Privacy Policy
What HKFlows collects from you, your Etsy shop and your Pinterest account, why, who sees it, how long we keep it and how to exercise your rights.
Effective October 12, 2026
1. Who we are
HK DTS LLC (“HK DTS”, “we”, “us”) is a limited liability company registered in Wyoming, United States (registered address: 30 N Gould St Ste 37130, Sheridan, WY 82801, USA). We operate HKFlows (the “Service”): software that helps you improve your Etsy listings (SEO audit and AI suggestions), plan Pinterest content from them and publish it, with an AI assistant to guide you, and this website. This policy explains how we handle personal data when you visit the website or use the Service.
Privacy questions, complaints and requests: [email protected]. We answer within 30 days and usually much sooner.
2. Our role
We are the controller of the personal data we need to run your account: your name and e-mail address, sign-in and security data, usage logs, billing identifiers we receive from our payment provider, support correspondence and your consent records.
We are a processor for the content you bring from your own shop: listing text and photos, generated pin content and the boards you connect. You decide what to publish and why. If that content contains personal data (for example a person in a product photo), you are the controller and we process it on your instructions, as described in these documents. A data processing agreement is available on request at [email protected].
HKFlows does not read your Etsy orders, buyer messages or customer lists, and we will update this policy before adding any feature that would.
3. Information we collect
Website
The public website does not use analytics, advertising cookies or tracking pixels. Fonts are served from our own domain. Our website and app are served through Cloudflare, which acts as a reverse proxy and security layer and sees traffic in transit. Cloudflare and our own servers write standard technical logs (IP address, browser user agent, requested page, time) for security and operation.
Your account
Name, e-mail address and a hashed password, your language, the time zone you pick, the versions of the Terms and this policy you accepted and when, and security data such as sign-in times and two-factor settings.
Etsy (when you connect a shop)
Through Etsy’s official authorization (OAuth) we receive shop information, your listings (titles, descriptions, tags, images and alt texts, prices, status, SKU, views and favorites) and the access tokens Etsy issues. We write to your listings on Etsy only when you review and apply a change yourself (title, tags, description or image alt text), and you can revert it. We do not read your orders, buyers or messages. We never see your Etsy password. We keep listing data in sync with Etsy and do not use it for anything except the features you use. For keyword research we also read aggregate counts of active Etsy listings for the search phrases you look up through the Etsy API; the counts contain no personal data, are refreshed at least every 24 hours and are used only to optimize your own listings.
Pinterest (when you connect an account)
Through Pinterest’s official authorization we receive basic account information (such as username and account type), your boards, and the access tokens Pinterest issues. We store the pins we publish for you (title, description, link, image, schedule, the Pinterest pin ID and status). We never see your Pinterest password. HKFlows publishes only organic Pins of your own Etsy listings, and each Pin links to the matching listing on Etsy. It does not buy or manage ads, does not use any advertising API and does not send Etsy data to any advertising or marketing platform.
Content we generate for you
Content plans, pin titles and descriptions, rendered pin images, your prompts and your conversations with the assistant. They are stored in our database and media storage while your account exists.
Ratings of assistant replies
When you rate an assistant reply (thumbs up or down), we store your rating, the note you add and a copy of that conversation up to the rated reply, so our team can review it and improve the assistant. You decide to share it each time; you can remove a rating in the conversation.
Payments
Paid plans are sold by Paddle, our Merchant of Record. Paddle collects your payment details; we do not receive or store card numbers. We receive a customer identifier, your plan and subscription status, the country and the e-mail used for the purchase.
Support
The messages you send us and whatever you include in them. If you use the contact form on our website: your name, e-mail address, subject and message. The form is not stored in our database; it is sent as an e-mail to our support mailbox, and we use your IP address only briefly to limit abuse (at most 5 messages per hour).
Waitlist
If you join the waitlist while sign-ups are closed: your name, e-mail address, language, the version of this policy you saw and when you confirmed your address. We use them only to tell you when sign-ups open. Every e-mail has a link that removes you from the list.
4. Why we use it, and on what legal basis
| Purpose | Data | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Create and run your account, connect Etsy and Pinterest, generate and publish content | Account, Etsy, Pinterest and generated content | Contract (Art. 6(1)(b)) |
| Enforce plan limits, daily posting limits and the one-free-plan-per-shop rule | Account, connected account identifiers, usage | Contract and our legitimate interest in preventing abuse (Art. 6(1)(b), (f)) |
| Security, fraud and abuse prevention, fixing errors, server logs | Logs, account and security data | Legitimate interests (Art. 6(1)(f)) |
| Billing, refunds and tax records (handled by Paddle as Merchant of Record) | Billing identifiers, plan, country | Contract and legal obligation (Art. 6(1)(b), (c)) |
| Service e-mails (verification, password reset, quota and publishing notices) | Name, e-mail | Contract (Art. 6(1)(b)) |
| Proving which policy version you accepted | Consent records | Legal obligation and legitimate interests (Art. 6(1)(c), (f)) |
| Tell you when sign-ups open (waitlist) | Name, e-mail, language | Consent (Art. 6(1)(a)), withdrawable at any time with the link in every e-mail |
| Answer your questions and requests (contact form, support e-mail) | Name, e-mail, subject, message | Legitimate interests in answering you (Art. 6(1)(f)); steps you ask us to take before a contract (Art. 6(1)(b)) |
| Improve the assistant from the replies you rate | Rating, note, the conversation you shared | Legitimate interests (Art. 6(1)(f)); you choose to share each one |
| Marketing e-mail, if we ever send it | Name, e-mail | Consent (Art. 6(1)(a)), withdrawable at any time |
We do not sell personal data. We do not use data from Etsy or Pinterest for advertising, profiling or to train AI models, and we do not combine data between customers. Keyword research uses only aggregate counts of public Etsy listings for the phrases you search; it contains no personal data and serves only to optimize your own listings.
