The Pending — operated by The Pending GmbH
Last updated: 22 October 2026
1. Who we are
The Pending GmbH, Nestroystraße 13, 81373 Munich, Germany, is responsible for the processing described here unless we identify a customer as the controller. Our managing directors are Tim Kriegler and Niklas Kornel. Contact us about privacy or your rights at service@thepending.app or our postal address.
This policy covers our Agency, community, iOS and Android apps, public portfolios, partner programme and websites, including thepending.com, agency.thepending.com, app.thepending.com, thepending.app, portfolios.thepending.com and partnerships.thepending.com.
Features are introduced in stages and can differ between the website, apps, plans and countries. Descriptions of a feature apply when it is available and you use it, or when information about you is otherwise processed through it. Publishing this policy does not activate an unavailable feature or give permission for optional processing.
We control account administration, our community, billing, security, moderation and our own marketing and analytics. When a customer manages applicants, talent records or CRM contacts for their purposes, we process that information on their instructions. That customer is responsible for their own privacy notice and lawful processing; our data processing terms apply to our work for them.
2. Information we receive
Information comes from you, your devices, selected sign-in and payment providers, other users, customers submitting information about you, and public professional sources. It can include:
- Account identifiers, names, email addresses, authentication records, age confirmation, declared country, roles, settings and acceptance or consent records.
- Profiles, portfolios, CVs, skills, experience, availability, locations, interests, photographs, recordings and other material you provide.
- Applications, form answers, attachments, professional contacts, correspondence, notes, ratings and customer workspace activity.
- Posts, drafts, comments, Echoes, Scenes, polls, votes, reactions, saves, follows, connections, Circle membership, events, attendance choices, voluntary check-in timestamps, pins, Page administration and audience choices.
- Messages, recipients, attachments, delivery/read information, notification preferences, reports and moderation records.
- AI prompts, relevant contextual information, outputs, search results, embeddings, recommendations, scores and feedback.
- Orders, receipts, transaction references, subscription entitlements, Pen balances and usage, billing information, refunds and cancellations.
- IP addresses, request and device information, access/security logs, push tokens and the usage or advertising information described below.
Required information is identified in the relevant flow. Without information necessary for an account, purchase or requested feature, we may be unable to provide it. Optional analytics, advertising consent and optional AI memory are not required for basic account access.
3. Accounts, portfolios and collaboration
We use account data to register and authenticate you, provide requested features and communicate about your account, under Article 6(1)(b) GDPR. Security and abuse prevention also rely on Article 6(1)(f), our interest in protecting users and the service.
If you choose Google, Apple or Microsoft sign-in, we receive the provider identifier and supplied identity/profile information, such as name and email, including an Apple relay address. We retain the account association needed for sign-in. This integration does not grant access to your cloud documents or retain provider tokens for ongoing document access. The provider's own privacy notice also applies.
We use a local IP-geolocation database for regional availability and country checks. We record your declared country, declaration time and the corresponding country comparison. Availability and purchasing restrictions can differ. A separately requested availability email uses consent. Linked accounts require verification and retain their relationship and verification information.
Portfolio, profile and collaboration information is processed to provide the features you request. Public profiles, portfolios, contact cards, download links and public posts can be viewed and copied outside your contacts. Public listings may be exposed to search engines and job feeds. Check audience, discoverability and sharing settings before publishing.
People listing and tagging by non-contacts can be enabled by default. Disabling People listing does not disable a direct profile link. Portfolio-to-community synchronisation can copy basic profile fields and can be disconnected. Studio collaborators receive the access you grant; you can revoke it. Whether AI tools may read your portfolio content (Studio suggestions, the portfolio check-up and Job Finder, including the portfolio text and photos Job Finder reads) is a separate Studio setting that only you as the owner can switch on; we record the wording and version you confirmed and the time, a collaborator cannot grant it, and an earlier tick made before this record existed, or a confirmation of an earlier wording, is treated as unconfirmed until you confirm it again. Switching it off stops these tools from using your portfolio content from their next use; content already sent for a run that had started cannot be recalled. Spotty's search of your own works, which only your account can use, follows your Spotty setting instead (section 5).
