1. Who We Are

Pynov ("Pynov," "we," "us," or "our") operates the website and application at getpynov.com (the "Service"), a tool for creating Pinterest content in batches with AI assistance and publishing or scheduling it to a connected Pinterest account.

• Data controller / operator: Leonardo Carlos Moncada Luaces, a sole proprietor operating as "Pynov"
• Physical address: 260 NW 41 Ave, Miami, FL 33126, USA
• Privacy contact email: legal@getpynov.com

This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices and rights you have. By using the Service, you agree to this Policy.

2. Information We Collect

2.1 Account information

When you create an account, we collect your email address and the information needed to run your account (such as your name, if you provide it, and your authentication credentials, which are managed by our authentication provider, Firebase Authentication). If you sign in with a third-party identity provider, we receive the basic profile information that provider shares with us.

2.2 Content you provide and generate

To operate the Service we process the content you create with it, including:

• Briefs, prompts, and campaign settings you enter;
• Product photos and other images you upload;
• Destination links, pin titles, descriptions, and keywords;
• AI-generated images and copy produced for you;
• Your pin history, drafts, and publishing schedules.

2.3 Pinterest connection data

When you connect your Pinterest account, Pinterest's authorization flow gives us access tokens and basic information about your Pinterest account (such as your Pinterest username and your boards) so we can display your boards and publish or schedule pins at your direction. We also read and synchronize pins and their performance metrics (impressions, saves, pin clicks, and outbound clicks), where Pinterest makes them available for your connected account, to display performance insights. We store the access tokens needed to keep the connection working until you disconnect or the token expires or is revoked by Pinterest.

2.4 Payment information

Paid subscriptions are processed by Stripe. Your card number and other payment details are collected and processed directly by Stripe; we do not receive or store your full card number on our systems. We receive and store limited billing records from Stripe, such as your subscription status, plan, the last digits or brand of your card as reported by Stripe, and invoice/charge records needed for accounting and support.

2.5 Usage and technical information

We automatically receive limited technical information when you use the Service, such as IP address, browser and device type, pages and actions within the Service, timestamps, error logs, and credit/generation usage records. We use this to operate, secure, and improve the Service and to enforce plan limits.

2.6 Communications

If you contact us (for example, by email), we keep the content of your messages and our replies so we can respond and maintain a support record.

2.7 Other integration credentials and imported content

When you choose to connect an integration, we store its connection identifiers, status and credentials needed for the authorized functions. OAuth tokens and the Mailchimp API key are encrypted by the server before storage; the Mailchimp key is not returned to the browser. A Zapier Catch Hook URL is stored as an integration setting and should be treated as a private destination credential. RSS and public WordPress store the URLs you configure. Imported content and drafts you save may remain in your PYNOV history or settings after disconnecting the source.

Configuring RSS feeds or connecting a Shopify catalog can allow background ingestion to create AI generation jobs from new items, subject to usage and service limits. Prompts and selected/source images used in those jobs are processed by the same AI and infrastructure providers as manual generation. Source ingestion does not itself authorize publication to every connected service.

3. How We Use Information

We use the information above to:

• Create and manage your account and authenticate you;
• Provide the Service: generate images and copy from your inputs, save your work, and publish or schedule pins to your connected Pinterest account at your direction;
• Process subscriptions and payments and maintain billing records;
• Enforce plan limits, credits, and our Terms of Service;
• Operate, secure, troubleshoot, and improve the Service;
• Communicate with you about your account, your subscription, and changes to the Service or our policies;
• Comply with legal obligations and respond to lawful requests.

We do not sell your personal information. We do not use your uploaded or generated content to train our own models; content sent to our AI provider is processed under that provider's terms for providing the generation service (see Section 4).

4. How We Share Information — Our Providers

We do not sell your personal information, and we do not share it for third-party advertising. We share information only with the service providers we need to run the Service, only for the purposes in Section 3, and under those providers' own terms and privacy policies:

We may also disclose information if required by law, court order, or lawful government request; to enforce our Terms; or to protect the rights, safety, and security of our users, ourselves, or others. If the business operating Pynov is sold or reorganized, information may transfer to the successor under this Policy's protections.

5. AI Processing

When you run a generation, your prompts, briefs, and any images you submit for that generation are sent to our AI provider (OpenAI) so it can produce the output. We do not use your content to train our own models. The AI provider processes submitted content under its own terms and API data policies.

