Privacy

Pinly stores what it needs to run the product for you: your account, the content of your workspace, your Pinterest connection, and the performance of the Pins it published. It runs on servers in Germany. It stores no IP addresses and keeps no access log. It sets three cookies, all of them necessary. It sells nothing, trains nothing on your data, and shows you no advertising.

The sections below say all of that precisely, and say where the honest answer is “nothing yet”.

Pinly is operated by Jonas Schmidt, Küssnachterstrasse 8, 6343 Risch ZG, Switzerland. That person is the controller under Art. 4(7) GDPR and the responsible party under the Swiss Federal Act on Data Protection (FADP).

For anything on this page, write to jonas.schmidt07@gmail.com.

Pinly is run by one person and its processing is not on the scale that requires a data protection officer under Art. 37 GDPR or Art. 10 FADP, so none has been appointed. The address above is the contact for every data protection question.

The operator is in Switzerland, so the Swiss FADP applies. Where Pinly is offered to people in the EU or UK, the GDPR applies as well, and the rights described below are the ones it grants. Personal data is stored and processed on servers in Nuremberg, Germany — inside the EEA, so running the service involves no transfer to a third country.

You, as the person who signed up, and anyone you invite into your workspace. Inviting someone means giving us their email address; you are responsible for having a reason to do that, and for telling them that you have.

Pinly is a tool for a business publishing its own content. It is not designed to process data about your customers, and you should not put personal data about third parties into it — not into your brand kit, not into Pin text, not into uploads.

To perform our contract with you (Art. 6(1)(b) GDPR): your account, your workspace, Pin drafts, publishing, and the analytics we compute. Without this data there is no product to deliver.

On the permission you grant Pinterest: connecting your account rests on the consent you give in Pinterest’s own screen, which you can withdraw at any time by disconnecting.

On our legitimate interest (Art. 6(1)(f) GDPR): the audit log and the rate-limit counters, which exist so that an account cannot be quietly misused and so the service stays available for everyone. We balanced this against your interests and kept the data minimal — the audit log records what was done, by which account, and when.

To meet a legal obligation (Art. 6(1)(c) GDPR): invoices and payment records, for as long as bookkeeping law requires them.

We do not process your data for advertising, and we ask for no consent beyond the Pinterest connection, because nothing else here needs one.

Your account. Email address, name and a password stored as a bcrypt hash — never the password itself. If you sign in with Google, we store the provider account identifier instead of a password.

Your workspace. Brand kit, business profile, the pages we read from the website you asked us to analyse, your keywords, ideas, Pin drafts and the images you upload. This is the content the product works on.

Your Pinterest connection. The account identifier and username, your board names and identifiers, and OAuth access and refresh tokens. Tokens are encrypted at rest with AES-256-GCM before they are written to the database, are never sent to your browser, and are only ever used server-side.

Published Pins and their results. The Pins we created on your behalf, and a daily record per Pin of impressions, outbound clicks, Pin clicks, saves, comments, reactions, profile visits and follows, as reported by the Pinterest API. This is what the analytics in the product are computed from.

Saved references. If you use the library, we store the title, description, link and a thumbnail URL of Pins you saved to your own Pinterest boards, together with structural facts about them. The thumbnail is referenced from Pinterest and is not copied into our storage.

Operational records. An audit log of significant actions, product usage counters for your plan limits, and a record of each AI call (provider, model, token counts and cost — not a copy of the response).

No IP addresses. The application never records the address you connect from, and the web server in front of it keeps no access log — it logs only certificate renewals. This is unusual enough to be worth stating plainly.

No tracking. There is no analytics script, no advertising pixel, no third-party tag of any kind on this site or in the product. Nobody is told that you visited.

No card numbers. If you subscribe, payment details go directly to Stripe. They never reach our servers.

No copies of AI output. We record that a generation happened and what it cost, not what was written.

We ask for only the four permissions the product needs: to identify the connected account, list your boards, read your own Pins and their analytics, and publish the Pins you approved. We do not request permission to create boards, to touch ads or catalogs, or to read secret boards.

That data serves one purpose — running Pinly for you. We do not sell it. We do not share it with other users or other workspaces. We do not use it to train models, and we never combine it with data from other accounts. Analytics are stored per Pin and stay inside your own workspace.

Publishing is assisted by default, so nothing appears on your Pinterest account until you have approved it. Disconnecting revokes the token with Pinterest and removes the stored credentials at once.

We use a small number of processors, and only the ones switched on for this deployment:

• Pinterest — to read your boards and analytics, and to publish the Pins you approved.
• Hetzner Online GmbH, Germany — the servers and the database run there, in their Nuremberg data centre. Bound by a processing agreement under Art. 28 GDPR.
• An AI provider — currently none. Text generation runs locally in this deployment, so no provider receives anything today. When it is switched on it will be Anthropic or OpenAI, and it will receive only the text we ask it to work on: your page content, headlines and computed statistics. It is never given your Pinterest tokens, and this page will name the provider before that happens.
• An email provider — currently none. Team invitations are shown to you as a link to pass on yourself, so no email provider holds an address of yours.
• Stripe — payment details, if you subscribe. We never see or store your card number.