Customers can create or import records about applicants and professional contacts, including people without accounts. They may share selected records, notes, attachments and AI scores with authorised colleagues or external reviewers. Review links use passwords and expiry; other share links may be accessible to anyone possessing the link. Protected-link access uses necessary cookies and can record access counts, times and an IP-derived binding.
4. Community, messaging and recommendations
We process content, audience choices, social connections and membership information to deliver community functions, under Article 6(1)(b). Safety and moderation use Article 6(1)(f), and Article 6(1)(c) where a specific legal duty applies. Private feedback is named, not anonymous. Page content may remain with another authorised administrator after an individual closes their account. Scenes normally leave the active display after 24 hours; Encores and permitted reshares can remain.
Circle events can include a title, description, dates, city, venue and online meeting link. Visibility depends on the Circle's access settings: some event details and attendance counts can be public, while the venue, meeting link and attendee list are restricted to members. Choosing to attend can appear in that member-only list; showing attendance on your profile is a separate choice. A voluntary check-in records a timestamp, not your device location, and the check-in indicator is visible to members while the event is running. The end of that display does not itself delete the stored timestamp. We also store your Circle pins and selected reminders, and can add an event to your own platform calendar when requested. You can withdraw your attendance or check-in and change your profile-display choice through the available controls.
Community recommendations use expressed interests, interests inferred from recent interactions, follows, connections, location, semantic similarity, recency, reactions, saves and previously displayed content. We may derive up to five suggested interests from a 30-day activity window. This is profiling. Eligible paid plans can add a feed boost. We rely on Article 6(1)(f), our interest in relevant professional discovery. The main feed offers newest-first ordering, but that does not disable every recommendation elsewhere. You can edit interests, dismiss suggestions and contact us to object.
Opening a member's profile while signed in can record your identity, visit time and count. Depending on feature access, the member may see visitor names. Private browsing stops new named visit recording; it does not erase earlier visits. This feature and content insights use Article 6(1)(f), our interest in professional-network feedback and measurement.
Messages and attachments are stored to deliver conversations. Read receipts can be disabled per conversation. Messages are access-restricted but are not end-to-end encrypted. Authorised operational access can occur when necessary to deliver the service, investigate a report, prevent abuse or meet a legal duty. Removing a message from view does not mean every retained copy is immediately erased.
Push delivery uses Apple Push Notification service or Google Firebase Cloud Messaging. Payloads may include sender information, identifiers, an avatar URL, group name and a message preview of up to 180 characters or an attachment filename. Apple or Google processes the payload; previews may appear on your lock screen. Manage permissions in device settings and notification categories in the app.
5. AI assistance, discovery and application analysis
Spotty and our finders use prompts and relevant profiles, applications, contacts, documents, messages or other authorised context to answer requests, find opportunities, draft material and propose actions. We retain conversation and tool records to operate and troubleshoot these features. Actions requiring approval are presented for confirmation. Spotty shows a short activation notice describing what is sent and to whom, and we record the version you confirmed. You can stop using Spotty at any time in Spotty’s settings; the stop takes effect immediately for Spotty chat, Spotty email and the search over your own content. A request that was already sent to a provider when you stop cannot be recalled; its answer is discarded rather than stored or sent to you, and the Pen for that message is refunded. Text already displayed on your screen before the stop can remain visible there. Requested AI features generally use Article 6(1)(b); proportionate safety and quality improvement use Article 6(1)(f). We process customer-controlled content on that customer's instructions.
AI inference and embeddings use Amazon Web Services' Bedrock service, including Anthropic Claude, Amazon Titan and TwelveLabs Marengo models. Claude and Titan support language tasks and text search. Marengo describes audio and video through numerical representations used for content matching. Inference is configured in EU regions; Marengo media jobs run in Ireland and its text requests can be routed between EU regions. Model names identify the technology; using these models through Bedrock does not mean that we send your inputs directly to Anthropic or TwelveLabs. Short-lived prompt caching may occur. We do not use your content to train foundation models. Interaction and feedback signals can improve recommendations and assistant behaviour; that is separate from foundation-model training.
