Privacy Policy
What HKFlows collects from you, your Etsy shop and your Pinterest account, why, who sees it, how long we keep it and how to exercise your rights.
Effective October 6, 2026
1. Who we are
HK DTS LLC (“HK DTS”, “we”, “us”) is a limited liability company registered in Wyoming, United States. We operate HKFlows (the “Service”): software that turns your Etsy listings into scheduled Pinterest content, and this website. This policy explains how we handle personal data when you visit the website or use the Service.
Privacy questions, complaints and requests: [email protected]. We answer within 30 days and usually much sooner.
2. Our role
We are the controller of the personal data we need to run your account: your name and e-mail address, sign-in and security data, usage logs, billing identifiers we receive from our payment provider, support correspondence and your consent records.
We are a processor for the content you bring from your own shop: listing text and photos, generated pin content and the boards you connect. You decide what to publish and why. If that content contains personal data (for example a person in a product photo), you are the controller and we process it on your instructions, as described in these documents. A data processing agreement is available on request at [email protected].
HKFlows does not read your Etsy orders, buyer messages or customer lists, and we will update this policy before adding any feature that would.
3. Information we collect
Website
The public website does not use analytics, advertising cookies or tracking pixels. Fonts are served from our own domain. Our web server writes standard technical logs (IP address, browser user agent, requested page, time) for security and operation.
Your account
Name, e-mail address and a hashed password, your language, the time zone you pick, the versions of the Terms and this policy you accepted and when, and security data such as sign-in times and two-factor settings.
Etsy (when you connect a shop)
Through Etsy’s official authorization (OAuth) we receive shop information, your listings (titles, descriptions, tags, images, prices, status) and the access tokens Etsy issues. We never see your Etsy password. We keep listing data in sync with Etsy and do not use it for anything except the features you use.
Pinterest (when you connect an account)
Through Pinterest’s official authorization we receive basic account information (such as username and account type), your boards, and the access tokens Pinterest issues. We store the pins we publish for you (title, description, link, image, schedule, the Pinterest pin ID and status). We never see your Pinterest password.
Content we generate for you
Content plans, pin titles and descriptions, rendered pin images and your prompts. They are stored in our database and media storage while your account exists.
Payments
Paid plans are sold by Paddle, our Merchant of Record. Paddle collects your payment details; we do not receive or store card numbers. We receive a customer identifier, your plan and subscription status, the country and the e-mail used for the purchase.
Support
The messages you send us and whatever you include in them.
4. Why we use it, and on what legal basis
| Purpose | Data | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Create and run your account, connect Etsy and Pinterest, generate and publish content | Account, Etsy, Pinterest and generated content | Contract (Art. 6(1)(b)) |
| Enforce plan limits, daily posting limits and the one-trial-per-shop rule | Account, connected account identifiers, usage | Contract and our legitimate interest in preventing abuse (Art. 6(1)(b), (f)) |
| Security, fraud and abuse prevention, fixing errors, server logs | Logs, account and security data | Legitimate interests (Art. 6(1)(f)) |
| Billing, refunds and tax records (handled by Paddle as Merchant of Record) | Billing identifiers, plan, country | Contract and legal obligation (Art. 6(1)(b), (c)) |
| Service e-mails (verification, password reset, quota and publishing notices) | Name, e-mail | Contract (Art. 6(1)(b)) |
| Proving which policy version you accepted | Consent records | Legal obligation and legitimate interests (Art. 6(1)(c), (f)) |
| Marketing e-mail, if we ever send it | Name, e-mail | Consent (Art. 6(1)(a)), withdrawable at any time |
We do not sell personal data. We do not use data from Etsy or Pinterest for advertising, profiling or to train AI models, and we do not combine data between customers.
5. AI-assisted content
To draft titles, descriptions and pin ideas we send listing text, listing images and your prompts to AI model providers through OpenRouter. We send content from your shop and your prompts, not your name, e-mail address or tokens. Those providers act as our sub-processors under their own terms; we do not use your content to train models ourselves.
