Privacy Policy

1. Introduction

Pinforge (also known as Pinterest Money Machine) is a SaaS tool that helps creators and marketers automate Pinterest content creation and publishing. It is operated by Pinforge and accessible at https://pinforge.net.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have over it. By creating an account or using our service you agree to this policy.

If you have questions about anything in this policy, email us at [email protected]. We respond within 30 days.

2. What data we collect

Account data — When you register we collect your email address and a hashed version of your password. We never store your password in plaintext.

Payment data — Payments are handled entirely by Stripe. We never see or store your card number, CVV, or full payment details. We receive a Stripe customer ID and subscription status so we know which plan you are on.

Pinterest data — When you connect a Pinterest account, you authorise us to receive an API access token via Pinterest OAuth. We store this token (encrypted) to post pins on your behalf. We also fetch your board names and IDs via the Pinterest API to let you choose where to post.

Content data — We store the pin titles, descriptions, image paths, and affiliate links that you create or that we generate for you. This is the core content the service produces.

Usage data — We record how many pins you have posted, your AI credit consumption, login timestamps, and other service-usage metrics. This lets us enforce plan limits and show you analytics.

Technical data — Our servers record standard access logs including your IP address, browser user-agent, and the pages you visit. These logs are retained for 90 days.

Cookie data — We use session cookies for authentication and optional affiliate referral cookies (see Cookies section).

3. How we use your data

• To operate the service — authenticating you, posting pins on your behalf, storing your content, enforcing plan limits.
• To process payments — we pass billing information to Stripe and receive webhooks about subscription changes.
• To send transactional emails — account verification, password reset, payment receipts, and usage alerts. We use Resend for email delivery.
• To track affiliate referrals — if you arrive via a referral link we store a cookie so the referring partner can receive their commission.
• To prevent abuse — rate limiting, fraud detection, and enforcing terms of service.
• To improve the service — aggregate, anonymised usage patterns help us understand what features to build and fix.

4. Third-party services

We share data with the following providers only to the extent necessary to deliver the service. Each has its own privacy policy:

5. Data storage and security

• All data is stored on servers in the European Union (Hetzner, Germany and Finland).
• Passwords are hashed with bcrypt and never stored in plaintext.
• Pinterest API tokens are encrypted at rest using Fernet symmetric encryption before being written to the database.
• All data is transmitted over HTTPS only. Plain HTTP connections are redirected to HTTPS.
• We perform regular automated backups of the database.

We take security seriously and apply industry-standard practices. However, no service can guarantee absolute security. If you discover a vulnerability please report it to [email protected].

6. Data retention

When you delete your account, all personal data associated with it is permanently deleted within 30 days, except payment records which we are required to retain by law for 7 years.

7. Your rights (GDPR)

Our servers are in the EU and we serve EU users, so the General Data Protection Regulation (GDPR) applies. You have the right to:

• Access — request a copy of your personal data.
• Correction — ask us to correct inaccurate data we hold about you.
• Deletion — request that we delete your account and all personal data (the "right to be forgotten").
• Objection — object to us processing your data in certain ways.
• Portability — receive your data in a machine-readable format.
• Withdraw consent — where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

8. Cookies

We use the following cookies:

We do not use advertising cookies, third-party tracking pixels, or analytics cookies (such as Google Analytics).

Session cookies are strictly necessary for the service to function and do not require your consent. Affiliate cookies are set only if you arrive via a referral link.

9. Children

Pinforge is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has created an account on our platform, please contact us at [email protected] and we will delete the account promptly.

10. Changes to this policy

We may update this policy from time to time. When we do, we will:

• Update the "Last updated" date at the top of this page.
• Send registered users an email notification of material changes.

Continued use of the service after changes are published constitutes your acceptance of the updated policy.

11. Contact

For any privacy-related questions, requests, or concerns:

• Email: [email protected]
• Response time: Within 30 days
• Website: https://pinforge.net