Community content analysis can process post text, selected images, audio/video and explicit interests to describe content, generate keywords and create search and recommendation vectors. We use these representations to match eligible content to relevant queries and interests. Audio, visual and speech-related representations are kept separately; they are not a voice-identity or facial-identification system. Media analysis is part of operating the available community service, rather than a separate member switch. This does not remove optional settings or rights of objection, and it is separate from advertising personalisation. Content analysis for discovery relies on Article 6(1)(f), our interest in making the professional community searchable and relevant.
Audience restrictions control who can see content; a followers-only or Circle audience does not by itself exclude the content from backend analysis needed for those features. Access to resulting search and recommendation information must respect those audiences. Spotty search over your own content: when you start using Spotty, after confirming its activation notice, we keep a search index over content you created on The Pending — posts (including posts visible only to some people), comments, portfolio works (including hidden works), Job Finder results and, if you use the CRM, the names and notes you keep there. To build it, the text is sent to AWS Bedrock (Amazon Titan). New own-content indexing requires a current activation. Earlier index copies cannot be searched through this feature without that activation. Only your account can search the index; it does not make restricted posts or hidden works visible to anyone else, and each result is checked against its source so deleted or changed content is not returned. If you stop using Spotty, indexing and searching stop immediately; the index copies are kept inactive for 90 days and then deleted. Your original content is not affected. Spotty memory and private search are separate settings with their own deletion rules. Processing your own information that is objectively necessary for the personal search you activate uses Article 6(1)(b). For customer-controlled CRM information, we act on the customer’s instructions under our processing terms; the customer must establish a basis for information about its contacts. Where we independently control necessary retrieval of other people’s information in your own content, we rely on Article 6(1)(f), the interest in providing your account-restricted retrieval without making that content available to others. The inactive 90-day recovery period serves continuity if you restart and relies on Article 6(1)(f); you can request earlier erasure. Activation does not establish a lawful basis for every piece of third-party or sensitive information supplied. Private-message and unpublished-draft indexing follows the separate choice below. Where external-AI sharing requires a separate permission, the relevant explanation and affirmative action are separate from general acceptance of our Terms.
For Marengo media jobs, we create temporary processing copies in our Ireland working storage and delete them and their results after the job attempt. A one-day storage-expiration rule provides a backstop for interrupted jobs and late results; it is not a guarantee of physical deletion within exactly 24 hours. Stored matching vectors follow the source content's applicable lifecycle. A file may be excluded from semantic analysis because of technical or processing limits; this does not exempt it from applicable publication checks.
Web research sends search terms and requested page URLs to Jina Search/Reader. Queries can contain personal information from your instructions or context, even though we do not add a separate account identifier. Talent and client discovery can collect public names, professional summaries, business contact details, location and source URLs from websites, directories and professional-network pages. For discovery we control, we rely on Article 6(1)(f), our interest in professional discovery. Contact us with a source URL to request access, correction, removal or to object. Minimal suppression information may remain to respect an objection. Public availability does not remove privacy rights.
Application analysis can run automatically unless the customer disables it, and only after the responsible customer has confirmed the current version of our application-analysis notice. It processes application information, form answers, the extracted content of attachments and role requirements to produce professionalism and fit scores, recommendations and summaries. The scoring model receives a job-relevant representation of the application: contact details, the applicant's name and statements about personal characteristics protected under anti-discrimination law are removed from that representation first, and visual descriptions of photographs are never a scoring input. The listing's own requirement text is reduced the same way: criteria about such characteristics are removed before scoring. The original application and documents remain stored unchanged for the customer's own review; extracting their text is still processing of personal data. Where the model reports insufficient evidence, or its reasoning refers to such a characteristic, the application is marked for human review and receives no automatic score, ranking position or recommendation; Spotty's application evaluations list such applications separately, unscored. Rationale text that mentions contact details is discarded and flagged. Scores can influence optional sorting and visibility. A score does not itself change an application's status: managers can decide individually or in batches, including by confirming an action proposed by Spotty. Our Terms require substantive human review for significant applicant decisions; a confirmation button alone is not a substitute for that review.
