, to the extent applicable as provisions and regulator guidance come into force.

EU and EEA privacy and platform rules

• EU General Data Protection Regulation (Regulation (EU) 2016/679), where PinStaQ offers services to, or monitors the behaviour of, individuals in the EEA.
• EU ePrivacy rules, including national laws implementing the ePrivacy Directive, where applicable.
• EU Digital Services Act, to the extent PinStaQ hosts, transmits, moderates, or makes available user-provided content to users in the EU and falls within the relevant service categories.

Online safety

• Online Safety Act 2023, to the extent PinStaQ provides a user-to-user service in the UK. PinStaQ's mediated owner/finder messaging falls within the scope of the Act, and PinStaQ applies proportionate safety measures including illegal content moderation and user reporting. PinStaQ accounts are restricted to users aged 18 and over.

Consumer, ecommerce, and digital service rules

• Consumer Rights Act 2015, including requirements around services performed with reasonable care and skill, digital content, and unfair contract terms.
• Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, where PinStaQ enters distance or online contracts with consumers.
• Consumer Protection from Unfair Trading Regulations 2008, as amended and replaced or supplemented by applicable consumer protection law.
• Digital Markets, Competition and Consumers Act 2024, including rules on unfair commercial practices, subscription transparency, consumer enforcement, and future subscription-contract requirements as they come into force.
• Electronic Commerce (EC Directive) Regulations 2002, including online service-provider information requirements.
• Payment Services Regulations 2017, where relevant to payment processing, refunds, and regulated payment services. PinStaQ does not itself act as a regulated payment institution unless expressly stated.
• UK and EU sanctions, anti-fraud, and law-enforcement requirements, where applicable to fraud prevention, abuse prevention, prohibited item handling, or legal requests.

Security and operational practices

PinStaQ aims to apply risk-based security practices aligned with recognised security principles, including access control, encryption in transit, least privilege, supplier due diligence, audit logging, vulnerability management, incident response, and secure software development practices.

This policy does not claim certification to any particular standard unless PinStaQ separately publishes such certification.

3. Key definitions

Personal data means information relating to an identified or identifiable individual. Examples include name, email address, telephone number, account ID, device identifier, IP address, location data, payment reference, item registration details linked to a person, photos containing identifiable people, and communications between users.

Special category data means more sensitive data such as health data, biometric data used for identification, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, and sex life or sexual orientation. PinStaQ does not intentionally request special category data. Users should not upload special category data unless strictly necessary for the recovery of an item and lawful to do so.

Owner means a person or organisation that registers or claims ownership of an item.

Finder means a person who scans a PinStaQ identifier, reports a found item, or otherwise interacts with PinStaQ to return an item.

Item data means information about an item, such as item type, description, serial number, photo, QR/tag identifier, approximate location, status, return method, and associated owner/finder workflow.

Return partner means a courier, locker provider, postal provider, school, building manager, retailer, concierge, or other third party involved in item return.

4. Personal data we collect

The exact data we collect depends on how you use PinStaQ.

4.1 Account and identity data

We may collect:

• name;
• email address;
• phone number;
• password or authentication credential, where applicable;
• login provider details if you use Apple, Google, Facebook, or another single sign-on provider;
• profile photo, if you choose to add one;
• account preferences;
• customer type, such as individual, parent/guardian, school, business, finder, owner, or administrator;
• age confirmation or eligibility confirmation.

Biometric authentication (Face ID, Touch ID, fingerprint). Where you enable biometric login on the PinStaQ mobile app, the biometric matching is performed entirely on your device by Apple iOS, Google Android, or the relevant device manufacturer. PinStaQ does not receive, store, or process your biometric data. The app only receives a yes/no signal from the operating system confirming successful authentication. You can disable biometric login through your device settings or within the app.

4.2 Item registration data

When you register, claim, or manage an item, we may collect:

• item name and category, such as phone, keys, bag, umbrella, school item, wallet, document holder, luggage, pet accessory, or similar;
• item description;
• item photo;
• serial number, model, colour, or distinguishing marks;
• PinStaQ QR code, tag ID, NFC ID, label ID, or other identifier;
• owner contact preferences;
• recovery reward or return instruction preferences, if offered;
• linked subscription, payment, or return plan;
• item status, such as active, lost, found, returned, archived, or deleted.

