Privacy policy
This policy explains what information ENGINEROOM holds, why, and what you can ask us to do with it. It covers the ENGINEROOM service and this website.
Who we are
ENGINEROOM is run by Elis Tyre, trading as ENGINEROOM, in the United Kingdom. We are the data controller for the information described here.
For anything about your data, including requests under UK data protection law, email hello@getengineroom.co.uk.
What we collect
Your contact and account details
Your name, email address, business name and website, so we can run the service and talk to you about it.
Pinterest connection
When you connect Pinterest, you sign in on Pinterest's own site and choose to grant ENGINEROOM access. We never see or store your Pinterest password. Pinterest gives us:
- an access token and a refresh token, which let us act on your account within the permissions you granted;
- your Pinterest username, and the names and IDs of your boards.
We ask for permission to read and write to your boards, read your pins, create pins, and read your basic account details (such as your username). Pinterest requires board write access to add a pin to a board, and we use your username only to show which account is connected. We use these permissions only to publish pins you have approved to the boards they were written for. We don't delete or rename your boards.
If we add Instagram publishing later, the same approach will apply: sign-in on Instagram's own site, tokens stored encrypted, and use limited to publishing content you have approved. We will update this policy before that happens.
Dropbox asset access
You share a Dropbox folder of product images with us. We read file names and folder paths to choose images, and create short-lived links so Pinterest can fetch an image at the moment it is published. We do not edit, move or delete your files.
Content and approval records
The pins we generate (titles, descriptions, alt text, links, boards and image references), your decision on each one with the time it was made, and publishing records (Pinterest pin IDs, times, and any errors).
Fit Check applications
If you apply for a Fit Check on our home page, we collect your name, email address, your shop's and Pinterest profile's web addresses, what you sell, roughly how many products you have, and anything else you choose to tell us. We use it only to decide whether ENGINEROOM suits your shop and to reply to you. It is stored with our hosting provider, and a copy is emailed to our own inbox.
This website
We do not use analytics or advertising cookies. While you connect an account we set one short-lived security cookie, which stops other sites from forging the connection request. It expires within minutes. Our hosting provider keeps standard server logs, such as IP address and request time, for security.
How we use it, and why we're allowed to
- To provide the service you asked for: generating, showing you, and publishing pins. The legal basis is our contract with you.
- To keep a record of approvals, so there is a clear account of what you approved and when. The legal basis is our legitimate interest in running the service accountably, and yours in knowing nothing is posted without your say.
- To reply to a Fit Check application. The legal basis is taking steps you asked for before a possible contract.
- To keep the service secure and to meet legal obligations, such as keeping business records.
We do not sell your information, use it for advertising, or use your content to train AI models.
Who we share it with
We use a small number of providers to run the service. Each acts on our instructions and only receives what it needs.
- Cloudflare: hosts this website and the service, and stores the encrypted tokens and pin records.
- Anthropic: the AI model that drafts pin text. It receives your brand brief, image file names and paths, and recent pin titles. Under its commercial terms it does not use this data to train its models.
- Google: hosts the approval sheet you use to review pins, and our email inbox.
- Dropbox: where your images stay.
- Pinterest: where your approved pins are published.
Some of these providers are based in, or process data in, the United States. Where that happens, we rely on the UK–US data bridge where the provider is certified under it, and otherwise on the UK International Data Transfer Addendum.
How we protect it
Pinterest tokens (and any future platform tokens) are encrypted with AES-256 before they are stored, and the encryption key is held separately from the database. All traffic uses HTTPS. Only the operator of ENGINEROOM can access client data.
How long we keep it
- Platform tokens: while your account is connected. When you disconnect, leave the service, or revoke our access in Pinterest, we delete them within 7 days.
- Content and approval records: for as long as you use the service, then for up to 6 years, because they are our record of what was approved and published. You can ask us to delete them sooner (see below).
- Contact details: while you are a client, and for up to 6 years afterwards for business and tax records.
- Fit Check applications: deleted after 6 months unless you become a client.
- Server logs: up to 30 days.
Your rights and deletion
You can ask us to show you the information we hold about you, correct it, delete it, restrict or object to how we use it, or give it to you in a portable format. Email hello@getengineroom.co.uk and we will respond within one month.
If you ask us to delete your data, we delete your tokens, content and records, except for anything we are legally required to keep, and we tell you what, if anything, remains.
You can also revoke ENGINEROOM's access at any time from your Pinterest account settings. We stop publishing immediately once access is revoked.
Complaints
If you are unhappy with how we have handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
Changes
If we change this policy in a way that matters, we will tell clients by email before the change takes effect. The date at the top shows when it was last updated.