Matching considers skills, experience, availability, location and role requirements. A Job Finder gender filter uses only an express Search Profile preference, not an inference from pronouns or portfolio gender fields. Without that preference, this filter does not exclude opportunities. Submitted documents and free text may nevertheless contain sensitive information. Supplying information is not blanket consent to evaluate sensitive characteristics. Where Article 9 GDPR applies, an additional lawful condition is required.
You may ask us or the responsible customer for an explanation, correction or human review, express your position and contest an outcome. Article 22 GDPR protections apply where its conditions are met. We do not treat all filtering or ranking as consequence-free.
Private-content search: indexing your own private chat messages and unpublished drafts is off by default and separately optional. Activation creates account-restricted text/vector search copies using AWS Bedrock. Switching it off stops further indexing and removes those derived copies; originals remain under their own lifecycle.
Spotty memory: cross-conversation memories and retrieval are separately optional and off by default. When enabled, Bedrock can derive notes and search copies from your Spotty conversations. You can inspect or forget notes. The optional weekly brief states facts counted by the platform; its single model-written sentence, which compares a Job Finder result with one of your memory notes, is only generated while memory is enabled. Disabling memory removes memories and Spotty-conversation search copies without deleting original conversations. Reactivation does not automatically reconstruct deleted memories from earlier conversations. In-progress processing may finish before withdrawal completes. These two optional functions rely on Article 6(1)(a).
Optional Companion helpers retain permissions, schedules, tasks and results under the permissions you activate. When you agree, we record the version of the statement you were shown; an outdated screen cannot record a new agreement, and withdrawal is always possible. A scheduled search checks again that your account is active and the schedule still switched on before it is charged and before it runs; a charged search that cannot start is refunded once. You can pause or delete them. A public Spotty preview sends entered text to our AI infrastructure; please avoid unnecessary personal information.
6. Moderation and media checks
We process reports, content, evidence, explanations and decisions to enforce our rules, protect people and meet specific legal duties, relying on Article 6(1)(f) or, where applicable, Article 6(1)(c). Posts, Scenes, comments, Echo captions, profiles, Circles, events and chat messages can be reported. When a report is closed you receive an in-app notice of the outcome with the case reference; it never discloses our internal notes or the identity of the person you reported, and the reported person is not told who reported them. A person whose content is removed or whose account is restricted receives a statement of reasons that says whether automated means were involved and how to contest the decision. Report, outcome and statement records are kept as case records for the moderation retention period.
On the community surfaces covered by our publication checks, Detesia checks images/video and IRCAM Amplify checks audio for generated media. Portfolio uploads are exempt from these generated-media detection checks and are not sent to Detesia or IRCAM through the portfolio upload flow. This exception does not disable separately described portfolio AI tools or other processing needed to provide the portfolio. Submitted media can contain personal information and embedded metadata; replacing a filename does not remove all such information. Under the processing arrangements confirmed for these services, processing, storage and access are restricted to the EU/EEA.
Required generated-media checks are a condition of publishing the affected new media; members cannot bypass them while publishing that media. A flag or incomplete required check hides only the affected photo, video or audio. The post’s text and cleared files remain visible to the selected audience; nothing is automatically deleted because of that flag. Detection is fallible. You can retry a failed check or request human review of the held file and provide an explanation. A review request does not itself publish the file. We retain the account reference, checksum, results and review decision to administer the rules and recognise an approved re-upload. Previously published unchecked media is not automatically removed merely because these checks were introduced. Private chats are excluded from this generated-media publication check; reports and other safety rules still apply. Files deliberately attached to Spotty can still be processed by its AI service as described in Section 5.
Commercial-content checks may use disclosure tags, links, codes and AWS Bedrock analysis of text or selected images. Your own disclosure can apply an advertising label; other suspected advertising is referred for human review before a platform-applied label. You can contest moderation decisions at service@thepending.app.
7. Payments, support and business communication
Stripe processes direct web payments. We retain order, customer, subscription, invoice and transaction references and the Pen ledger, not full card details. Apple and Google handle their store purchases. RevenueCat receives account-linked app identifiers, receipt/transaction and technical information to validate purchases and synchronise entitlements, renewals, refunds and restores.