6. Cookies and Similar Technologies

We and our providers use cookies and similar technologies that are necessary for the Service to work — for example, to keep you signed in, remember your session and preferences, and keep the Service secure. Our hosting and authentication providers may set their own strictly necessary cookies for those functions. Firebase Analytics is optional and starts only after you accept analytics in the consent banner (or if you previously accepted). Before that choice, it does not initialize analytics cookies or device identifiers; if you decline, it stays off. If we later add advertising cookies, we will update this Policy and, where required, ask for your consent before using them.

7. Data Retention

We keep personal information only as long as needed for the purposes in this Policy:

• Account information, imported content, saved drafts and connection settings are retained while needed to provide the account features. Disconnecting a source removes its primary connection record, subject to the exceptions below; it does not remove content already imported or posts already sent to a third-party platform.
• Pinterest, Instagram and TikTok disconnect attempt provider token revocation and remove the local connection even if the provider cannot confirm revocation. Google Drive and Shopify disconnect remove their primary local credential records; they do not implement provider-side revocation. Shopify also retains a global shop-domain-to-owner identifier binding after disconnect and account deletion; automatic cleanup or expiry of that binding is not currently implemented. Mailchimp disconnect deletes the encrypted key record; it does not revoke the API key at Mailchimp. Remove provider grants or revoke keys in the provider account if you also want to invalidate them there.
• WordPress disconnect removes its saved source connection. Removing an RSS feed or Zapier setting stops its future use by that configuration; it does not erase earlier imported results, queued jobs or data already received by another service.
• Account deletion attempts to remove the account, its discovered user subcollections, ordinary generation jobs identified by userId, and storage objects covered by its ownership-aware cleanup. Server-issued image-generation/edit jobs identified by ownerUid and their generation-jobs objects are included only after the server confirms that their Storage writers have stopped. If that proof is unavailable, including for legacy jobs or an unconfirmed Storage write, deletion is paused for reconciliation rather than reporting those records and files deleted. Contact legal@getpynov.com to request review of retained data. Cleanup is not atomic across services: failures are recorded for retry, unresolved generation/billing obligations can delay deletion, and legacy shared assets without verified ownership are retained instead of deleting another user's data.
• After settled generation attempts are reconciled during deletion, minimal hashed replay-prevention records can remain without the plain user/run identifiers or result fields. Unresolved accounting, cost, security, legal and cleanup records are retained while needed. The current implementation does not enforce one automatic fixed retention period for all technical logs, billing records and third-party copies; provider-held data is also subject to the provider's own retention and deletion controls.

8. Security

We use reasonable technical and organizational measures to protect information, including encrypted connections (HTTPS), access controls, and reputable infrastructure providers. Pinterest access is handled with OAuth tokens — we never see or store your Pinterest password — and payment details are handled by Stripe — we never see or store your full card number. No system is perfectly secure, and we cannot guarantee absolute security.

9. Your Rights and Choices

Depending on where you live (including under the GDPR and the CCPA/CPRA, where they apply), you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Delete your information and your account;
• Export / portability — receive a copy of your information and your generated content;
• Object to or restrict certain processing, and withdraw consent where processing is based on consent;
• Not be discriminated against for exercising your privacy rights.

To exercise any of these rights, email legal@getpynov.com from your account email. We will verify your request is really yours and respond within the time required by applicable law. You can also disconnect Pinterest at any time from the Service or your Pinterest settings, which stops further access through that connection.

10. Children's Privacy

The Service is intended for adults running businesses or creator accounts. It is not directed to children under 13 (or under 16 where that is the applicable age), and we do not knowingly collect their personal information. If you believe a child has provided us information, contact legal@getpynov.com and we will delete it.

11. International Transfers

Our providers may process and store information in the United States and other countries. If you use the Service from outside the United States, your information will be transferred to and processed in countries whose data-protection laws may differ from your own, under the safeguards offered by our providers' terms.

12. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will give reasonable notice (for example, by posting the updated Policy on our website or in the Service, or by email) before they take effect, and we will update the "Last updated" date. Continued use of the Service after the effective date means you accept the updated Policy.

13. Contact

Privacy questions or requests: legal@getpynov.com Operator / data controller: Leonardo Carlos Moncada Luaces (sole proprietor, operating as "Pynov"), Miami, FL, USA. (Full postal address: Section 1.)