Subprocessors

Pinnacle MAV Media LLC uses the third parties listed below to operate Pinnora(the "Service"). Each listed subprocessor is bound by a written data processing agreement that imposes confidentiality, security, and (where applicable) Standard Contractual Clauses for cross-border transfers materially consistent with our Data Processing Addendum. We disclose nested infrastructure providers (so-called sub-subprocessors) for transparency in the second table below; their use is governed by our direct subprocessor's own DPA.

Notice of changes

We will provide at least thirty (30) days' advance notice of any new or replaced subprocessor that processes Customer personal data. Customers under our DPA may subscribe to change notifications by emailing privacy@thepinnacle.media. You may object to a new subprocessor on reasonable data-protection grounds during the notice window; if we cannot accommodate the objection, you may terminate the affected Service components without penalty for the remainder of the then-current term.

Direct subprocessors

Nested infrastructure (sub-subprocessors)

For transparency, the following are the major infrastructure providersour direct subprocessors publicly disclose. We do not contract with these parties directly; our customers' data flows to them only via the corresponding direct subprocessor and is governed by that direct subprocessor's own commitments. The list below tracks each vendor's public disclosures and is provided for diligence purposes; refer to the linked vendor pages for canonical, up-to-date detail.

AI subprocessors and model training

For each LLM provider above, we route inference through API endpoints whose contractual terms prohibit training on customer prompts or outputs (OpenAI API Enterprise terms, Anthropic API DPA, Google Gemini API for paid use, xAI API). We do not enroll the Service in any opt-in training, feedback-collection, or model-improvement program that would expose Customer Content to the provider's general training corpus. See AI & automated systems for the full per-provider statement.

Ad platform integrations

Where you connect a Meta, Google Ads, or TikTok ad account, the corresponding access token is encrypted at rest in our database and used only to (i) read the campaigns and metrics you scope, (ii) receive webhook events for changes in those scopes, and (iii) where you explicitly initiate it, write changes back to the platform. Disconnecting an integration revokes the stored token.

Content delivery networks (no customer personal data)

For UI assets we load from public CDNs that do not receive customer personal data: Unsplash (stock imagery API), jsDelivr (open-source library distribution), Dicebear Avatars (procedural avatar generation), and Google's public CDN (e.g., googleusercontent.com). These services receive only request metadata (IP, user agent) inherent to delivering a public asset.

Internal / operational tools

We also use limited operational tools that may incidentally process employee data or aggregated diagnostics (for example, source-control via GitHub above). We do not route Customer Content to internal productivity tools without an explicit DPA-covered purpose.

Contact

Subprocessor questions and DPA copies: privacy@thepinnacle.media — for data-protection officer inquiries: dpo@thepinnacle.media.