Purchases and support use Article 6(1)(b), payment security and claims handling use Article 6(1)(f), and required financial records use Article 6(1)(c). Service emails use AWS SES. Our general, support and reporting mailboxes are hosted by IONOS and contain correspondence, addresses and submitted attachments.
Our own sales records can contain public-source or directly supplied professional contact details, company information, source references, correspondence and notes. Contractual requests use Article 6(1)(b); proportionate business administration and direct-marketing preparation use Article 6(1)(f). Electronic-marketing permission requirements apply separately. You may object to direct marketing at any time. Optional newsletters and promotional messages use consent unless a lawful exception applies.
8. Advertising and campaign measurement
For partner applications and creative approval, we process representative contact details, business and tax-country information, submitted creatives and destination URLs, revision messages, approval times and the reviewing administrator’s reference. We host copies of approved creatives and publish them for the booked placements. Contact and internal review details are not part of the public advertisement. This supports requested contracts with individuals under Article 6(1)(b), business-relationship administration and content safety under Article 6(1)(f), and identified accounting duties under Article 6(1)(c).
General partner advertisements can use page context, country and untargeted rotation. Using your saved, expressly selected interests for advertising requires separate advertising consent. Behaviour-derived community interests and private messages are not advertising-interest inputs.
With advertising consent, impression and click records can include an account/session reference, placement, page, declared interests, role, plan, signup cohort, language, device/browser category, country and referrer. Partner links can transmit campaign or affiliate parameters and a unique click reference. A participating partner may return an order/lead reference, conversion type, currency and value, linking the click to activity on its website. The partner may associate this with information it holds; its privacy notice also applies. Partner dashboards receive aggregated reports.
Without advertising consent, these account/session-linked advertising records and attributed redirects are not created. In the iOS app, cross-company conversion attribution additionally requires Apple's App Tracking Transparency permission. Missing permission blocks attribution. A session-scoped permission record can remain for 90 days after its last update. Changes made while offline reach us when the app next communicates. We do not collect IDFA for this feature.
Optional advertising and referral attribution rely on Article 6(1)(a) GDPR and, where applicable, § 25(1) TDDDG. Consent is separate from PostHog analytics. Withdraw it in cookie preferences or app settings. General contextual advertising and necessary business administration rely on Article 6(1)(f) or the relevant contract.
When you report a partner advertisement, we record your account reference, the partner, placement, selected reason and timestamps to investigate misuse and protect the service, under Article 6(1)(f). This report is not advertising consent. The report form does not ask for free-text personal details; internal report summaries use counts by partner and reason. Reporting is not a promise of automatic removal or hiding of the partner.
Our own campaign and listing-share statistics can record a daily pseudonymous visit identifier, source/channel, device category and location, and associate a signup or application with its arrival link. We rely on Article 6(1)(f) for proportionate campaign measurement; you can object. Referral attribution uses advertising consent and may store an invitation code for 30 days. Earned rewards can reveal to the inviter that an invitation qualified.
9. Analytics, cookies and external content
Security logs can contain IP addresses and device/request information. Separate first-party page statistics use daily pseudonymous identifiers and coarse device, referrer and location information derived locally; their statistic rows do not retain raw IP addresses. These statistics can include city/region and are separate from the country-only PostHog configuration. We rely on Article 6(1)(f) for security, stability and proportionate service measurement.
PostHog: optional analytics, error diagnostics and session replay require analytics consent. They record product interactions, pages/screens, device/app information and technical events under a pseudonymous identifier that can be linked to your account. PostHog is not anonymous. The configuration limits its location information to country and filters advertising click identifiers.
Replay records navigation and interactions. Web replay uses masking and media exclusions. Session replay is disabled in the Android app. The iOS app uses structural replay without screenshots and shows a recording indicator while replay is running. Sensitive screens, including messages, billing, account settings and protected media, are excluded or paused. Console and network-payload recording are disabled. Masking is a safeguard, not a guarantee that arbitrary content can never appear in a recording.
The paid PostHog plan has a seven-year event/exception query window. This is not an automatic deletion deadline. Person profiles remain until deleted. New replay recordings are configured for 30 days; expiry does not mean immediate physical deletion, older recordings can retain earlier settings, and metadata or exported copies have separate lifecycles.
Decline optional analytics without losing core access, or withdraw in web cookie preferences or app account settings. Manage the choice on each surface you use. Withdrawal stops future consent-based collection; erasure of previously collected records can be requested separately. A previously granted consent-related Pen credit is not reclaimed on withdrawal. Legal basis: Article 6(1)(a) GDPR and § 25(1) TDDDG.
Storage
Purpose and duration
Session and security storage
Sign-in, request protection and requested access. Website sessions normally last seven days; request-protection cookies can last approximately one year.
Consent choices
Website consent cookies normally last 365 days; account records can retain the choice and evidence separately.
Protected-link cookies
Remember requested access; reviewed share/review flows use up to 12 hours.
External-media preferences
The optional External media choice is valid for 180 days unless changed earlier. It is stored in local storage (tp_external_media_v1), in the tp_cookie_consent cookie (external_media and external_media_t) and, when signed in, in your account settings. The newer recorded choice takes precedence; the general consent cookie can have a different lifetime.
Referral attribution
With advertising consent, the tp_ref cookie lasts 30 days.
PostHog storage
Consented identifiers and SDK state use cookies, local storage or app storage; persistence depends on the deployed SDK settings, while local/app state can remain until cleared or reset.
App credentials, settings and caches
Until expiry, logout, reset, removal or cache eviction, depending on the item. Clearing the app does not cancel a subscription.
Strictly necessary device storage uses § 25(2) TDDDG where its conditions are met. Other device storage/access requires the applicable permission; an existing login session is not consent to advertising or analytics.
External media in portfolios covers YouTube, Vimeo, Spotify, SoundCloud, Instagram and TikTok. This optional category is off by default. Without permission, players remain local placeholders. Our server can fetch and cache permitted provider previews without forwarding your visitor IP, cookies or browser headers; Instagram is not fetched for a server-side preview.
You can choose Allow external media or Only necessary in the portfolio cookie notice. Allowing the category loads visible players and permits players to load on subsequent visits while the choice remains valid. Tapping a player is also an activation of this shared External media category: it loads that player and remembers permission for the listed providers, rather than only for that individual item. Once loaded, the provider receives your IP address, browser information and the site address through the browser request and may use cookies or similar storage.
Withdraw through the External media switch in the portfolio Cookie Policy or Turn off external media at any loaded player. This unloads the players and stops subsequent automatic loading. Analytics and advertising remain separate choices. Community/chat link cards use local previews; opening their external link connects to the external site. Withdrawal does not erase information already received by a provider.
10. Recipients and international processing
Provider or recipient
Function
Amazon Web Services
Application hosting, databases, file storage, CloudFront delivery, SES email and Bedrock inference/embeddings using Claude, Titan and Marengo; relevant account, content and connection information.
IONOS
Contact, support and reporting email hosting.
Stripe; RevenueCat; Apple; Google
Payments, purchase validation, subscription entitlements and store services; Apple/Google also deliver push notifications.
Google, Apple and Microsoft
The optional sign-in method you select.
PostHog
Consented analytics, replay and diagnostics.
Detesia; IRCAM Amplify
Generated-media checks of submitted images/video or audio.
Jina AI GmbH, part of Elastic
Web search and page retrieval, including queries, requested URLs and returned content.
OpenCage GmbH
Converting entered places to coordinates. We send place text with a request not to log query contents; technical logs are separate.
Cloudflare Turnstile
Bot prevention on protected forms; connection/device and challenge information.
Selected audiences, customer teams/reviewers and external content providers
Publishing, sharing, communication and external content you choose.
Advertising partners
Attributed clicks/conversions where consented, and partner administration.
Authorised personnel, professional advisers and authorities may receive information where necessary. Providers may act as our processors or, for their own payment, store, authentication or advertising activities, as independent controllers.
