Privacy Policy

Last updated: 28 June 2026  ·  Effective date: 28 June 2026  ·  Version 1.0

1. Who we are

Pinspark is a social media marketing tool for Etsy sellers, operated by Pinspark ("PinSpark", "we", "us", or "our"), registered in England and Wales. Our registered address is Pinspark, The Pines, BS16 9QY, Bristol, UK

We are the data controller for personal data processed through the Pinspark platform at pinspark.co.uk.

For questions about this policy or our data practices, contact us at: privacy@pinspark.co.uk

2. What data we collect and why

2.1 Account data

When you sign up for Pinspark, we collect:

• Your name and email address
• A hashed password (we never store passwords in plain text)
• Your billing information, processed securely by Stripe (we never see or store full card numbers)

Legal basis (UK GDPR): Contract — necessary to provide the service you've signed up for.

2.2 Etsy shop data

When you connect your Etsy shop via Etsy's OAuth 2.0 authorisation, we access:

• Your Etsy shop name and public shop information
• Your product listings (title, description, price, images, tags)
• Sales and transaction data (order counts, revenue figures, fees)
• Shop statistics (views, favourites, traffic sources)

We use this data solely to provide Pinspark's features to you — specifically to generate social media content from your listings and to display shop analytics within your Pinspark dashboard. We do not share Etsy data with third parties, combine it with other users' data, or use it for advertising.

Legal basis: Contract and Legitimate Interests (providing the service you have requested).

2.3 Pinterest account data

When you connect your Pinterest account, we access and use:

• Your Pinterest profile name and account identifier
• Your Pinterest boards (names and IDs, to allow you to choose where to publish)
• The ability to create Pins on your behalf, on boards you select, when you explicitly approve each Pin for publishing

We access Pinterest data in real time via the Pinterest API v5 each time it is needed. In accordance with Pinterest's Developer Guidelines, we do not store Pinterest API data beyond what is operationally necessary to complete a publishing action you have initiated. We do not store Pin content, board data, or analytics from Pinterest beyond your own session.

We only publish to Pinterest when you have explicitly reviewed and approved each piece of content. We do not publish automatically without your deliberate action per Pin.

Legal basis: Consent (you authorise Pinterest access via OAuth) and Contract.

2.4 Instagram and TikTok account data

When you connect your Instagram or TikTok account, the same principles apply as for Pinterest above. We access your account via OAuth authorisation to publish content you have explicitly approved. We access data in real time and do not store social media account content beyond session-level operational necessity.

2.5 Content you create in Pinspark

When you use Pinspark to generate or edit social media captions, we store:

• The AI-generated captions we produce for you
• Any edits you make to those captions before publishing
• Your scheduled posts queue
• A record of posts that have been published (platform, listing, timestamp, status)

We use aggregated, anonymised patterns from your edits to improve the quality of AI-generated captions for your shop over time. This data is not shared with third parties. Raw edit content is deleted after 90 days; only anonymised signal scores (e.g. "this seller prefers shorter sentences") are retained beyond that point.

Legal basis: Contract and Legitimate Interests.

2.6 Material cost and profit data

If you use our profit calculator, you may enter material costs, labour time, and packaging costs. This data is stored in your account and used only to calculate profit figures displayed to you. It is never shared.

2.7 Usage data and cookies

We collect standard technical data when you use Pinspark, including:

• IP address and approximate location (country/region level)
• Browser type and version
• Pages visited and features used within Pinspark
• Error logs and performance data

We use cookies that are strictly necessary for the service to function (authentication session cookies). We do not use advertising cookies or third-party tracking cookies. We use PostHog for product analytics, which processes anonymised usage data only.

Legal basis: Legitimate Interests (operating and improving the service). Strictly necessary cookies do not require consent under UK PECR.

3. How we use your data

We never use your data for advertising purposes. We never sell your data to third parties.

4. Who we share data with

We share data only with the following categories of third-party service providers who help us run Pinspark:

• Stripe — payment processing (UK/EU data residency available)
• Supabase — database hosting (EU data centres)
• Vercel — application hosting (EU data centres)
• Anthropic — AI caption generation via the Claude API. Caption generation requests include your listing data. Anthropic does not use API data to train its models.
• PostPeer — social media publishing middleware. We pass approved post content and your OAuth tokens to PostPeer to complete publishing actions on your behalf.
• PostHog — anonymised product analytics
• Resend — transactional email delivery

All third-party processors are bound by data processing agreements. We do not transfer your personal data outside the UK or EEA without appropriate safeguards (Standard Contractual Clauses or adequacy decisions).

We may disclose data if required to do so by law, court order, or to protect the rights and safety of Pinspark or its users.

5. How long we keep your data

6. Your rights under UK GDPR

As a UK resident, you have the following rights regarding your personal data:

• Right of access — You can request a copy of the personal data we hold about you.
• Right to rectification — You can ask us to correct inaccurate data.
• Right to erasure — You can request deletion of your account and associated data. We will action this within 30 days. Note that billing records must be kept for 7 years under UK law.
• Right to restriction — You can ask us to limit how we use your data in certain circumstances.
• Right to data portability — You can request your data in a structured, machine-readable format (JSON export available from Settings).
• Right to object — You can object to processing based on legitimate interests.
• Right to withdraw consent — Where we rely on consent (e.g. connecting social accounts), you can withdraw it at any time by disconnecting the account in Settings.

To exercise any of these rights, email privacy@pinspark.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

7. Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• All data in transit encrypted via TLS 1.2 or higher
• All data at rest encrypted in our database
• OAuth tokens stored encrypted, never in plain text
• Passwords hashed using bcrypt
• Access to production data restricted to essential personnel only
• Regular security reviews and dependency updates

No system is completely secure. If you believe your account has been compromised, contact us immediately at security@pinspark.co.uk.

8. Children

Pinspark is intended for adults and business owners. We do not knowingly collect personal data from anyone under the age of 18. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

9. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email at least 14 days before the changes take effect and update the "Last updated" date at the top of this page. Continued use of Pinspark after the effective date constitutes acceptance of the updated policy.

10. Pinterest-specific disclosures

Pinspark uses the Pinterest API v5. Our use of Pinterest's API is subject to Pinterest's Developer Guidelines and API Terms of Service.

Specifically:

• We only access your Pinterest account with your explicit authorisation via Pinterest's OAuth 2.0 flow.
• We only use your Pinterest account data to provide Pinspark's service to you.
• We do not store Pinterest API data beyond what is necessary to complete a publishing action you have explicitly approved.
• We do not combine your Pinterest account information with other users' account information.
• We do not share or sell Pinterest API data with third parties.
• Each Pin published to Pinterest requires your deliberate review and approval within Pinspark before it is submitted to Pinterest.
• You may revoke Pinspark's access to your Pinterest account at any time from your Pinterest account settings at pinterest.com/settings/security.