Privacy Policy
Last updated: October 21, 2026
- We use your Etsy listing data only to write and draw Pinterest pins for you.
- The AI providers we use are told not to store or train on what we send.
- Nothing is posted to Pinterest unless you approve it and upload it (or, with Auto-Publish, schedule it).
- We never sell your data. You can ask us to delete it at any time.
1. Who we are
PinMyListings is a web app made by Sunmesa Labs ("we", "us"). It turns your Etsy listings into Pinterest pins. This policy explains what data the app handles, why, and the choices you have. Questions: randy@sunmesalabs.com.
2. What we collect
| Data | Where it comes from | Why we need it |
|---|---|---|
| Name and email address | Your purchase (WarriorPlus) or your Sunmesa Labs account sign-in | To create your account, let you log in and send account emails (such as your password link) |
| Password | You | To log you in. We only store a one-way hash, never the password itself |
| Purchase details: product, sale ID, status | WarriorPlus purchase notifications | To unlock the plan you bought, and to remove access after a refund |
| Your Etsy shop name and shop ID | You, checked with the Etsy API | To lock the app to your own shop(s) |
| Listing data: title, description, price, tags, materials, photo links, listing link | Etsy's public API, or the CSV file you upload from Etsy Shop Manager | To write pin text and draw pin images |
| Pins you create: text, keywords, boards, schedule, review history | The app and your edits | To show, edit, schedule and export your pins. Review history records who approved each pin, when, and from which IP address |
| Your own OpenRouter API key (optional) | You, in Settings | To write pins with your own AI account. Stored encrypted |
| Technical data: IP address, login attempts, usage counts, emails we sent | Your browser and the app | Security (for example blocking repeated wrong passwords), monthly limits and troubleshooting |
We do not collect payment card details. Payments are handled by WarriorPlus and the payment providers they use. We do not access your Etsy account, orders, buyers or messages: the app only reads listing information that Etsy makes public.
3. How the AI writing works
To write pins, the app sends the listing's title, a shortened description, price, tags and materials, plus the occasion, shoppers and tone you choose, to OpenRouter, which passes the request to an AI model provider (for example Google or OpenAI). We do not send your photos, your name, your email or your shop's sales data.
Every request asks OpenRouter to use only providers that do not store or train on the data (OpenRouter's data collection: deny setting). AI results are saved in your account so the same request does not have to be sent twice. If you add your own OpenRouter key, your requests go through your own OpenRouter account and its settings also apply.
4. Pin images are public links
Pinterest's bulk upload reads each pin image from a web address, so the images the app draws are stored at public addresses with a long random part (for example …/media/pins/<random code>/…jpg). They are not listed anywhere, but anyone who has the exact link can open the image. They show only what you would publish on Pinterest anyway: your product photo and the pin text. We also keep a copy of your listing photos from Etsy's image servers so pins can be redrawn quickly.
With the Agency License you can share a client report through a link with a long random code. Anyone with that link can see the report (the pins, their schedule and your brand details), so only send it to your client. You can replace the link at any time, and the old one stops working.
5. Pinterest
With the standard plans, the app never connects to your Pinterest account: you download a CSV file and upload it to Pinterest yourself.
If you use the Auto-Publish add-on, you connect your Pinterest account through Pinterest's own sign-in (OAuth). We then store an access token, encrypted, and use it only to read your Pinterest username and boards, to create a board when you ask for one, and to create the pins you approved, at the times you scheduled. We do not read your other pins, followers or messages. You can disconnect at any time in the app or in your Pinterest settings, and we delete the token.
6. Cookies
We use only cookies the app needs to work, and no advertising or tracking cookies:
pml_sess: keeps you logged in (session).pml_via,pml_hub_try: remember whether you log in with a password or through your Sunmesa Labs account.pml_pin: remembers whether you pinned or collapsed the sidebar.
7. Who we share data with
We never sell your data or share it for advertising. We only share what is needed to run the app with:
- Our hosting provider, which stores the app, its database and the pin images.
- OpenRouter and the AI model providers it routes to, as described in section 3.
- Etsy, when the app reads your public listings through the Etsy API.
- Pinterest, only if you use Auto-Publish.
- WarriorPlus, which tells us about your purchase.
- The reseller who set up your account, if you bought PinMyListings from one: they can see your email, name, when you last logged in and how many pins you wrote this month, and they can pause your account. They cannot see your listings, pins or password.
- Authorities, if the law requires it.
8. How long we keep data
We keep your account and pins while your account is active, so you can come back to them. Failed-login records are deleted after 24 hours, and logs of sent emails after 12 months. When you ask us to delete your account, we delete your account, shops, listings, pins, pin images and stored keys within 30 days. Copies may stay in backups for up to 30 more days before they are overwritten.
9. Your choices and rights
- See and correct: your listings and pins are in the app. Change your name and time zone in Settings.
- Delete: reject pins you do not want, or write to us to delete your whole account.
- Copy: export your pins as CSV and ZIP at any time.
- Ask: write to randy@sunmesalabs.com for a copy of your data or any privacy question. We answer within 30 days.
Depending on where you live (for example the EU, the UK or California), you may have further rights under local law. We will honour them.
10. Security
The app runs over HTTPS. Passwords are hashed, and API keys and tokens are encrypted. Access to the server is limited to the people who run the app. No system is perfectly secure, so if we learn of a breach that affects your data, we will tell you without undue delay.
11. Children
The app is for sellers and is not meant for anyone under 16. We do not knowingly collect data from children.
12. Changes to this policy
If we change how we handle data, we will update this page and the date at the top. For important changes we will also let you know by email or in the app.
13. Contact
Sunmesa Labs · randy@sunmesalabs.com