Privacy Policy

Pin-Up Studio · operated by Pin-Up Marketing LLC · Last updated July 29, 2026 · Contact: marketing@pinupmarket.com

1. Who we are and what Pin-Up Studio does

Pin-Up Studio (the "Service") is a business marketing suite that helps companies plan, create (including with AI), approve, schedule, and publish marketing content — social posts, images, videos, emails, text campaigns, and product feeds — to accounts the business connects (such as Facebook, Instagram, Threads, TikTok, LinkedIn, and Google Business Profile), and reports on results. This policy explains what we collect, why, and the choices you have. The Service is for businesses; we process much of the data below on behalf of the business that opened the account.

2. Information we collect

Account details — name, email address, business name, password (stored only as a salted hash), and two-factor authentication secret (stored encrypted).
Business content — posts, captions, images, videos, inventory and product feeds, brand profiles, logos, offers, and campaign settings you add.
Connected-platform data — when you connect a social or business account (Meta, TikTok, LinkedIn, Google, and others), we store the access tokens those platforms issue (encrypted at rest), the pages/profiles you select, basic profile metadata (names, IDs, avatars), and the engagement metrics those platforms report for your own content.
Billing — payments are processed by Stripe; we never see or store full card numbers, only Stripe customer/subscription references and billing status.
Customer lists you upload (names/phone numbers for text campaigns) — stored encrypted and used only to send the messages you initiate.
Usage and device data — log data such as IP address, browser type, pages viewed, and actions taken; and, where enabled, session analytics collected by Microsoft Clarity (interaction heatmaps and session replays) to improve the product. Clarity's processing is described at clarity.microsoft.com.

3. How we use information

To operate the Service you signed up for: generating and scheduling content, publishing to the accounts you connected, importing and transforming your product feeds, sending the campaigns you initiate, measuring results, billing your subscription, securing accounts, providing support, and improving the product using aggregated or de-identified usage data. We do not sell personal information and we do not use your data for third-party behavioral advertising.

4. AI processing

Content you request is generated by third-party AI providers — OpenAI (text and images) and Google (video) — using only the material needed for the request (your brief, brand rules, product data, and reference imagery). These providers process API content under their own terms and, per their published API policies, do not use API data to train their models.

5. Connected-platform commitments (Meta, TikTok, LinkedIn, Google)

Data received from connected platforms is used only to provide the features you request — publishing the content you approve and reporting on your own accounts. We do not sell platform data, use it for advertising to third parties, or combine it across customers. Tokens and platform data are retained only while the connection is active: disconnecting an account revokes and deletes its stored tokens, and deleting your workspace deletes the associated platform data. Our use of information from Google APIs adheres to the Google API Services User Data Policy, including Limited Use. You can revoke Google access at myaccount.google.com/permissions, and TikTok access from your TikTok app settings under Security → Apps and services.

6. Sharing

We share data only with the service providers that make the product work, each only to the extent needed: Google Cloud (hosting, storage, video generation), OpenAI (AI text and image generation), Stripe (payments), Twilio (text messages you send), Microsoft Clarity (product analytics), and the platforms you explicitly connect (Meta, TikTok, LinkedIn, Google, and others) in order to publish and report. We may also disclose information when required by law, to protect the Service and its users, or as part of a merger or acquisition (with notice).

7. Cookies

We use strictly necessary cookies for sign-in sessions and security. Analytics (Microsoft Clarity) may set cookies or use similar technologies to distinguish sessions; these are used for product improvement, not cross-site advertising.

8. Retention & deletion

Your data stays while your account is active. Disconnecting a platform removes its stored tokens immediately. You may request deletion of your organization and all its data by emailing marketing@pinupmarket.com from an owner account — verified requests complete within 30 days, except records we must retain for legal, billing, security, or tax purposes. Backups age out on a rolling schedule.

9. Security

All traffic is encrypted in transit (TLS). Sign-in requires a password plus an authenticator code. Platform tokens, two-factor secrets, API credentials, and uploaded customer lists are encrypted at rest. Each organization's data is isolated from every other organization, and production access is limited to authorized personnel.

10. Your rights

Depending on your location, you may have rights to access, correct, export, delete, or restrict processing of your personal information (including under GDPR and state privacy laws such as the CCPA). Contact us and we will honor applicable requests within the legally required time. We do not discriminate for exercising privacy rights. If you are in the EEA/UK, our legal bases are contract performance (providing the Service), legitimate interests (security, product improvement), and consent where required.

11. International transfers

We operate from the United States and store data on Google Cloud infrastructure in the US. Where data originates from other regions, we rely on appropriate safeguards such as standard contractual clauses offered by our providers.

12. Children

The Service is for businesses and is not directed to anyone under 18; we do not knowingly collect information from children.

13. Changes

We will post updates to this policy here with a new effective date; for material changes we notify account owners by email or in-product notice.