You should avoid adding unnecessary sensitive details to item descriptions or photos.

4.3 Found-item and QR scan data

When a finder scans a QR code, reports an item, or uses a found-item page, we may collect:

• finder name, if provided;
• finder email address or phone number, if provided;
• scan timestamp;
• approximate scan location, if made available by the device, browser, user, network, or QR workflow;
• IP address, device, browser, operating system, and app version;
• message or notes submitted by the finder;
• photo of the found item, if submitted;
• selected return option;
• locker, courier, drop-off, or postage reference;
• anti-fraud and abuse signals.

Where possible, PinStaQ aims to minimise unnecessary disclosure between owner and finder by using mediated messaging, masked contact methods, or controlled return workflows.

4.4 Location data

PinStaQ may process location-related data where relevant to lost-and-found recovery, security, fraud prevention, or service improvement. This may include:

• approximate location from IP address;
• location entered manually by a user;
• location associated with a QR scan, drop-off point, locker, courier collection, or return event;
• device location if you enable location permissions in the app;
• school, workplace, venue, building, or organisation location where a managed return scheme applies.

PinStaQ does not require continuous background tracking unless a specific app feature clearly requests it and you enable it. You can usually control device location permissions through your device settings.

4.5 Communications data

We may collect and process:

• messages between owners, finders, return partners, and PinStaQ support;
• support tickets and correspondence;
• call notes or transcripts, where support calls are used and lawful;
• email, SMS, push notification, and in-app notification history;
• consent and unsubscribe records;
• moderation, safety, and dispute records.

4.6 Payment, subscription, and transaction data

If you pay for a subscription, item registration, recovery service, owner fee, return fee, postage, locker return, courier service, or other charge, we may process:

• billing name;
• billing email;
• billing address or postcode, if required;
• payment amount, currency, date, and status;
• subscription plan, renewal date, cancellation status, and invoice history;
• payment processor reference;
• refund or chargeback record;
• fraud-prevention signal.

Charity donations. Where you choose to make an optional charitable donation through PinStaQ as part of a return, we may process:

• donation amount and currency;
• chosen recipient charity;
• Gift Aid declaration, if you choose to provide one (this may include your name, home address, and confirmation of UK taxpayer status, which we share with the recipient charity for Gift Aid claim purposes);
• payment status and reference.

PinStaQ does not intend to store full payment card numbers. Card and payment details are normally processed by payment providers such as Stripe, Apple, Google, or other approved payment processors.

4.7 Device, analytics, and technical data

We may collect:

• IP address;
• device type and model;
• operating system;
• browser type and version;
• app version;
• language and region settings;
• referring page or campaign;
• pages viewed and features used;
• crash logs, diagnostic logs, performance data;
• cookie identifiers and similar technologies;
• security logs and access logs.

4.8 Marketing and preference data

We may collect:

• launch-notification signup details;
• marketing preferences;
• communication channel preferences;
• campaign engagement data;
• survey responses;
• referral or promotional code usage;
• unsubscribe or opt-out history.

4.9 Organisational, school, and managed-scheme data

If PinStaQ is used by a school, business, venue, property manager, local authority, charity, or other organisation, we may process:

• administrator name and contact details;
• organisation name and address;
• role and permission level;
• managed item categories;
• incident, lost-property desk, locker, or return workflow data;
• user lists or identifiers provided by the organisation;
• audit logs and access records.

4.10 Items belonging to children

PinStaQ accounts are restricted to users aged 18 and over. Anyone under 18 cannot create or hold a PinStaQ account.

PinStaQ is, however, often used by parents, guardians, teachers, and school administrators to register and manage items that belong to children, such as school bags, uniforms, lunch boxes, instruments, or sports kit. Where this happens:

• the data subject is the adult account holder, not the child;
• the child's first name may appear on the item label or in a description, but no account is created for the child;
• adults should avoid entering more personal information about a child than is necessary to identify the item, and in particular should avoid recording a child's full name, address, school, date of birth, or photograph in item descriptions where this is not required for recovery.

