← Druid Pin Manager

Privacy Policy

Last updated: May 7, 2026

Druid Pin Manager (operated by MS MODA, "we", "us", "our") is an internal content management platform we built to operate our own portfolio of fashion brands on Pinterest. This Privacy Policy explains what data we collect, how we use it, and how we protect it.

1. Information We Collect

The platform handles a narrow set of data:

• OAuth access & refresh tokens — issued by Pinterest when one of our own brands authorizes the platform. Tokens are stored encrypted server-side and used only to publish to and read analytics from the brand's own Pinterest account.
• Pinterest account metadata — username, account ID, board names and IDs of our own brands. Pulled from Pinterest's API after OAuth.
• Content we publish — pin titles, descriptions, hashtags, source images, scheduled times, and the Pinterest pin IDs returned after publish. All content originates from our own product catalogs.
• Pin analytics — aggregated impressions, saves, clicks, and outbound visits returned by the Pinterest API for our own published pins.
• Operational logs — timestamps of API calls, success/failure status, retry counts. Used internally for debugging and monitoring.

What we do not collect: we do not collect data about Pinterest users who view, save, or interact with our pins beyond the aggregate analytics Pinterest itself provides. We have no access to other people's Pinterest accounts, follower lists, or private boards.

2. How We Use Your Information

We use the collected data exclusively to:

• Schedule and publish pins to our own Pinterest business accounts
• Read pin performance data for our own pins to inform future content decisions
• Manage boards (list, create) on our own Pinterest accounts
• Maintain operational logs for debugging and rate-limit management
• Refresh OAuth tokens when they expire so the platform continues operating

3. Pinterest API Integration

The platform uses the Pinterest API v5 with the following scopes, on accounts we own:

• user_accounts.read — verify connected account identity after OAuth
• boards:read — list boards for assignment
• boards:write — create new boards on our own accounts when launching collections
• pins:read — verify pins after publish, read analytics
• pins:write — publish approved pins to our own boards

Our use of Pinterest data complies with Pinterest's Developer Guidelines, API rate limits, and Pinterest's Privacy Policy. Tokens are refreshed automatically and revocable from the brand's Pinterest settings at any time.

4. Data Sharing

We do not sell, rent, or share data collected through this platform. Specifically:

• We do not transmit Pinterest data to third parties
• We do not use Pinterest data for advertising
• We do not provide Pinterest data to data brokers, analytics aggregators, or AI training datasets
• The platform is single-tenant from a data-flow perspective: each of our brands' data is scoped to that brand only and never crosses into other brands' workspaces

5. Service Providers

The platform runs on infrastructure we operate or contract directly:

• Hosting — VPS hosting in the European Union for the platform application and database
• SSL/TLS — Let's Encrypt for HTTPS certificates
• Pinterest API — direct calls to api.pinterest.com on behalf of our own accounts
• AI text generation — Anthropic Claude API for generating pin titles and descriptions from our own product data; no Pinterest user data is sent

6. Data Retention

Operational data is retained as long as needed to run the platform:

• OAuth tokens — until revoked by the brand or replaced by a new authorization
• Published pin records — retained for analytics history (no expiration)
• Logs — rotated after 90 days

7. Your Rights (GDPR)

If you are an end user (a Pinterest viewer who interacts with our pins) and have questions about data Pinterest provides to us about your interactions, please contact Pinterest directly — they are the data controller for that information.

If you are an authorized operator of one of our brands, you have the right to:

• Access the data the platform holds about your brand account
• Request correction of inaccurate data
• Request deletion of your brand's data and disconnect the Pinterest account
• Withdraw OAuth authorization at any time from Pinterest's app settings

8. Data Security

We implement appropriate technical and organizational measures to protect data:

• HTTPS-only access (TLS 1.2+) to the platform
• OAuth tokens stored server-side, never exposed to the browser
• Database access restricted to the application service account
• Operating-system patches applied regularly
• No raw passwords ever collected or stored — Pinterest authentication is OAuth-only

9. Third-Party Links

Pages on this site may link to Pinterest, our brand websites, and external documentation. We are not responsible for the privacy practices of those external sites. Each operates under its own privacy policy.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected in the "Last updated" date at the top of this page.

11. Contact

For any questions regarding this Privacy Policy or to exercise data rights, contact us: