Pinnacle Data Discovery: connected tools privacy notice

Last updated: October 22, 2026

Who we are

Pinnacle HQ, Inc. is a Delaware corporation with its registered address at 131 Continental Dr, Newark, DE 19713, USA ("Pinnacle", "we", "us"). This notice explains how we handle data from Slack, HubSpot, Zoom and Microsoft 365 when you connect them on the Pinnacle Data Discovery portal at https://data.hqpinnacle.co/tools, and the figures you type in there yourself. Our Privacy Policy covers everything else, including our website, cookies, and visitors in the EU and UK.

For any privacy question or request, email privacy@hqpinnacle.co.

What we collect and why

The portal is an intake form that asks how much data your company holds. Pinnacle Data Discovery reads totals only, never content: counts and sizes such as the number of members, records, meetings or messages, and storage used. When you connect a tool, its figures pre-fill the form. You can also type figures in for any tool, including ones the portal can't connect to, such as ConnectWise.

Figures: the counts and storage totals read from the tools you connect or typed in by you, the date they were read, and which ones you edited.
Who connected: for each connected tool, the account that connected it (an email address or, for Slack, a member ID) and the account or workspace name, as described for each tool below.
About you: your company name, company domain (optional), your name, your work email and any notes.

We use these only to review your submission internally and respond to you. If you leave the page without clicking "Send to Pinnacle", nothing is sent to us. We do not sell this data, use it for advertising, or share it with data buyers, AI labs or any other third party, and we never use it to train artificial intelligence or machine learning models.

Slack data (Pinnacle Data Discovery)

When you click "Connect Slack" on https://data.hqpinnacle.co/tools, a Slack Workspace Owner or Admin can let Pinnacle Data Discovery read a small set of figures from your Slack workspace. This section explains exactly what we access and how we handle it.

What we access. We request these read-only permissions for the person connecting: view people in the workspace (users:read), view basic information about public channels (channels:read), view the workspace's name, email domain and icon (team:read), and read the workspace's billing plan (team.billing:read). With them we count full members and guests (leaving out bots and deactivated accounts), count active and archived public channels, read the year the oldest public channel was created, and read the workspace's domain and plan, and we check that the person connecting is a Workspace Owner or Admin. We do not request email addresses (we never ask for users:read.email), and we do not keep anyone's name, profile or channel name: they are counted and discarded at once. If you tick "Also count files", we also request files:read ("View files shared in channels and conversations"); Slack lets that permission download files, but we only read the number of files you can see and their sizes, and never download or open one. On a Slack Enterprise org, an Org Owner or Org Admin can instead connect the whole org with admin.analytics:read ("Access analytics data about the organization"), which we use only to read the number of messages posted and files added by members on a sample of days spread over the last 12 months, and scale that up to a 12-month estimate (the page shows how many days were sampled); Slack's analytics files also list each member's email address, which we never keep, log or send anywhere. We never read, search, download or store messages, files, canvases or any other content, and we never call Slack's message history or search methods. If you upload a Slack analytics export (CSV) on the page, it is read only in your browser, only the message and file totals are kept, and the file is never sent to us.

How we use it. The figures pre-fill the intake form on the same page. You can edit or remove any figure before sending. If you leave the page without clicking "Send to Pinnacle", nothing is sent to us. Pinnacle uses submitted figures only to review your submission internally and respond to you.

How we handle the token. Slack gives our server a temporary user access token. It is used only for the request that reads the figures, is never stored, logged, put in a cookie or sent to our Sheet, and is revoked with Slack's auth.revoke as soon as the figures are read, so it stops working at once. Our server keeps nothing about the connection: the figures go back to the page in the sign-in window's own response, which hands them to the page within your browser, and are not stored on our side. When you click "Send to Pinnacle", we store the submitted form, including the figures, the workspace domain, its plan and the Slack member ID of the person who connected (not their name or email address), in a restricted Google Sheet accessible only to a small number of authorized Pinnacle staff. We keep submissions for 24 months and then delete them.

How we share it. We do not sell Slack data, use it for advertising, or share it with data buyers, AI labs or any other third party. Google hosts the Sheet as our processor. We disclose it only when required by law.