PinStaQ may apply additional safeguards in school managed schemes (see Section 20).

5. How we collect personal data

We collect personal data:

• directly from you when you create an account, register an item, scan a QR code, submit a form, send a message, make a payment, or contact support;
• automatically through our website, app, cookies, SDKs, logs, QR scan workflows, and security tools;
• from payment processors, identity providers, app stores, email providers, analytics providers, hosting providers, customer support tools, courier/locker providers, and fraud-prevention services;
• from schools, employers, venues, or organisations that set up managed PinStaQ schemes;
• from other users, such as a finder reporting an item or an owner providing return instructions;
• from public sources or law-enforcement bodies where necessary to investigate fraud, misuse, threats, prohibited items, or legal claims.

6. Why we use personal data and our lawful bases

The table below explains our main processing purposes and lawful bases under UK GDPR and, where applicable, EU GDPR.

Where we rely on legitimate interests, we balance PinStaQ's interests, user interests, and privacy rights. Our legitimate interests include operating a secure lost-and-found service, preventing misuse, improving reliability, supporting item recovery, managing disputes, and protecting users and PinStaQ.

Where we rely on consent, you can withdraw consent at any time. Withdrawal does not affect processing already carried out before withdrawal.

7. How we use personal data

We use personal data to:

1. create and manage accounts;
2. authenticate users;
3. register, identify, and manage items and PinStaQ tags;
4. connect or mediate communication between owners and finders;
5. notify owners when an item is reported found;
6. help arrange item return through approved workflows;
7. process payments, fees, subscriptions, refunds, and invoices;
8. support schools, venues, businesses, or managed lost-property schemes;
9. provide customer support;
10. detect, investigate, and prevent fraud, spam, abuse, scams, theft, and prohibited conduct;
11. secure the website, app, infrastructure, and user accounts;
12. maintain audit logs and operational records;
13. comply with applicable laws and lawful requests;
14. improve the service, user experience, recovery rates, and operational performance;
15. send marketing communications where permitted;
16. conduct analytics, reporting, and product development;
17. enforce our Terms and protect legal rights.

8. Owner and finder privacy

PinStaQ is designed to reduce the need for owners and finders to disclose unnecessary personal contact details to each other.

Depending on the feature and settings used, PinStaQ may:

• notify the owner without showing the owner's direct contact details to the finder;
• allow finder messages to be routed through PinStaQ;
• show limited return instructions without disclosing a home address;
• use locker, courier, school, venue, or managed drop-off workflows;
• allow users to choose whether certain contact details are shared;
• restrict or moderate messages that appear abusive, fraudulent, or unsafe.

However, some return options may require sharing limited personal data, such as a name, phone number, delivery address, drop-off location, or return reference, with a courier, locker provider, school, venue, or other return partner.

Users should not pressure others to disclose personal information outside the PinStaQ workflow.

9. Photos, item descriptions, and user-generated content

You are responsible for the information you upload or submit to PinStaQ. Before uploading an item photo, message, or description, check that it does not unnecessarily reveal:

• home addresses;
• bank cards or financial details;
• passports, driving licences, or government IDs;
• children's details;
• medical information;
• confidential business documents;
• other people's personal data;
• passwords, access codes, or security credentials.

PinStaQ may remove, restrict, blur, moderate, or delete content that appears unsafe, unlawful, excessive, abusive, misleading, or contrary to our Terms.

10. Cookies and similar technologies

PinStaQ may use cookies, SDKs, pixels, local storage, device identifiers, and similar technologies.

10.1 Types of technologies we may use

• Strictly necessary technologies: required for login, security, fraud prevention, session management, load balancing, payment flow, consent management, and core service functionality.
• Preference technologies: remember language, region, accessibility, or user choices.
• Analytics technologies: help us understand usage, performance, feature adoption, and errors.
• Marketing technologies: measure campaigns or support advertising, where used and lawful.

