Is Pinecone safe with your data?
Pinecone
Pinecone Systems, Inc.
Weak disclosure · medium confidence
Pinecone earns a D (54/100) because it leaves much about its data practices unstated.
Dealbreaker flag
- D4.3: shares personal information with third-party advertisers for interest-based advertising via tracking technologies with no named opt-out mechanism disclosed
#129
of 177 apps ranked
54
score · Data platform avg 64
-10
vs category average
Pinecone's website privacy policy grants strong GDPR data-subject rights and includes a full legal-basis table. It says nothing about model training or concrete retention timelines, and it affirmatively shares data with third-party advertisers for interest-based advertising without naming an opt-out. The policy explicitly excludes enterprise Services data handled under a data processing agreement, so it describes no AI-assistant data ingestion, and all training indicators read as silent.
What Pinecone's privacy policy says about your data
Full data-subject rights
The policy grants access, correction, deletion, portability ("Transfer a machine-readable copy of your personal information to you or a third party"), restriction, and objection rights via privacy@pinecone.io for European users.
Shares with advertisers, no opt-out
The policy states that "Our third party advertisers may use Tracking Technologies to gather information about your activities on our Services and other websites and apps in order to provide you advertising based upon your browsing activities." The only opt-out it names covers marketing emails, and it provides none for the ad-related data sharing.
Vague retention only
Retention runs "as long as necessary to fulfill the purposes for which we collected it" with no day-count or deletion timeline, and anonymized data "may be used indefinitely."
International transfers covered by SCCs
The policy says that whenever it shares personal information originating in the EEA, the UK, or Switzerland it does so "in accordance with the EU standard contractual clauses or other applicable frameworks," and it names an Article 27 EU and UK representative (EDPO).
What the policy is silent or vague on
- Not stated: keeping user inputs out of model training
- Not stated: a way to opt out of training
- Not stated: whether training use differs by plan
- Not stated: your ownership of generated outputs
Pinecone privacy rating
Details
- Category
- Data platform
- Modalities
- text
- Processes biometrics
- No
- Policy last updated
- 2024-05-08
- Region scored
- Global / US-default
- Assessed
- 2026-06-20
Each grade reflects our analysis of what an app states in its public privacy policy and terms as of the assessment date. It measures the transparency of those documents, not the company's actual data practices, security, or compliance. Grades are our opinion, offered for general information. Full disclaimer.