5. AI-assisted content
To draft titles, descriptions and pin ideas we send listing text, listing images and your prompts to AI model providers through OpenRouter. We send only content from your shop and your prompts, not your name, e-mail address or tokens. Those providers act as our sub-processors under their own terms. We use only model endpoints configured for zero data retention, and neither we nor those providers use your content to train models.
AI output is a draft. You review and approve it before anything is scheduled. No decision with legal or similarly significant effects is made by automated means. Where Pinterest asks for it, content created with AI is flagged so that Pinterest can label it.
7. International transfers
HK DTS is a United States company and our team administers the Service from Türkiye. Our providers operate in the United States and other countries. When personal data of people in the European Economic Area, the United Kingdom or Türkiye is transferred to a country without an adequacy decision, we rely on the safeguards the law provides for, such as the European Commission’s standard contractual clauses and the UK addendum, Turkish standard contracts, or a provider’s certification under the EU–US Data Privacy Framework where available. For example, Cloudflare processes traffic data under its data processing addendum, which includes standard contractual clauses.
You can ask us for details of the safeguards for a given provider at [email protected].
8. Security and incidents
Etsy and Pinterest tokens are encrypted at rest (AES-256-GCM). Data travels over HTTPS (TLS 1.2 or newer). Every workspace’s data is kept separate from other workspaces’. Access to production systems is limited to authorized personnel, and administrator actions on customer accounts are recorded in an audit log. No system is completely secure.
If a personal data breach is likely to put you at risk, we notify the competent supervisory authority within 72 hours of becoming aware of it, notify affected users without undue delay where the risk is high, and notify Etsy within 24 hours when Etsy data is affected and Pinterest within 72 hours when Pinterest data is affected.
9. How long we keep data
| Data | Retention |
|---|---|
| Account data and generated content | While your account exists; deleted within 7 days after you delete the account |
| Etsy and Pinterest tokens | Deleted immediately when you disconnect an account; if you revoke access on Etsy or Pinterest, deleted as soon as we detect it |
| Etsy listing data and related content for a disconnected shop | Deleted within 7 days of disconnecting |
| Pinterest account data (username, boards) after you disconnect an account | Deleted within 7 days. Pins we published stay in your history |
| Publishing history (pins published, status) | While your account exists |
| Assistant conversations | While your account exists; a conversation you delete is removed after 30 days; conversations about a shop you disconnect are deleted with its Etsy data, 7 days after the disconnect |
| Rated replies (rating, note, shared conversation) | 180 days, or until you remove the rating or delete your account; ratings about a shop you disconnect are deleted with its Etsy data, 7 days after the disconnect |
| Waitlist | Unconfirmed addresses: 7 days. Confirmed: until we tell you sign-ups are open, then 90 days, or until you remove yourself |
| Contact form and support messages | Kept in our support mailbox for up to 2 years, then deleted |
| Our server and security logs | Up to 30 days |
| Traffic data at Cloudflare | As described in Cloudflare’s privacy policy; we do not use Cloudflare’s log storage |
| Consent records (policy version, time) | While your account exists, then as long as needed to prove consent |
| Billing records | Held by Paddle for as long as tax and accounting law requires; we keep only the identifiers listed above |
| Backups | Deleted data leaves backups as they are overwritten in the normal backup cycle |
Etsy rules also apply: listing data is refreshed from Etsy at least every 6 hours and all other Etsy data at least every 24 hours, and we do not keep it longer than needed to provide the Service. Content we generated from your Etsy data (assistant replies, rated replies, suggestions) is kept as our output for you; the Etsy listing data itself follows the refresh and deletion rules above.
10. Your rights and choices
Depending on where you live (for example the EEA, the UK, Türkiye or California) you may have the right to access your data, have it corrected or deleted, restrict or object to processing, receive a portable copy, withdraw consent and not be subject to certain automated decisions.
- Use the data export and account deletion tools in your account settings, or disconnect Etsy or Pinterest at any time to revoke our access: the tokens are deleted at once and the Etsy listing data of a disconnected shop within 7 days.
- Or e-mail [email protected] from the address of your account. We may ask you to confirm your identity first and answer within one month (30 days under Turkish law).
- Revoke access on the platform as well: Etsy under Account settings → Security → Apps; Pinterest under Settings → Security and logins → Connected apps.
Deleting data from HKFlows removes our copy only. Pins and listings that already exist on Pinterest or Etsy stay there; manage them on the platform.
You may complain to your data protection authority (in Türkiye, the Personal Data Protection Board, KVKK). We would like the chance to fix the problem first, so please write to us as well. Users in Türkiye can read our Turkish notice under Law No. 6698.
11. Children
HKFlows is a business tool for people aged 18 or older. We do not knowingly collect personal data from anyone younger.
13. Changes to this policy
We post changes on this page with a new effective date and version. For material changes we notify you by e-mail or in the app before they take effect, and we ask for your agreement again where the law requires it.
14. Platform notices
The term 'Etsy' is a trademark of Etsy, Inc. This application uses the Etsy API but is not endorsed or certified by Etsy, Inc. Pinterest is a registered trademark of Pinterest, Inc. HKFlows is an independent product of HK DTS LLC and is not endorsed by, affiliated with or operated by Etsy or Pinterest.