10.2 Consent

Where required by PECR, UK GDPR, EU GDPR, or applicable ePrivacy laws, PinStaQ will request consent before using non-essential cookies or similar technologies. You can withdraw or change consent through the cookie settings or device/app settings where available.

10.3 Mobile app permissions

The PinStaQ app may request permissions such as camera, notifications, photos, location, contacts, or storage only where relevant to a feature. You can manage these permissions through your device settings. Some features may not work if permissions are disabled.

11. Marketing communications

We may send you marketing communications where:

• you have consented;
• you signed up for launch or product updates;
• we can lawfully rely on a soft opt-in for similar products or services;
• you are a business contact and applicable law allows us to contact you.

You can opt out at any time by using the unsubscribe link, changing your account settings, or contacting us.

We will still send service, security, account, payment, legal, and item-recovery communications where necessary to provide the service or comply with law.

12. Automated decision-making and profiling

PinStaQ may use automated tools to help detect fraud, spam, suspicious scans, abusive messages, prohibited items, duplicate reports, unusual payment activity, or security risks.

These tools may influence whether an account, report, message, payment, or return flow is flagged for review, restricted, delayed, or blocked.

PinStaQ does not intend to make solely automated decisions that produce legal or similarly significant effects on users without appropriate safeguards, unless permitted by law. Where applicable, you may request human review.

13. Who we share personal data with

We may share personal data with the following categories of recipient where necessary and lawful.

13.0 Named key sub-processors and partners

The following are PinStaQ's principal sub-processors and partners at the time of publication. The list may be updated; please check the latest version of this policy for changes.

Subscriptions (paid PinStaQ plans) are billed exclusively through Apple or Google in-app purchase systems. PinStaQ does not receive your payment card details for subscriptions; Apple or Google retain that data under their own privacy policies and terms.

One-off payments (item fees, return fees, charity donations, and physical goods) are processed through Stripe. PinStaQ does not store full card numbers; Stripe handles card data under its own PCI-DSS-aligned security and privacy controls.

A complete and current sub-processor list will be made available on request to [email protected] and may be published at https://www.pinstaq.com/sub-processors.

13.1 Service providers

• cloud hosting providers;
• database and storage providers;
• authentication providers;
• email, SMS, and push notification providers;
• customer support tools;
• analytics and diagnostics providers;
• fraud-prevention and security providers;
• payment processors;
• app store operators;
• QR, tag, label, and fulfilment providers;
• professional advisers, including lawyers, accountants, auditors, and insurers.

13.2 Return partners

Where necessary for item return, we may share data with:

• Royal Mail, including via the Click & Drop API and "Labels to Go" workflow — typically the finder's name, the owner's return address (where applicable), item description, weight band, and a return reference. PinStaQ shares only the data needed to generate a label, drop the parcel at a Royal Mail Customer Service Point or Post Office branch, and track delivery to the owner;
• other postal providers;
• courier providers;
• locker network providers;
• collection/drop-off locations;
• schools, workplaces, venues, property managers, or lost-property desks;
• logistics or fulfilment partners.

13.3 Other users

We may share limited information between owners and finders where necessary for recovery. The amount of data shared depends on user choices, product settings, and return workflow.

13.4 Organisations using managed schemes

If a school, business, venue, or other organisation uses PinStaQ to manage lost property, we may share relevant administrative, item, report, and workflow data with authorised representatives of that organisation.

13.5 Legal, safety, and corporate recipients

We may disclose data:

• to comply with law, court orders, regulator requests, or law-enforcement requests;
• to investigate fraud, theft, abuse, harassment, safety incidents, prohibited items, or security threats;
• to enforce our Terms or protect legal rights;
• in connection with a business sale, merger, investment, reorganisation, financing, acquisition, or asset transfer.

We do not sell personal data.

14. International transfers

PinStaQ may use suppliers or infrastructure located outside the UK, EEA, or your country of residence. Where personal data is transferred internationally, we will use appropriate safeguards where required, such as:

• adequacy regulations or adequacy decisions;
• UK International Data Transfer Agreement or UK Addendum;
• EU Standard Contractual Clauses;
• contractual, technical, and organisational measures;
• transfer risk assessments where required.

15. Data retention

We keep personal data only for as long as reasonably necessary for the purposes described in this policy, including service delivery, security, legal compliance, tax, accounting, dispute resolution, and enforcement.

Indicative retention periods are set out below. Actual periods may vary depending on legal, operational, and security requirements.

When data is no longer needed, we delete, anonymise, or securely archive it.

16. Security

PinStaQ uses appropriate technical and organisational measures designed to protect personal data. Measures may include:

• encryption in transit;
• secure password handling;
• access controls and role-based permissions;
• least-privilege access;
• multi-factor authentication for administrative access where appropriate;
• audit logging;
• secure cloud configuration;
• vulnerability management;
• supplier due diligence;
• incident response procedures;
• backup and recovery controls;
• staff confidentiality obligations.

No online service can guarantee absolute security. You are responsible for keeping your account credentials secure and notifying us promptly if you suspect unauthorised access.

17. Data breaches

If PinStaQ becomes aware of a personal data breach, we will assess the incident and take appropriate steps to contain, investigate, remediate, and notify affected users, regulators, or organisations where legally required.

In the UK, reportable personal data breaches may need to be notified to the Information Commissioner's Office within the statutory timeframe. Similar obligations may apply in the EEA or other jurisdictions.

18. Your privacy rights

Depending on your location and the lawful basis for processing, you may have the right to:

• be informed about how your data is used;
• access your personal data;
• correct inaccurate or incomplete data;
• request deletion of your data;
• restrict processing;
• object to processing, including direct marketing;
• request data portability;
• withdraw consent;
• challenge certain automated decisions;
• complain to a data protection regulator.

To exercise your rights, contact us at [email protected]. We may need to verify your identity before responding.

We aim to respond within the legally required timeframe, usually one month for UK GDPR and EU GDPR requests, subject to lawful extensions.

19. Complaints

Please contact us first if you have a privacy concern so we can try to resolve it.

You also have the right to complain to a data protection supervisory authority.

In the UK, you can contact:

If you are in the EEA, you may contact your local data protection authority.

20. School use and managed schemes

PinStaQ accounts are for users aged 18 and over only. We do not knowingly collect personal data directly from anyone under 18.

PinStaQ may, however, be used in schools where teachers, administrators, or parents register and manage items that belong to children, such as school bags, uniforms, lunch boxes, or sports kit. Where PinStaQ is used in a school managed scheme:

• accounts are held by adult staff and parents only;
• only the minimum information needed to identify an item should be recorded;
• communication between owners and finders is mediated by PinStaQ — finders cannot directly contact a child;
• the school or organisation operating the managed scheme is responsible for setting appropriate internal controls, access permissions, and acceptable-use rules;
• where PinStaQ acts as a processor under a separate written agreement with the school, that agreement governs the processing.

Parents, guardians, schools, and adult account holders should avoid entering unnecessary personal information about children into item descriptions, photos, or messages.

If you believe a person under 18 has obtained a PinStaQ account, please contact us at [email protected] and we will investigate and, where appropriate, close the account and delete the data.

21. Prohibited or sensitive items

If a reported item appears to involve unlawful, dangerous, or sensitive material, such as weapons, controlled substances, stolen goods, explicit material involving minors, passports, bank cards, medical records, confidential business records, or identity documents, PinStaQ may restrict the workflow, provide safety guidance, involve relevant authorities, or refuse to facilitate a return.

Do not upload unnecessary copies of identity documents, bank cards, confidential records, or highly sensitive materials.

22. Third-party websites and services

PinStaQ may link to third-party websites, app stores, payment providers, courier services, locker networks, social login providers, or support resources. These third parties have their own privacy policies and practices. PinStaQ is not responsible for third-party privacy practices except where required by law.

23. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If changes are material, we will take reasonable steps to notify users, such as by email, in-app notice, website notice, or account notification.

The updated version will apply from the effective date shown at the top unless otherwise stated.

24. Contact us

For privacy questions, rights requests, or complaints, contact: