Privacy policy

Who we are

Pinnomatic is operated by Digipeak Media ("we", "us"), Borgarvägen 16, 824 53 Hudiksvall, Sweden. We are the data controller for the personal data processed through Pinnomatic. Questions about this policy: stefan@digipeak.se.

What we collect

• Account data — your email address, name and a hashed password (we never store passwords in plain text).
• Pinterest account data — when you connect a Pinterest account via OAuth we store your Pinterest username, profile image, account type and access tokens. Tokens are encrypted at rest.
• Content — boards, pins, campaign settings, product information, destination links, and images you upload or generate. Images are stored with our storage provider (Cloudflare R2).
• Usage data — credit balance and AI-generation usage (what was generated, when, and its cost), used for billing and abuse prevention.
• Technical data — server logs including IP address, used for security (e.g. rate limiting) and troubleshooting.

Why we process it

• To provide the service (contract, GDPR art. 6.1 b) — generating, scheduling and publishing pins on your behalf.
• Security and abuse prevention (legitimate interest, art. 6.1 f) — login rate limiting, encrypted token storage, server logs.
• Legal obligations (art. 6.1 c) — e.g. bookkeeping where applicable.

We do not sell personal data, and we do not use it for advertising.

Who we share it with

We use a small number of processors to run the service:

• Cloudflare — storage and delivery of pin images (R2).
• Runware — AI image and text generation. Pin copy and image prompts are sent to Runware to generate your content.
• Pinterest — when you connect an account and publish pins, content is transferred to Pinterest under their own privacy policy.
• Hosting — the application and database run on our own self-managed server infrastructure within the EU.

Where processors are located outside the EU/EEA, transfers rely on the EU Commission's Standard Contractual Clauses or an adequacy decision.

How long we keep it

Your data is kept for as long as you have an account. When you delete your account — or a connected Pinterest account — the associated data is deleted. Server logs are rotated regularly. Some records may be retained longer where the law requires it (e.g. bookkeeping).

Your rights

Under the GDPR you have the right to access, rectify, erase and port your data, to restrict or object to processing, and to withdraw consent where processing is based on it. Contact stefan@digipeak.se to exercise any right. You can also lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se.

Changes

We may update this policy as the service evolves. Material changes will be announced in the app. The date above always reflects the latest revision.