Privacy Policy for “Pin Studio”

1. Overview

Pin Studio is a privately operated tool that the operator named below uses to manage their own Pinterest business account: creating, scheduling, editing and deleting Pins, managing boards and uploading media. Optionally, the operator can connect AI assistants (such as Claude or ChatGPT) through a protected interface (Model Context Protocol, MCP).

Pin Studio is not a public service. There is no sign-up for third parties, and it only accesses the Pinterest account that the operator has explicitly authorized. Pin Studio does not use tracking, analytics, advertising or third-party cookies.

2. Controller

Responsible for data processing within the meaning of the EU General Data Protection Regulation (GDPR):

3. Data we receive from Pinterest and how we use it

Pin Studio connects to the official Pinterest API v5 only after the account owner has authorized it via Pinterest's OAuth consent screen. The following permissions (scopes) are requested:

user_accounts:read boards:read boards:read_secret boards:write pins:read pins:read_secret pins:write

This allows Pin Studio to access:

• Account information: username, account type, business name, and the number of followers, Pins and boards.
• Boards and board sections: names, descriptions and visibility, including secret boards of the account.
• Pins of the connected account: title, description, destination link, alt text and image/video URLs.

Purpose: This data is used exclusively to display the account's content in the dashboard and to create, edit, schedule or delete content in the operator's own account at the operator's request.

What we do not do: We do not sell, rent or share Pinterest data with third parties (except as described in sections 10 and 11 at the operator's own initiative), we do not use it for advertising or profiling, we do not combine it with other data sources, and we do not access data of other Pinterest users.

Storage: Pinterest content (boards, Pins, account information) is not stored permanently; it is retrieved live from Pinterest each time a page is opened. Pin Studio only stores: the OAuth access and refresh tokens, the IDs and titles of Pins created or scheduled through Pin Studio, and the activity log described in section 6.

Legal basis: the consent given by the account owner during authorization (Art. 6(1)(a) GDPR), which can be withdrawn at any time (see section 4), and the operator's legitimate interest in efficiently managing their own Pinterest presence (Art. 6(1)(f) GDPR).

4. Revoking access and deleting data

• In Pin Studio: Settings → “Disconnect” immediately deletes the stored Pinterest tokens. Pin Studio can no longer access the account afterwards.
• On Pinterest: access can be revoked at any time in the Pinterest account settings in the section for connected apps.
• Deletion request: on request to the email address in section 2, all data stored by Pin Studio (tokens, uploaded files, schedule and activity log) will be deleted within 30 days.

Pins already published on Pinterest are not affected by this; they can be deleted directly on Pinterest.

5. Uploaded files

Images and videos uploaded to the media library are stored on the web server in a directory that is not publicly accessible. They are only transferred to Pinterest when a Pin is created from them. Files remain stored until the operator deletes them in the media library.

6. Schedule and activity log

For scheduled Pins, Pin Studio stores the Pin content (board ID, title, description, link, alt text, media reference) and the planned publishing time until publication. The activity log records which actions were performed and by whom (dashboard, AI assistant, scheduler), e.g. “Pin created”. IP addresses are not stored. Entries in the activity log and completed schedule entries are automatically deleted after 12 months.

7. Login and cookie

Access to the dashboard is protected by a password, which is stored only as a cryptographic hash. To protect against brute-force attacks, the number of failed login attempts is counted (without IP address).

After login, a technically necessary session cookie (pinboard_session) is set. It contains no personal data other than a random session ID and is deleted when the browser is closed, or after 12 hours of inactivity. No other cookies are used. Legal basis: Section 25(2) No. 2 of the German TDDDG and Art. 6(1)(f) GDPR.

Pin Studio does not load any external fonts, scripts or tracking services.

8. Hosting

Pin Studio is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. When the website is accessed, the hosting provider automatically processes technical access data in server log files (e.g. IP address, date and time, requested URL, browser type) in order to deliver the website and ensure its security. A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider. Legal basis: Art. 6(1)(f) GDPR. Retention of these logs is determined by the hosting provider.

9. Pinterest images in the dashboard

When boards and Pins are displayed in the dashboard, preview images are loaded directly from Pinterest's servers. In doing so, the IP address of the person viewing the dashboard (i.e. the operator) is transmitted to Pinterest.

10. AI assistants (optional)

If the operator connects an AI assistant to Pin Studio via MCP, the assistant can — at the operator's request — retrieve board names, Pin texts, the list of uploaded files and reduced preview images of uploaded images, and create or schedule Pins. This data is transmitted to the provider of the respective assistant and processed under its terms:

• Claude: Anthropic — Privacy Policy
• ChatGPT: OpenAI — Privacy Policy

Access via MCP is protected by a secret key, can be disabled at any time in the settings, and the key can be renewed (invalidating the old one).

11. Recipients

Content created via Pin Studio is transmitted to Pinterest (for users in the EU: Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland) and published there. Pinterest's own privacy policy applies to processing on Pinterest. Data may also be processed by Pinterest, Inc. in the USA. There are no other recipients.

12. Security

All connections use HTTPS. Tokens and uploaded files are stored outside the publicly accessible area of the web server. Forms are protected against cross-site request forgery, and repeated failed logins lead to a temporary lockout.

13. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21), as well as the right to withdraw consent at any time with effect for the future (Art. 7(3)). To exercise these rights, please contact the controller (section 2). You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77), in particular in the EU member state of your residence. There is no automated decision-making.

14. Changes

This privacy policy is updated when Pin Studio's functions or the legal requirements change. The current version is always available at this address. In case of doubt, the German version prevails.