TRANSPARENCY & CARE

Privacy policy

Northform Studio & Northform AI Commerce

Effective October 31, 2026

1. Scope and operator

Vincent LaPelusa is the legal operator of Northform Studio and the Etsy shop NorthformStudioUS. Northform Studio and Northform AI Commerce are business and software names; this policy does not represent either as a separately registered legal entity. Northform AI Commerce is the operator’s private business software. This policy describes this informational website and current software practices relevant to a proposed Pinterest connection. Etsy and Pinterest apply their own policies to their services.

2. This website

These static pages use one locally served product image, with no forms, user accounts, analytics scripts, advertising trackers, application cookies or connection to the private dashboard. Cloudflare Pages hosts this website. Cloudflare processes visitor requests, which may include IP addresses, traffic routing data and other request metadata to deliver and protect the site. Cloudflare describes that processing in its privacy policy. No optional Web Analytics, advertising or additional tracking is planned. We do not promise a fixed Cloudflare retention period; provider retention is governed by its applicable terms and service configuration.

3. Pinterest information and OAuth

Pinterest OAuth is prepared but not connected. Live token exchange and API publishing are disabled. The proposed permissions are boards:read, pins:read, pins:write and user_accounts:read, for our own business account. If separately authorized and connected, they support checking account and board identity, publishing individually approved Pins, verifying content and reading available own-account information. Analytics availability depends on access.

Existing local records include Pin images and copy, board and tracked destination URLs, content hashes, owner decisions, publishing results for two Pins posted through the signed-in browser, and dated metric observations. Northform does not currently have an active Pinterest API connection.

4. Uses

Information supports content review, scheduling, duplicate prevention, publication verification and evaluating organic marketing. Etsy order records are handled separately in the private business system for order and financial monitoring. They are not included on this site. Northform does not sell personal information or operate advertising through these pages.

5. AI and service providers

Northform uses the OpenAI API for bounded text analysis when authorized. Evidence export requires a specific, unexpired processing-permission record. Restricted Etsy research is kept out unless its specific processing use is cleared. Pinterest account records, credentials and analytics are not authorized for external AI processing under the prepared connection; this policy does not grant that permission. Current scheduled Pin preparation uses local templates and programmed checks.

A future approved API post would send its image, copy, board and destination to Pinterest. Etsy and Pinterest receive information when visitors open their links. OpenAI handles approved API inputs under the applicable API account terms; we do not claim that provider has zero retention. These pages load no third-party fonts, social widgets or external image services.

6. Security

The private application protects integration and operational records using Windows CurrentUser DPAPI encryption on the owner’s computer. Prepared OAuth state is single-use and valid for ten minutes. These controls do not eliminate security risk. This public site contains no credentials, business database, administrative functions or OAuth callback. A future connection must be checked against its intended account, board and scopes before replacing an existing connection.

7. Retention and deletion

Local approval, publishing, financial and monitoring records currently have no automated deletion schedule. Authorization-state expiry does not imply automatic disk deletion at expiry. No fixed retention period or automatic deletion service has been implemented. Recovery, accounting and audit needs must be assessed before deleting records; we do not promise a fixed deletion deadline or automatic removal from backups.

An authorized app can be revoked through Pinterest settings. Revocation does not itself erase saved local records. Disconnect and deletion requests require manual operator handling and review of retained copies. Published Pins may remain on Pinterest unless separately removed there.

8. Contact and requests

Contact Vincent LaPelusa at vince@steadyflowleads.com for privacy questions or requests to access, correct or delete relevant records. This is the operator-confirmed monitored public contact. Please describe your request and the records involved without sending passwords, access tokens or unnecessary sensitive information. The operator may ask for information needed to verify a request before disclosing or deleting records.

9. Changes

Review is required before Pinterest activation or changes in hosting, data use or AI processing. This policy took effect upon first public deployment on October 31, 2026. Material updates will be identified in the published policy. Approval of this text authorizes no new processing or integration.