Artificial intelligence. We do not use Slack data, or anything derived from it, to develop, improve or train artificial intelligence or machine learning models, and we do not allow anyone else to.

Your choices. Our access ends once the figures are read, because the token is revoked. To remove Pinnacle Data Discovery from your workspace, open your workspace name in Slack, then Tools & settings, Manage apps, Installed Apps, select Pinnacle Data Discovery, and on its Configuration tab click Remove App. To ask us to delete a submission, email privacy@hqpinnacle.co.

HubSpot data (Pinnacle Data Discovery)

When you click "Connect HubSpot" on https://data.hqpinnacle.co/tools, you can let Pinnacle Data Discovery read a small set of figures from your company's HubSpot account. This section explains exactly what we access and how we handle it.

What we access. We request read-only access to CRM records: contacts (crm.objects.contacts.read, which in HubSpot also covers calls, meetings and notes), companies (crm.objects.companies.read), deals (crm.objects.deals.read) and tickets (crm.objects.tickets.read). With it we count the records of each type, read the creation date of the oldest one, count the calls that have a recording and the calls HubSpot marks as having a transcript, and add up the length of the transcribed calls. We do not read names, email addresses, phone numbers, notes, email or message content, call recordings, call transcripts or call summaries, and we do not change or delete anything. HubSpot's read permissions technically allow reading record details, so the limit is in what our code requests: counts and dates only. Counting logged emails is optional and off by default. Only if you tick "Also count logged emails" do we also request sales-email-read, as an optional permission. HubSpot describes it as: "Grants access to read and manage one-to-one email engagements." HubSpot has no narrower permission for emails, and this one could read email content, so we ask for it only when you choose to. We use it only to count logged emails and read the creation date of the oldest one: we never request an email's subject, body, sender, recipients, headers or attachments. If you don't tick the box, or don't grant the permission, we leave the email count empty.

How we handle the token. HubSpot gives our server a temporary access token. It is used only for the request that reads the figures, is never stored, logged or put in a cookie, and is revoked as soon as the figures are read. When you click "Send to Pinnacle", we store the submitted form, including the figures and the email address of the HubSpot user who connected, in a restricted Google Sheet accessible only to a small number of authorized Pinnacle staff. We keep submissions for 24 months and then delete them.

How we share it. We do not sell HubSpot data, use it for advertising, or share it with data buyers, AI labs or any other third party. Google hosts the Sheet as our processor. We disclose it only when required by law.

Artificial intelligence. We do not use HubSpot data, or anything derived from it, to develop, improve or train artificial intelligence or machine learning models, and we do not allow anyone else to.

Your choices. Our access ends once the figures are read. A HubSpot super admin can also remove Pinnacle Data Discovery at any time in HubSpot under Settings, Integrations, Connected apps. To ask us to delete a submission, email privacy@hqpinnacle.co.

Zoom data (Pinnacle Data Discovery)

When you click "Connect Zoom" on https://data.hqpinnacle.co/tools, a Zoom account owner or admin can let Pinnacle Data Discovery read a small set of figures from your company's Zoom account. This section explains exactly what we access and how we handle it.

What we access. We request these read-only permissions: view a user's profile (user:read:user:admin), list users (user:read:list_users:admin), view the active hosts report (report:read:list_users:admin) and list the account's cloud recordings (cloud_recording:read:list_account_recordings:admin). With them we read the email address of the person connecting and your Zoom account ID; the number of users and licensed users; the number of meetings, meeting minutes and meeting participants per month over the last 6 months, added up from the active hosts report; and, from recording file details only, how many cloud recordings were made in the last 12 months, their total file size and how many include an audio transcript. To count them, our server receives Zoom's user list, active hosts report and recording list, which include people's names and email addresses, departments, meeting topics, dates and file details. These lists are held in memory only for the request that counts them, and then discarded: we keep only the totals, and we never keep, log or send the lists anywhere. We do not download, play or read any recording, transcript, chat, meeting summary or other content, we do not request download links or access tokens for recording files, and we do not change anything.

