Privacy policy clauses for Pinecone
Pinecone is a vector database that stores and indexes AI embeddings—numerical representations of text, images, or other content. Websites use Pinecone to enable semantic search, AI recommendations, and similarity matching without storing raw user data.
Free scan · No signup · Results in 60 seconds
What data Pinecone collects
Your privacy policy must disclose each of the following data types when you use Pinecone.
When does Pinecone trigger privacy obligations?
Installation triggers immediate obligations
The moment you integrate Pinecone into your application, you begin transmitting vector embeddings and metadata to Pinecone Systems Inc. (US-based processor). This data flow activates compliance requirements:
GDPR (if you serve EU users): If your embeddings are derived from personal data—such as user text, documents, or behavioral signals—those vectors themselves constitute personal data under GDPR Article 4(1). You must have a lawful basis (Article 6) before sending them to Pinecone. This triggers mandatory data processing agreements (Article 28) with Pinecone and disclosure obligations in your privacy notice (Articles 13–14).
CCPA (California users, $25M+ revenue or 100K+ consumers): Vector embeddings of user content fall under "personal information" (CCPA Section 1798.100). Pinecone becomes a service provider; you must execute a CCPA-compliant contract (Section 1798.140(ag)) and disclose collection and use in your privacy policy.