AWS application infrastructure is configured in EU regions, but global delivery and vendor support can involve other countries. PostHog uses an EU endpoint; its agreement also permits international processing, including the United States. Store, payment and other global services may process data outside the EEA. Our confirmed arrangements for Detesia, IRCAM and Jina restrict their processing and access to the EU/EEA.
Transfers requiring safeguards must be covered by an applicable adequacy decision or appropriate safeguards, such as the European Commission's Standard Contractual Clauses with necessary supplementary measures. Data Privacy Framework coverage applies only to a certified recipient and covered transfer. Contact us for information or a copy of the safeguards applicable to your data. Using our service is not blanket consent to international transfers.
11. Retention and deletion
Retention depends on purpose, customer instructions, legal duties and necessary claims evidence. Deactivation, hiding content, scheduled erasure and expiry of backup copies are different steps. The following application retention rules apply, with documented exceptions for open reports, appeals, disputes and required legal records:
Records
Period or criterion
Account deletion
An accepted self-service deletion request from Agency Settings, the community or the app deactivates access immediately and schedules account purge after a 14-day recovery period. Contact support during that period to request recovery. The period is not a promise that all shared, customer-controlled, legally retained or backup copies are erased after 14 days; their applicable rules remain separate. If the account owns a project with another active co-administrator or an open co-administrator invitation, self-service deletion can be blocked before deactivation; the screen identifies the projects and the support route. If a previously accepted purge is later blocked or fails, its request stays open for resolution. Contact us if the self-service route cannot complete your erasure request; a technical block does not remove your rights.
Deleted posts, comments and Echoes
Content, unnecessary personal associations and linked reactions are scheduled for removal after 30 days, including individually deleted responses. Minimal empty references can preserve replies; required case identities remain for the case-retention period.
Spotty conversations
Until deleted or account closure. Deleted conversations have 30 days for recovery, then transcripts and exclusively used attachments are scheduled for erasure. Derived memories/search copies are removed separately; restoring a conversation does not restore those copies.
Spotty search copies of your own content
While you use Spotty, source checks exclude deleted or outdated content from results. A hidden or retired copy is not necessarily erased at that point: copies of deleted posts and comments follow their content-purge rules; other retired own-content copies currently have no uniform automatic expiry while Spotty remains active. After you stop, copies remain inactive for 90 days from the first stop unless you restart before expiry, after which their text and vectors are scheduled for erasure. Empty source-reference records can remain until account deletion. You can request earlier erasure of unnecessary copies. Memory and private-search copies have their own rules.
Confirmation, Spotty email and cancellation records
Records of statements you confirmed or withdrew (for example the Spotty activation and stop, Companion, Portfolio AI tools and the application-analysis notice): on account deletion the account link is removed and the email address recorded at the time stays with the record. Spotty email delivery records (message identifier, status, charge and sender-check results; no address, subject or message text): deleted with the account. Cancellation and withdrawal requests (name, email, receipt time): kept as records of receipt. There is currently no automatic expiry for these confirmation and cancellation records, or for Spotty email delivery records while the account remains. Their continued retention must be limited to what is necessary to demonstrate the relevant choice, fulfil an obligation or resolve an identified claim; a technical lack of expiry is not a reason to keep them indefinitely. You may request review and erasure.
Inbound-email processing records
We keep message identifiers, processing status, authentication results, hashed sender identifiers, service-inbox references and links to resulting application records to prevent duplicate processing and recover failures. These records can be linked to people even without message text. There is currently no automatic expiry; the seven-day retry-reconciliation window is not a deletion deadline. Retention must be justified by necessary duplicate prevention, recovery or identified evidence needs, and you may request review and erasure.
Drafts
Discarded drafts: 30 days. Staged media of untouched drafts: 90 days. Remaining live drafts follow their purpose and account lifecycle.
Applications and scores
Normally 180 days after process closure/deletion and no earlier than 180 days after submission. Inactive unclosed processes have a 540-day fallback with prior warning. Separate talent-pool permission or documented extensions can affect retention.
Customer CRM/manual records
For the customer's authorised use; eligible soft-deleted records normally have a 180-day cleanup period. Linked applications can affect deletion.
Human media-review files
Originals and submitted explanations: 90 days after decision. Open cases remain pending review. Minimal decision records/checksums: until account deletion.
Moderation reports
Twelve months after closure, subject to necessary appeal/legal holds. Ongoing restrictions retain necessary separate records. The report record (reason, the reporter's name and contact details, the report text, decision and dates) is kept for that period even if the reported content or an involved account is deleted earlier; a deleted account is then referenced only by its identifier, and the reported content itself is not kept with it.
Advertising events
Individual impressions, clicks and conversion attributions: 90 days. Accounting records are separate.
Partner applications and creative review
For application handling, active advertising contracts, necessary approval evidence and identified legal claims. These records and hosted creative copies currently have no uniform automatic expiry. Abandoned applications and superseded assets must be assessed for continued need; the 90-day ad-event period does not apply automatically.
Partner-ad reports
The account-linked partner, placement and reason record is scheduled for deletion after 90 days. A separate moderation or legal case, if opened, follows its own necessary evidence-retention rules.
Community insights
Named profile visits: 90 days; post impressions: 60 days; serving/ranking logs: 90 days.
Notifications and push addresses
Ordinary read/unread notifications: 180 days from creation. Push addresses: 180 days without app reconfirmation, or earlier on logout, invalidity or recorded permission withdrawal.
Technical records
Authentication records and outgoing email logs: 90 days. Site/portfolio/listing/campaign statistics: 400 days. Other AI run history: up to 365 days; AI cost telemetry: 400 days; retrieved raw public-source documents: 90 days. Conversation-linked copies follow conversation deletion where linked.
Other operational records
Soft-deleted finder results: 180 days. Chat delivery/replay events: normally up to 120 days. Spam quarantine: 30 days unless restored. Export archives: seven days; download links: one hour.
Own sales prospects
Manual review is due after 24 months from the prospect's last substantive reply, or collection if there was no reply. Our own outgoing messages do not restart the period. Continued retention needs a concrete reason.
General contact/support mail
There is currently no fixed routine deletion schedule or regular mailbox review. You may request deletion; any continued retention must still be justified by the purpose, applicable duties or necessary claims evidence.
Financial and legal evidence
Applicable statutory periods; in Germany commonly eight years for accounting vouchers, ten for books/financial statements and six for business correspondence. Necessary consent, restriction and claims records follow their evidential purpose.
PostHog periods are described in Section 9. Media-check providers have their own contractual deletion processes; we do not promise a universal 30-day provider deadline. OpenCage technical request logs can be retained for six months; cached results have a separate lifecycle.
Automated production database backups currently use a seven-day retention setting. Historical manual snapshots and earlier file versions can persist separately and are not covered by that setting. There is currently no verified uniform maximum deletion period across all such copies. Restoring a backup does not remove the obligation to honour previous deletion requests. File-deletion failures require retries; removal from public view is not proof that every stored copy is erased.
12. Your choices and rights
Where the applicable conditions are met, you have rights to access, correction, erasure, restriction, data portability and protection against solely automated decisions with legal or similarly significant effects. You can withdraw consent without affecting earlier lawful processing. You can object to processing based on legitimate interests; objection to direct marketing and related profiling is unconditional.
Use account controls or contact service@thepending.app. We may request proportionate identity verification. We normally respond within one month; a legally permitted extension is explained within that month. Contact us if a self-service export is incomplete or you do not have an account. For customer-controlled records, we assist the responsible customer and can help identify them.
You may complain to a competent supervisory authority, including the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA). Mandatory local privacy rights remain unaffected. This policy does not claim that the service satisfies every country's separate launch, representative or recruitment requirements.
We use access controls, encrypted transport and other safeguards appropriate to the service. No policy guarantees absolute security. Accounts are intended for adults aged 18 or over; contact us if you believe a child has registered.
We update this policy when processing changes and notify users of material changes. Optional consent remains separate from accepting our Terms. English is our source text; translated legal documents are provided where offered or required. A legal-document translation does not mean that the entire product interface is available in that language.