How we handle the token. Zoom gives our server a temporary access token. It is used only for the request that reads the figures, is never stored, logged or put in a cookie, and is revoked as soon as the figures are read. When you click "Send to Pinnacle", we store the submitted form, including the figures, the email address of the Zoom user who connected and your Zoom account ID, in a restricted Google Sheet accessible only to a small number of authorized Pinnacle staff. We keep submissions for 24 months and then delete them.

How we share it. We do not sell Zoom data, use it for advertising, or share it with data buyers, AI labs or any other third party. Google hosts the Sheet as our processor. We disclose it only when required by law.

Artificial intelligence. We do not use Zoom data, or anything derived from it, to develop, improve or train artificial intelligence or machine learning models, and we do not allow anyone else to.

Your choices. Our access ends once the figures are read. A Zoom account owner or admin can also remove Pinnacle Data Discovery at any time in the Zoom App Marketplace under Manage, Added Apps. Because we keep no Zoom data apart from submitted forms, removing the app leaves nothing for us to delete; to ask us to delete a submission, email privacy@hqpinnacle.co.

Microsoft 365 data (Pinnacle Data Discovery)

When you click "Connect Microsoft 365" on https://data.hqpinnacle.co/tools, you can let Pinnacle Data Discovery read a small set of figures from your organization's Microsoft 365 usage reports. This section explains exactly what we access and how we handle it.

What we access. We request your basic sign-in identity (openid, email and profile) and read-only access to your organization's Microsoft 365 usage reports (Reports.Read.All, shown by Microsoft as "Read all usage reports"). Microsoft requires an administrator to approve this permission, and the person connecting must hold the Global Reader, Reports Reader or Global Administrator role. With it we read only totals from the latest reports: mailbox storage and the number of mailboxes, OneDrive and SharePoint storage, the number of Teams channel and chat messages over the last 180 days, and the number of active users. We do not read, open, copy or download any email, file, chat message, calendar entry, contact or other content, and this permission does not allow it. We do not read per-user report rows.

How we handle the token. Microsoft gives the page a temporary access token. It is kept only in the page's memory and sent once to our server, which uses it for that single request to read the report totals and does not store, log or forward it. Microsoft offers no way for a web page to revoke the token, so we discard it straight away and it expires on its own within about an hour. When you click "Send to Pinnacle", we store the submitted form, including the figures and the email address of the Microsoft account you connected, in a restricted Google Sheet accessible only to a small number of authorized Pinnacle staff. We keep submissions for 24 months and then delete them.

How we share it. We do not sell Microsoft 365 data, use it for advertising, or share it with data buyers, AI labs or any other third party. Google hosts the Sheet as our processor. We disclose it only when required by law.

Artificial intelligence. We do not use Microsoft 365 data, or anything derived from it, to develop, improve or train artificial intelligence or machine learning models, and we do not allow anyone else to.

Your choices. An administrator can remove Pinnacle Data Discovery at any time in the Microsoft Entra admin center under Enterprise applications: select the app, then Properties, then Delete. You can see the apps you use at https://myapps.microsoft.com. To ask us to delete a submission, email privacy@hqpinnacle.co.

Submitted forms are stored in a restricted Google Sheet in Pinnacle's Google Workspace account, which Google hosts as our processor, and accessible only to a small number of authorized Pinnacle staff. The portal runs on Cloudflare, which hosts data.hqpinnacle.co. Access tokens from the tools you connect are never stored or logged, and are never shared with anyone. We disclose data only when required by law.

How long we keep data

Submitted forms, including the figures from connected tools: 24 months from submission, then deleted.
Access tokens: not kept. Each is used for the one request that reads the figures, then revoked or, for Microsoft 365, discarded to expire on its own within about an hour.
Figures you don't send: not kept. They exist only in your browser until you close the page.

Deletion requests and your rights

You can ask us to tell you what we hold about you or your company, to correct it, or to delete a submission. Email privacy@hqpinnacle.co with "Privacy request" in the subject line. We may need to confirm your identity first. We reply within one month. Each tool section above also explains how to remove Pinnacle Data Discovery from that tool.

Contact

Pinnacle HQ, Inc.
131 Continental Dr, Newark, DE 19713, USA
Privacy: privacy@hqpinnacle.co

Pinnacle Data Discovery for Slack, HubSpot, Zoom and Microsoft 365