Let's Pin This is a service operated by Manmade, a business based at Morkullegatan 1, 432 42 Varberg, Sweden ("Manmade", "we", "us"), trading as "Let's Pin This". Manmade is the data controller for the personal information described in this policy. Let's Pin This helps Etsy sellers and small business owners create AI-generated Pinterest and Instagram pin images and publish them to their connected social accounts. This Privacy Policy explains what we collect, how we use it, the legal basis on which we process it, and the choices you have.
Information we collect
- Account information — your name, email address, and profile photo when you sign in.
- Uploaded product images you provide to generate pins.
- Generated pin images created on your behalf and stored in your library.
- Product and listing information you enter (titles, descriptions, links, audience, benefits).
- Brand settings such as colors, fonts, design style, reference images, CTAs, and brand notes.
- Pinterest and Instagram account connection data, including the account ID and username you connect.
- OAuth access and refresh tokens required to publish content to Pinterest and Instagram on your behalf. Tokens are stored server-side and never exposed to your browser.
- Subscription and payment status from our payment processor. Paddle.com Market Limited ("Paddle") acts as our Merchant of Record and processes all payments, billing, tax, invoicing, and refunds on our behalf. We do not store full card numbers.
- Usage data such as image generations, revisions, and publish history, used to enforce plan credits and improve the service.
How your data is used
- To generate pin images from your uploads and brand settings.
- To publish content to Pinterest or Instagram when you choose to.
- To run your account, subscription, and credit balance.
- To diagnose issues, prevent abuse, and improve reliability and quality.
Legal basis for processing (UK/EEA users)
- Contract — we process your account, uploads, brand settings, generated images, and social connection tokens to provide the service you signed up for.
- Legitimate interests — we process usage data and diagnostic information to keep the service secure, prevent abuse, and improve quality.
- Consent — where you connect a Pinterest or Instagram account, you consent to us publishing on your behalf. You can withdraw consent at any time by disconnecting the account.
- Legal obligation — we retain billing and tax records as required by law.
Service providers we use
- OpenAI — image generation via the GPT Image API. Your prompt and reference images are sent to OpenAI to produce the result.
- Supabase — authentication, database, file storage, and server-side functions.
- Paddle.com Market Limited — our Merchant of Record. Paddle processes all subscription payments, billing, sales tax / VAT, invoicing, and refunds. When you buy a plan, Paddle collects the billing information required to complete the sale under its own Buyer Terms and privacy notice.
- Pinterest and Meta / Instagram — only when you connect those accounts and ask Let's Pin This to publish or schedule a post.
International data transfers
Some of our service providers (including OpenAI, Supabase, and Paddle) process personal data outside the European Economic Area, including in the United States and the United Kingdom. Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision, in line with GDPR requirements.
Publishing to your social accounts
Let's Pin This only publishes content to Pinterest or Instagram when you explicitly click Publish or schedule a post. You can disconnect your Pinterest or Instagram account at any time from the Social Connections page, which revokes our stored tokens.
Data retention and deletion
We keep your account data, uploads, generated images, and publish history for as long as your account is active. You can request account deletion at any time by emailing support@letspinthis.com. We will delete your account, uploaded images, generated images, brand profiles, and social connection tokens, subject to records we are required to retain for billing, tax, or legal reasons (typically up to 7 years for Swedish accounting law).
Security
We apply appropriate technical and organisational measures to protect personal data, including encryption in transit, role-based access controls, and row-level security on our database. Access and refresh tokens for Pinterest and Instagram, along with our API keys, are stored as server-side secrets. They are never embedded in the browser bundle and are not returned to the client.
Your rights under GDPR
If you are in the UK or EEA, you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Erasure ("right to be forgotten"), subject to legal retention obligations;
- Restrict processing in certain circumstances;
- Portability — receive a copy of the data you provided in a common format;
- Object to processing based on legitimate interests;
- Withdraw consent at any time, without affecting prior lawful processing;
- Complain to a supervisory authority — in Sweden, the Swedish Authority for Privacy Protection (IMY, imy.se).
To exercise any of these rights, email support@letspinthis.com. We will respond within one month.
Cookies
Let's Pin This uses only strictly necessary cookies and local storage required to keep you signed in and to run the application (for example, your authentication session and UI preferences). We do not use advertising cookies. If we add analytics cookies in the future, we will update this policy and ask for your consent where required.
Your choices
- Disconnect Pinterest or Instagram at any time.
- Delete individual pins, brand profiles, and reference images.
- Request full account deletion by email.
Contact
Questions about this policy or your data? Email support@letspinthis.com, or write to Manmade, Morkullegatan 1, 432 42 Varberg, Sweden.
This page is maintained by the Let's Pin This team and may be updated from time to time. Continued use of the service after an update constitutes acceptance of the revised policy.