Privacy Policy

1. Who we are

Bloomtack (the “Service”) is a product operated by Outdated Digital LLC, a Wyoming limited liability company with its address at 30 N Gould St Ste R, Sheridan, WY 82801, USA (“Outdated Digital LLC”, “Bloomtack”, “we”, “us” or “our”).

This Privacy Policy explains how we collect, use, store, share and delete information when you visit bloomtack.com (the “Website”), join our waitlist, or use the Service. For the purposes of the EU and UK General Data Protection Regulation (GDPR), we are the controller of the personal data described here. If you have questions, email support@bloomtack.com.

2. Information we collect

Information you give us

• Waitlist. If you join a waitlist on the Website, we store your email address, which waitlist you joined (the general waitlist or the Founding Member waitlist), where on the Website you joined, and the date and time. We use them only to email you when it opens. They are stored in Cloudflare’s data storage (Workers KV, section 7). We do not store your IP address with them; to limit abuse, a one-way hash of it is kept for one hour. To be removed, email support@bloomtack.com.
• Messages. If you email us, we receive your email address and anything you choose to include in your message.
• Contact form. If you use the form on the Contact page, we receive your name, your email address, the topic you pick and your message. We use them only to answer you. The Website’s Cloudflare Worker keeps them in Cloudflare’s data storage (Workers KV) for at most 30 days, and deletes them as soon as they have reached our support system; there they become a support ticket in the Bloomtack back office, which our support staff read and which is kept like the other support messages (section 7). To limit abuse we keep a one-way hash of your IP address for one hour, never stored with the message. To have your message and ticket deleted, email support@bloomtack.com from the address you gave in the form, with the topic and the date, and we will delete them within 30 days.
• Account information. Your name, email address and sign-in details, which are handled by our authentication provider. If you use single sign-on (for example, Google), we receive your name and email address from that provider.
• Blog and brand information. Your blog’s URL, feeds, sitemaps and CSV uploads; the posts we import (titles, URLs, excerpts, headings, featured images and SEO focus keywords); and your brand kit (logo, colors and fonts).
• Content you create or edit in the Service. Pin designs, pin titles and descriptions, schedules, settings and your approval decisions.
• Pins you upload (Bring your own pin). If you upload a finished pin of your own, an image (up to 20 MB) or a video (up to 100 MB), we store the checked file (for a video, also a cover image cut from it) and a record of the upload: its file name, size and type, who uploaded it and when. We also store the title, description, destination link, board and alt text you give the pin. We use the file only to check it, show it back to you and publish the pin you scheduled. It is sent to Pinterest, with those texts, only when the pin is published at its slot, never earlier. Your data export lists the pin and its texts but does not contain the image or video file, so keep your original. Section 6 says how we check uploads and section 10 how long they are kept.
• Billing information. When you buy a plan (Starter, Pro, Business, Agency or Enterprise), payment is handled by our payment processor or the marketplace where you bought it. We receive your plan, billing status, billing country and the last four digits of your card, but never your full card number.
• Support. Information you give us when you contact support.

Information collected automatically

• Sign-in and session records. For security and to prevent misuse, we keep a record of each sign-in and session: the IP address, the approximate location worked out from it (country, region and city, and coordinates rounded to about 11 km), the device type, the browser and operating system, a one-way hash of the browser’s identifying text (its user agent) so repeat visits from the same browser count once, and the time. The coordinates let us spot sign-ins from places too far apart to be the same person. Kept for as long as your account exists, and deleted when you delete your own account; if you were banned, only a minimal marker of the ban stays. These records are never sold and never used for advertising. Legal basis: our legitimate interest in keeping accounts secure and preventing misuse.
• Service logs. IP address, browser type, device type, pages or actions used within the Service, timestamps and error reports. We use these to keep the Service secure, diagnose problems and understand which features are used.
• Free tools. The free tools on bloomtack.com work in your browser and need no account. An image you pick in the pin size checker or the pin preview never leaves your browser. The Rich Pin and meta checker is the one tool that contacts us: it sends the web address you type to Bloomtack, and Bloomtack fetches that public page, as BloomtackToolsBot, to read its tags. We keep the result for 5 minutes so a repeat check is instant, and a counter keyed to a one-way hash of your IP address for up to an hour to limit abuse; we store nothing else, and the page content is never kept or returned.
• Website. The Website sets no advertising or tracking cookies. Our hosting and security provider processes standard request data (such as IP address and user agent) to deliver pages and protect against abuse.

Information from third parties

• Pinterest. If you connect a Pinterest account, we receive the data described in section 3.
• Your blog. If you install our WordPress plugin or provide a feed or sitemap, we receive the public content of your posts.

3. Pinterest data we access

Bloomtack connects to Pinterest only through Pinterest’s own API, and only after you authorize it on Pinterest’s own OAuth screen. The exact permissions requested are shown on that screen before you approve. We never ask for, receive or store your Pinterest password, and we never automate the Pinterest website or app.

With your authorization, we access the following Pinterest data:

Our Pinterest data commitments.

• We use Pinterest data only to provide the features you use in Bloomtack.
• We never sell Pinterest data or share it with advertisers or data brokers.
• We never use Pinterest data to train, fine-tune or improve any AI or machine learning model, and we never include it in prompts sent to AI providers.
• We never combine one customer’s Pinterest data with another customer’s. A/B testing runs on each account separately.
• We never scrape Pinterest, and we never automate follows, saves of other people’s pins, comments or messages.
• We follow the Pinterest Developer Guidelines and respect Pinterest’s rate limits.

4. How we use information

We use information to:

• provide the Service: import your posts, generate pin designs and copy, run your review queue, schedule and publish approved pins, and show analytics;
• create and secure your account, including sign-in, fraud prevention and abuse detection;
• process payments and manage your plan;
• send service emails, such as security notices, publishing errors and weekly summaries you’ve turned on;
• respond to support requests and waitlist messages;
• diagnose problems and improve the reliability and usability of the Service, using aggregated or de-identified usage data (never Pinterest data for AI training);
• comply with legal obligations and enforce our Terms of Service.

If you joined the waitlist, we use your email address only to tell you when access opens and about launch pricing. You can ask us to remove you at any time.

Legal bases (EEA and UK users). We process personal data to perform our contract with you; for our legitimate interests in running, securing and improving the Service, including keeping accounts secure and preventing misuse with the sign-in and session records; with your consent (for example, when you connect Pinterest or join the waitlist), which you can withdraw at any time; and to comply with legal obligations.

5. AI features and your own AI keys

Bloomtack has no AI model of its own. AI features, such as AI-written titles and descriptions, AI images and AI video, run only on an AI provider key that you connect (for example OpenAI, Google Gemini, OpenRouter or Anthropic). Without a key, Bloomtack works with template copy and your post’s own images.

When you use an AI feature, we send the relevant text of your blog post (such as its title, headings, excerpt and focus keyword), or a prompt built from it, to the provider you chose. It is processed under your own account with that provider and its terms, including its rules on training. We never send your Pinterest data, access tokens or account details. Your AI keys are encrypted at rest (see section 6), and you can delete them at any time in Settings.

6. Storage and security

• Encryption in transit. All connections to the Website, the Service and the Pinterest API use TLS (HTTPS).
• Encryption at rest. Pinterest access and refresh tokens, and any API keys you provide, are encrypted with AES-256-GCM. The encryption keys are kept in a separate secrets manager, outside the database, and are rotated on a schedule. Our databases, file storage and backups are also encrypted at rest.
• Access controls. Only a small number of authorized people can access production systems, using multi-factor authentication and the least access needed for their role.
• Checks on uploads. Every file you upload is checked before anything uses it: its type is read from the file itself, it is scanned for malware, and it is re-encoded. Images lose their embedded metadata (such as camera and location tags). Videos are re-encoded, keeping only the first video and audio stream and no metadata. A file that fails a check is never stored for use. The file you send is held in a private area only while the checks run and is deleted when they end; if that delete fails, a daily job tries again. Checked files are stored privately and reach you only through signed, short-lived links.
• Minimal storage. We store only the Pinterest data listed in section 3 and fetch everything else from Pinterest when it’s needed.

No system is perfectly secure. If we become aware of a security incident that affects your personal data, we will notify you and the relevant authorities as required by law.

7. Sharing and sub-processors

We share information only with service providers that help us run Bloomtack (sub-processors), under contracts that limit their use of the data to providing services to us, and when required by law. Our current sub-processors are:

To suggest images for pin designs, we may send search keywords (never personal data) to stock photo services such as Unsplash, Pexels and Pixabay.

AI providers you connect with your own key are not our sub-processors. They process data under your own agreement with them (see section 5).

We may also disclose information if required by law, subpoena or other legal process; to protect the rights, safety or property of our users, the public or Bloomtack; or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to your information and we will notify you before it becomes subject to a different policy.

We will update the list above before adding a new sub-processor. To be notified of changes, email support@bloomtack.com.

8. We never sell your data

We do not sell personal information, and we do not “share” it for cross-context behavioral advertising, as those terms are defined under California and other US state privacy laws. We do not show ads in the Service, and we do not use Pinterest data for advertising of any kind. We honor Global Privacy Control signals, though since we don’t sell or share data, there is nothing to opt out of.

9. Disconnecting Pinterest

You can disconnect your Pinterest account from Bloomtack at any time, in any of these ways:

1. In Bloomtack: go to Settings, open the Pinterest section and choose Disconnect.
2. In Pinterest: open your Pinterest account settings, find the list of apps that have access to your account, and remove Bloomtack.
3. By email: write to support@bloomtack.com from your account email address and ask us to disconnect your account.

What happens when you disconnect:

• We immediately stop all scheduled pins for that account and revoke our access tokens with Pinterest.
• We delete the Pinterest data we hold for that account from Bloomtack: its access and refresh tokens, board mappings, the pins Bloomtack published for it, their stored results and the totals made from them. If you revoke access from Pinterest’s side, we delete this data within 24 hours of detecting that access was revoked. If you turn analytics off without disconnecting, the stored numbers and design totals are deleted at once.
• Your blog posts, brand kit and unpublished pin designs stay in your Bloomtack account so you can reconnect later, until you delete your account.
• Pins that were already published stay on your Pinterest account. They belong to you, and you can edit or delete them in Pinterest.

10. Data retention and deletion

• Pinterest data: kept only while your Pinterest account is connected. It is deleted when you disconnect, and if you delete your account, Pinterest is disconnected at once and its data is gone within 24 hours. The daily numbers of your pins are kept for at most 13 months.
• Account and blog data: kept while your account is active and deleted within 30 days after you delete your account.
• Generated pin images: images of pins you skip are deleted after 30 days. Images of published pins are removed from our storage after 90 days, since Pinterest hosts the published copy.
• Images and videos you upload as your own pins: the checked file (and a video’s cover image) is kept while the pin waits to be published. You can delete a pin that is not yet published at any time; its file is then removed from our storage and its upload record (file name, size, type, who uploaded it and when) is deleted. Once a pin is published, it can no longer be deleted in Bloomtack (delete it on Pinterest), and its file is removed from our storage 90 days after publishing, like a generated image. A file you never turn into a pin, and the upload record of a published pin, are kept until you delete your account, which removes all of your uploads. Bloomtack does not remove unused uploads automatically, so we promise no shorter period for them.
• Sign-in and session records: kept for as long as your account exists, and deleted when you delete your own account; if you were banned, only a minimal marker of the ban stays.
• Service logs: kept for up to 30 days, unless needed longer to investigate a security issue.
• After a refund: the account is read-only for 30 days so you can export your data, and is then deleted.
• Waitlist emails: kept until access opens or until you ask us to remove you.
• Billing records: kept as long as tax and accounting laws require.
• Backups: deleted data may remain in encrypted backups for up to 30 days, after which those backups are overwritten. Backups are used only for disaster recovery.

Free-trial record: every plan starts with a 3-day free trial. To stop repeated free trials, we keep a keyed hash (a scrambled code that cannot be turned back) of your email address and of your card’s fingerprint, with the date, for 24 months. We do not keep the address or the card itself in this record, and nothing from a Pinterest account is kept after it is disconnected.

You can delete your Bloomtack account at any time in Settings, or by emailing support@bloomtack.com.

11. Cookies

The Website does not set analytics, advertising or tracking cookies. Our hosting and security provider may set strictly necessary cookies to protect the Website from bots and abuse. The Service uses strictly necessary cookies to keep you signed in and to protect your account. We don’t use third-party advertising or cross-site tracking technologies.

12. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy of it in a portable format;
• correct inaccurate data;
• delete your data;
• restrict or object to certain processing;
• withdraw consent at any time, where we rely on consent;
• opt out of the sale or sharing of personal information (we don’t do either);
• not be discriminated against for exercising these rights; and
• lodge a complaint with your local data protection authority.

You can export or delete most of your data yourself in Settings. For anything else, email support@bloomtack.com. We’ll verify your request by confirming it from your account email address, and respond within 30 days. You may use an authorized agent to make a request on your behalf, and we may ask for proof of their authorization. If we decline a request, you may appeal by replying to our decision.

13. International transfers

We are based in the United States, and our providers may process data in the United States, the European Union and other countries. When we transfer personal data from the EEA, UK or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum.

14. Children

Bloomtack is a business tool and is not directed to children. You must be at least 18 years old to create an account. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

15. Changes to this policy

We may update this policy as the Service changes. We’ll post the new version on this page and update the effective date. If a change materially affects how we use your data, we’ll email account holders at least 14 days before it takes effect.

16. Relationship with Pinterest

Bloomtack is an independent product. It is not endorsed by, affiliated with, sponsored by or approved by Pinterest, Inc. “Pinterest” is a trademark of Pinterest, Inc., used only to describe the service Bloomtack connects to. Your use of Pinterest is also governed by Pinterest’s own terms and privacy policy.

17. Contact us

For privacy questions, data requests or complaints, contact: