Ping

GDPR overview

The word GDPR appears nowhere on ping.tm — not once across any page collected. The privacy notice, effective 1 August 2024, nevertheless describes GDPR-shaped rights for EEA and UK residents: access and a copy, rectification or erasure, restriction of processing, portability, objection, and withdrawal of consent without retroactive effect. Complaints are directed to the national supervisory authority through the European Commission directory, and Swiss residents to the EDÖB. Requests go to privacy@ping.tm. The publisher is established in Poland, so no Article 27 representative is required and none is named. International transfers are acknowledged, with servers in the United States and Germany, but no transfer mechanism is cited: no adequacy decision, no standard contractual clauses. There is no published DPA, no subprocessor list and no designated data protection officer. Compliance is implied by practice, never claimed in writing.

Who owns the data?

Ownership of your content stays with you: the terms state that you retain every right to whatever you submit, post or display, and that you are responsible for protecting those rights. In exchange you grant Who Else Poland Sp. z o.o. a licence to use, modify, publicly perform, publicly display, reproduce and distribute that content on and through the service, including making it available to other users, who may in turn use it under the same terms. You warrant that you own the content or hold the necessary rights. Backups are taken regularly but carry no guarantee against loss or corruption, and the publisher advises keeping an independent copy elsewhere.

Reuse rights

You may reuse anything you created in Ping without asking permission; the terms place no restriction on your own material. Content you share into the service can also be used by the other users it is made available to, under those same terms. On the vendor's side, Ping collects names, e-mail addresses, usernames, passwords, photos, device and log data, together with Gmail credentials and Google Calendar events when you connect those accounts. Declared purposes are account creation and login, feedback requests, user-to-user communication, account management, administrative messages, protecting the service, enforcing the terms, answering legal requests and internal analytics. Data may be passed to processors handling payment, analytics, e-mail delivery, hosting, customer service and marketing, under contracts that limit them to instructed processing; the only recipient category actually named is Data Analytics Services. Ping states it does not sell, rent or trade information for third-party promotion, that its use of Google APIs follows the Limited Use requirements, and that Google Workspace APIs are not used to develop, improve or train generalised AI or ML models. Do-Not-Track browser signals are not honoured.

Data retention & training

Hosting summary

Ping states that its servers are located in the United States and in Germany. Users accessing the service from elsewhere are warned that their information may be transferred to, stored in and processed in those countries and others, and that jurisdictions outside the EEA or United Kingdom may not offer comparable data protection law. No transfer mechanism is named: neither standard contractual clauses nor an adequacy decision is cited. Customers cannot choose a hosting region, and no subprocessor list is published, so the identity of the hosting providers themselves is unknown. One category of data escapes this entirely: email messages read through the Gmail integration are processed on the device only and are never stored on Ping's servers. The website is delivered through Cloudflare, whose resolved address geolocates to the United States, but that concerns content delivery rather than where user data actually lives.