Privacy Policy

1. Introduction

Vynthr ("we", "us", "our") operates Vynthr (the "Service") accessible at https://vynthr.com.

This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and your rights regarding your personal data. By using the Service, you agree to the practices described in this policy.

2. Information We Collect

2.1 Information you provide directly

• Account data: email address and password (hashed) when you register
• Workspace data: niche names, keyword lists, affiliate links, caption preferences you configure
• Content: images and captions you upload directly to the Service
• Communications: messages you send us via email or support channels

2.2 Information collected automatically

• Log data: IP address, browser type, pages visited, timestamps
• Usage data: features used, actions taken (approve / reject queue items), session duration
• Cookies: session cookies required for authentication; no third-party advertising cookies

2.3 Information from third-party integrations

• Pinterest: when you connect a Pinterest account we store your Pinterest user ID, username, and profile image URL, OAuth access and refresh tokens, the identifiers of the boards you select, and per-account and per-pin analytics we retrieve for pins you post through Vynthr (impressions, saves, outbound clicks, and pin clicks)
• Image sources: image URLs and metadata pushed via webhook or API from connected tools
• We do not receive your passwords for any third-party service

3. How We Use Your Information

• To create and manage your account and workspaces
• To operate the pin queue and publish approved content to Pinterest on your behalf
• To re-queue previously posted pins for your review when you enable the evergreen recycler feature — recycled pins are returned to your approval queue and are never auto-published
• To authenticate API requests from connected image sources
• To send transactional emails (password resets, critical service notices) — we do not send marketing email without explicit opt-in
• To diagnose bugs, monitor service health, and improve the platform
• To comply with legal obligations

We do not sell your personal data to third parties. We do not use your content to train AI models.

3a. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases as defined in GDPR Article 6:

• Performance of a contract (Art. 6(1)(b)): account creation and authentication, operating the pin queue, publishing approved pins to Pinterest on your behalf, storing and using OAuth tokens to fulfil the Service, and sending transactional emails necessary to operate your account.
• Legitimate interests (Art. 6(1)(f)): service health monitoring, bug diagnosis, abuse prevention, and platform improvement — where these interests are not overridden by your rights and freedoms.
• Legal obligation (Art. 6(1)(c)): retaining records where required by applicable law and responding to lawful requests from public authorities.

Where processing is based on legitimate interests, you have the right to object. Contact us at hello@vynthr.com to exercise this right.

4. Pinterest Data

When you connect a Pinterest account, we store an OAuth access token to publish pins on your behalf. This token is stored server-side, encrypted at rest, and protected by row-level security so that only your account can use it; it is used exclusively to post content you explicitly approve within Vynthr. We do not read your private messages, contact list, followers, or any Pinterest data beyond what is necessary to post to your selected board.

To show you how your content performs, we also store your Pinterest username and profile image and a history of pin- and account-level metrics (impressions, saves, outbound clicks, and pin clicks) for pins posted through Vynthr. This data is used solely to build analytics for the account that owns it; it is never combined across users, shared, or sold, and it is deleted when you disconnect the account or delete your Vynthr account.

You may revoke Vynthr's access at any time through your Pinterest security settings. Upon revocation, we will no longer be able to post to your account. Deleting your Vynthr account also removes stored tokens within 30 days.

5. Data Storage & Security

Your data is stored using Supabase, a managed database platform. Data is hosted in EU (Frankfurt). Supabase uses encryption at rest and in transit (TLS 1.2+). Our application is hosted on Vercel (global edge network).

We implement row-level security policies so that each user can only access their own data. API keys and OAuth tokens are stored server-side, encrypted at rest, and are never exposed to the client browser.

Despite these measures, no system is 100% secure. We cannot guarantee absolute security of your data transmitted over the internet.

International transfers. Your data is stored in the EU (Frankfurt). However, our hosting and edge-delivery provider Vercel operates a global network, so limited request data and logs may be processed on servers outside the European Economic Area. Where that happens, the transfer is governed by the provider's Data Processing Agreement incorporating the European Commission's Standard Contractual Clauses (GDPR Article 46) as the transfer safeguard.

Incident notification. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it (GDPR Article 33). Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay (GDPR Article 34). Our notice will describe the nature of the breach, the data affected, the likely consequences, and the measures taken or proposed to address it.

6. Data Retention

We retain your account data for as long as your account is active. Rejected pins are retained for 30 days then permanently deleted. Posted pins retain metadata (Pinterest pin ID, caption, image URL) for the life of your account so you can reference your posting history. Server and access logs, including IP addresses, are retained for up to 12 months for security and abuse-prevention purposes, then deleted or anonymised.

If you delete your account, we will permanently delete all associated workspaces, pin queue items, and tokens within 30 days, except where retention is required by law.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you
• Correction: request correction of inaccurate data
• Deletion: request deletion of your account and associated data
• Portability: request your data in a machine-readable format
• Objection / Restriction: object to or restrict certain processing
• Withdrawal of consent: where processing is based on consent, withdraw it at any time
• Complaint: lodge a complaint with a data protection supervisory authority

To exercise any of these rights, email us at hello@vynthr.com. We will respond within 30 days.

You also have the right to lodge a complaint with a data protection supervisory authority. In Hungary this is the National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, “NAIH”), 1055 Budapest, Falk Miksa utca 9-11., naih.hu. If you are located elsewhere in the EEA, you may contact your local supervisory authority.

8. Cookies

We use only strictly necessary session cookies to keep you logged in. We do not use tracking cookies, advertising pixels, or analytics cookies that share data with third parties.

You can disable cookies in your browser settings, but doing so will prevent you from logging in to the Service.

9. Sub-Processors & Third-Party Services

We use the following sub-processors — companies that process personal data on our behalf under data processing agreements:

• Supabase — database and authentication hosting (EU, Frankfurt) · Privacy Policy
• Vercel — application hosting and edge delivery (global CDN) · Privacy Policy

The following are third-party platforms you may optionally connect to the Service. They are not sub-processors of your personal data but may process image content or API requests you initiate:

• Pinterest, Inc. · Privacy Policy
• Ombryth — AI image generation
• OpenAI (DALL·E) · Privacy Policy
• Leonardo.ai — AI image generation
• Midjourney — AI image generation (via webhook)

Each of these services has its own privacy policy. We are not responsible for the data practices of third-party services you choose to connect.

10. Children's Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us at hello@vynthr.com and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify registered users by email and update the "Last updated" date above. We encourage you to review this policy periodically.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact: