Privacy policy
Last updated 19 October 2026
PingPong collects only what it needs to run your workspace and bill your plan, keeps your data in the EU where it can, and never sells it. This policy covers pingpong.studio and the app at app.pingpong.studio.
Who is responsible
Corné Romme, trading as PingPong (KvK 78635969, Zeewolde, the Netherlands), is responsible for the personal data described here. Questions or requests: corne@pingpong.studio.
For personal data inside the work you give us (for example customer names in a file), your company is responsible and we process it for you under our data processing agreement.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Name, work email, company, profile photo | Your account and signing in | Contract |
| Tasks, comments, files, your brief | Doing the work you ask for | Contract |
| Billing name, address, VAT number, invoices | Billing and tax records | Contract, legal obligation |
| Payment method details (last 4 digits, card brand) | Showing which method you use; Stripe holds the full card number or IBAN, we never see it | Contract |
| Waitlist details (name, email, company, note) | Telling you when a spot opens | Consent |
| Notification settings and what you've read | Sending only the emails you need | Contract |
| Sign-in and security logs (time, IP address) | Keeping accounts safe and fixing problems | Legitimate interest |
We don't use advertising or analytics cookies, and we don't track you across other sites.
Cookies
The app only uses cookies it needs to work: one that keeps you signed in, one for a sign-in with Google in progress, and two that remember your theme and display preferences. Because they are strictly necessary, we don't ask for consent.
Who we share it with
We use these providers to run PingPong. Each only gets what it needs, under a data processing agreement.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage | EU (Ireland) |
| Vercel | Hosting the app | EU (Ireland), company in the US |
| Stripe | Payments and invoices | EU and US |
| Resend | Sending emails | US |
| Signing in with Google, only if you choose it | US | |
| Cloudflare | Domain and email forwarding | Global |
| Anthropic (Claude) | Software used for design and development work | US |
| OpenAI (ChatGPT) | Software used for design and development work | US |
When data goes to the US, it is protected by the EU-US Data Privacy Framework or the EU's standard contractual clauses. We share data with authorities only when the law requires it.
How long we keep it
- Your account and workspace: while your plan runs, then 3 months read only, then deleted.
- Invoices and billing records: 7 years, as Dutch tax law requires.
- Waitlist details: until you sign up, ask us to remove you, or 12 months pass.
- Backups are overwritten within 30 days of a deletion.
Your rights
You can ask to see, correct, delete or export your personal data, or object to how we use it. Email corne@pingpong.studio and we reply within 30 days. You can also change your name, photo and notification settings yourself in Settings. If you're unhappy with how we handle your data, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Security
Data is encrypted in transit and at rest. Passwords, sign-in links and invite links are only stored as hashes, files are only shown to people in your workspace, and payment details stay with Stripe.
Changes
When this policy changes in a way that affects you, we email you before it takes effect.