Captured before automated identity checks (Oct 14, 2026): accurate as of its capture on May 12, 2026; our capture on Oct 15, 2026 found the same text, but its identity was not checked by them.
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
“all Authorized Affiliate Claims shall be considered claims made by Customer and shall be subject to any liability restrictions set forth in the Agreement, including any aggregate limitation of liability.”
“it has provided notice and obtained all consents and rights necessary under Data Protection Laws for Pinecone to process Customer Personal Data and provide Services pursuant to the Agreement”
“it shall in no event include special categories of personal data (GDPR article 9), personal data relating to criminal convictions and offenses (GDPR article 10), or similarly sensitive personal data subject to Data Protection Laws in any Customer Data.”
“Customer agrees that any regulatory penalties incurred by Pinecone that arise in connection with Customer's failure to comply with its obligations under this DPA...shall reduce Pinecone's liability under the Agreement...”
“each Party's and all of its Affiliates' liability...arising out of or related to this DPA, the SCCs or any data protection agreements...shall remain subject to the limitation of liability provisions of the Agreement”
“Upon expiration or termination of the Agreement, Customer may retrieve any Customer Personal Data it wishes to retain as described in the Agreement and, unless prohibited by Applicable Law, Pinecone will delete Customer Personal Data in accordance with the Documentation and Agreement.”
This addendum sets the rules for how Pinecone handles personal data submitted by customers. Customers are responsible for ensuring they have the right to submit data to Pinecone—including obtaining all necessary consents—and must never submit highly sensitive categories of personal data such as health information or criminal records. If a dispute arises about a third-party data processor Pinecone uses and it is not resolved within 14 days, the customer's only remedy is to cancel the relevant service subscriptions.
This Data Processing Addendum establishes the terms under which Pinecone processes Customer Personal Data in connection with its Services. Pinecone's processing is limited strictly to what is necessary to perform its Agreement obligations and to the Customer's documented instructions, with a corresponding prohibition on the Customer submitting GDPR special-category, criminal-conviction, or similarly sensitive personal data. The Customer bears the obligation to confirm that all required notices have been given and consents obtained under applicable Data Protection Laws before Pinecone processes any data. Liability for data-protection claims—including those arising under SCCs—is capped by the Agreement's liability limits for both parties and their Affiliates, and any regulatory penalties Pinecone incurs due to the Customer's DPA non-compliance reduce Pinecone's liability under the Agreement. Pinecone retains unilateral authority to modify the DPA by posting a revised version, subject only to the constraints that modifications may not materially diminish service security or change the scope of Pinecone's processing.
As a customer, you are contractually required to confirm that all necessary notices have been provided and consents obtained under applicable Data Protection Laws before Pinecone processes your data, and you must not submit GDPR special-category data, criminal-conviction data, or similarly sensitive personal data. Pinecone will process your personal data only to the extent needed to perform the Agreement and according to your documented instructions, and will notify you in writing without undue delay—and within any legally required deadline—after becoming aware of a Security Incident. If you object to a Subprocessor and the objection is not resolved within 14 days of your Objection Notice, the one action available to you is to terminate the relevant Service subscriptions.
Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.
We withheld clauses we had published from this document. Each withholding is recorded in our correction log:
“all Authorized Affiliate Claims shall be considered claims made by Customer and shall be subject to any liability restrictions set forth in the Agreement, including any aggregate limitation of liability.”
“it has provided notice and obtained all consents and rights necessary under Data Protection Laws for Pinecone to process Customer Personal Data and provide Services pursuant to the Agreement”
“it shall in no event include special categories of personal data (GDPR article 9), personal data relating to criminal convictions and offenses (GDPR article 10), or similarly sensitive personal data subject to Data Protection Laws in any Customer Data.”
“Customer agrees that any regulatory penalties incurred by Pinecone that arise in connection with Customer's failure to comply with its obligations under this DPA...shall reduce Pinecone's liability under the Agreement...”
“each Party's and all of its Affiliates' liability...arising out of or related to this DPA, the SCCs or any data protection agreements...shall remain subject to the limitation of liability provisions of the Agreement”
“Upon expiration or termination of the Agreement, Customer may retrieve any Customer Personal Data it wishes to retain as described in the Agreement and, unless prohibited by Applicable Law, Pinecone will delete Customer Personal Data in accordance with the Documentation …”
“Pinecone may modify this DPA at any time by posting a revised version...provided that the modifications (a) do not materially diminish the overall security of Services...(b) do not change the scope of Pinecone's processing...”
“Pinecone will notify Customer in writing without undue delay, and in any event within any time period required by Data Protection Law, after becoming aware of a Security Incident.”
“Pinecone will process Customer Personal Data as necessary to perform its obligations under the Agreement, and only in accordance with Customer's documented instructions”
“Pinecone remains fully liable for any breach of this DPA that is caused by an act, error or omission of its Subprocessors to the same extent that Pinecone would have been liable...”
“Without limiting its other obligations under this DPA, with respect to Customer Personal Data subject to the CCPA, Pinecone confirms that it will not: (a) process, retain, use, or disclose Customer Personal Data for any purpose other than for the …”
“If the Parties are unable to achieve resolution within 14 days of the applicable Objection Notice, Customer, as its sole and exclusive remedy, may terminate its Service subscriptions with respect to those aspects of Services...”
Every distinct legal provision identified in this document. Featured provisions appear above with analysis.
We have not recorded a change to this document since we began capturing it. Monitor includes alerts from a daily check, structured change summaries, and monitoring for up to 20 platforms.
Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.
Cross-platform context
See how other platforms handle Affiliate Claims must be brought by Customer and subject to liability cap and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 343 platforms.