We do not sell your data and we do not use it to train models.

Running the service involves none. The servers and the database are in Germany, and Pinterest processes the data you authorised under its own terms as the operator of the platform you are publishing to.

Two processors would involve a transfer to the United States if switched on: the AI provider, and Stripe if you subscribe. Where that applies we rely on the European Commission’s Standard Contractual Clauses, together with the EU–US Data Privacy Framework where the provider is certified under it. Today no AI provider is switched on, so the only such transfer that can occur is a payment you make yourself.

The measures below are the ones actually implemented, not a wish list:

• Everything travels over TLS; the certificate is obtained and renewed automatically.
• Passwords are stored as bcrypt hashes and can never be read back.
• Pinterest tokens are encrypted at rest with AES-256-GCM under a key held only on the server.
• No secret is ever sent to the browser; tokens are used server-side only.
• Every query is scoped to a workspace by construction, so one workspace cannot read another’s rows even if an identifier is guessed.
• The database is not reachable from the internet — it listens only inside the server.
• A firewall drops everything except the two web ports and the administrative SSH port, and the application runs in containers rather than directly on the host.

No system is perfect. If personal data is nevertheless exposed, we will notify the competent supervisory authority within 72 hours of becoming aware of it where Art. 33 GDPR requires it, and tell you directly where the risk to you is high (Art. 34 GDPR).

Nothing expires on its own. Everything belonging to a workspace is kept for as long as that workspace exists — deliberately, because the product’s purpose is to compare what you publish today against what you published months ago, and a metric that has been deleted can no longer be learned from.

Three things are exceptions:

• Pinterest credentials are deleted the moment you disconnect, whether or not the workspace stays.
• Team invitations expire on their own and stop working once they do.
• Invoices and payment records are kept for as long as bookkeeping law requires, which is ten years under Swiss law, even after you have closed your account.

Disconnecting Pinterest revokes the token with Pinterest and deletes the stored credentials immediately.

Closing your account under Settings → Plan & billing deletes the rows and the stored files themselves — Pins, drafts, measurements, references, uploaded images and the Pinterest credentials — not a flag that hides them. Two things it cannot delete, and says so before you confirm: a Pin already published is on your Pinterest account rather than ours, and invoices are kept for the period named above. A workspace belonging to somebody else that you were invited to is not deleted; you leave it.

Leaving a workspace from the workspace settings instead only marks that workspace closed and keeps its data, which is the right thing when somebody else may still need it. If you want the data gone, close the account. You can also write to jonas.schmidt07@gmail.com and we will do it for you.

You have the right to access your data, to have it corrected, to receive it in a portable form, to have it erased, to have processing restricted, and to object to processing that rests on our legitimate interest — under the Swiss FADP wherever you are, and under the GDPR if you are in the EU or UK. Where processing rests on consent, you may withdraw it at any time without affecting what was lawful before.

There is no self-service export button in the product yet. Write to jonas.schmidt07@gmail.com from the address on your account and we will answer within one month, as Art. 12(3) GDPR requires. If a request is complex we may extend that by two months and will tell you why. We will ask for proof of identity only where we genuinely cannot tell who is asking, and we charge nothing unless a request is manifestly excessive.

If you believe your data has been handled wrongly, you can also complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC) in Bern, and in the EU or UK the authority for the country you live in.

Pinly makes suggestions, not decisions about you. Nothing in it produces a legal effect on you or similarly significantly affects you within the meaning of Art. 22 GDPR, and there is no profiling of you as a person — the statistics it computes are about the performance of Pins, not about their author.

Autopilot is the one part that acts without asking each time. It is off until you switch it on, bounded by limits you set, publishes only to the account you connected, and stops the moment you switch it back.

Pinly sets three cookies, all strictly necessary, so no consent banner is required under Art. 5(3) of the ePrivacy Directive:

• a session cookie, so you stay signed in;
• one holding the workspace you last had open;
• one remembering whether you chose the light or dark theme.

There is no advertising or analytics cookie, and no third party sets a cookie through this site.

Pinly is a tool for running a business and is not directed at children. You must be at least 16 to have an account, and old enough under the law of your country to enter into a contract. We do not knowingly collect data about children; if you believe a child has an account, write to jonas.schmidt07@gmail.com and we will remove it.

When a practice changes, this page changes with it and the date at the top moves. If a change materially affects how your data is handled — a new processor, a new purpose, a transfer that did not exist before — we will tell you in the product or by email before it takes effect, and never apply it retroactively.

Every section above was written against the source code of the product rather than adapted from a template, so what it describes is what the software does — including where the honest answer is “nothing yet” or “there is no button for that”.