AI output is a draft. You review and approve it, or, on plans where you enable auto-approval, you accept that approved plans are scheduled without a further review. No decision with legal or similarly significant effects is made by automated means. Where Pinterest asks for it, content created with AI is flagged so that Pinterest can label it.
7. International transfers
HK DTS is a United States company and our team administers the Service from Türkiye. Our providers operate in the United States and other countries. When personal data of people in the European Economic Area, the United Kingdom or Türkiye is transferred to a country without an adequacy decision, we rely on the safeguards the law provides for, such as the European Commission’s standard contractual clauses and the UK addendum, Turkish standard contracts, or a provider’s certification under the EU–US Data Privacy Framework where available.
You can ask us for details of the safeguards for a given provider at [email protected].
8. Security and incidents
Etsy and Pinterest tokens are encrypted at rest (AES-256-GCM). Data travels over HTTPS (TLS 1.2 or newer). Every workspace’s data is kept separate from other workspaces’. Access to production systems is limited to authorized personnel, and administrator actions on customer accounts are recorded in an audit log. No system is completely secure.
If a personal data breach is likely to put you at risk, we notify the competent supervisory authority within 72 hours of becoming aware of it, notify affected users without undue delay where the risk is high, and notify Etsy within 24 hours when Etsy data is affected.
9. How long we keep data
| Data | Retention |
|---|---|
| Account data and generated content | While your account exists; deleted within 7 days after you delete the account |
| Etsy and Pinterest tokens | Deleted immediately when you disconnect an account; if you revoke access on Etsy or Pinterest, deleted as soon as we detect it |
| Etsy listing data and related content for a disconnected shop | Deleted within 7 days of disconnecting |
| Publishing history (pins published, status) | While your account exists |
| Web server and security logs | Up to 30 days |
| Consent records (policy version, time) | While your account exists, then as long as needed to prove consent |
| Billing records | Held by Paddle for as long as tax and accounting law requires; we keep only the identifiers listed above |
| Backups | Deleted data leaves backups as they are overwritten in the normal backup cycle |
Etsy rules also apply: listing data is refreshed from Etsy at least every 6 hours and all other Etsy data at least every 24 hours, and we do not keep it longer than needed to provide the Service.
10. Your rights and choices
Depending on where you live (for example the EEA, the UK, Türkiye or California) you may have the right to access your data, have it corrected or deleted, restrict or object to processing, receive a portable copy, withdraw consent and not be subject to certain automated decisions.
- Use the data export and account deletion tools in your account settings, or disconnect Etsy or Pinterest at any time to revoke our access: the tokens are deleted at once and the Etsy listing data of a disconnected shop within 7 days.
- Or e-mail [email protected] from the address of your account. We may ask you to confirm your identity first and answer within one month (30 days under Turkish law).
- Revoke access on the platform as well: Etsy under Account settings → Security → Apps; Pinterest under Settings → Security and logins → Connected apps.
Deleting data from HKFlows removes our copy only. Pins and listings that already exist on Pinterest or Etsy stay there; manage them on the platform.
You may complain to your data protection authority (in Türkiye, the Personal Data Protection Board, KVKK). We would like the chance to fix the problem first, so please write to us as well. Users in Türkiye can read our Turkish notice under Law No. 6698.
11. Children
HKFlows is a business tool for people aged 18 or older. We do not knowingly collect personal data from anyone younger.
13. Changes to this policy
We post changes on this page with a new effective date and version. For material changes we notify you by e-mail or in the app before they take effect, and we ask for your agreement again where the law requires it.
14. Platform notices
The term 'Etsy' is a trademark of Etsy, Inc. This application uses the Etsy API but is not endorsed or certified by Etsy, Inc. Pinterest is a registered trademark of Pinterest, Inc. HKFlows is an independent product of HK DTS LLC and is not endorsed by, affiliated with or operated by Etsy or Pinterest.