Privacy Policy
1. Controller
Patrick Werner, trading as Selfora (sole proprietorship)
Würzburger Straße 229
63808 Haibach, Germany
Email: kontakt@selfora.de
2. Overview
ExpertFlow is an internal tool of the operator. It publishes the operator's own short videos, each approved by a human, to the operator's own accounts on Pinterest and other platforms. There is no sign-up, no third-party user accounts and no public access. Personal data is processed when this website is visited (section 3) and when the operator connects their own platform accounts (sections 4–6). Data of other platform users is never retrieved, analysed or stored.
3. Visiting this website
This is a static website without cookies, analytics, tracking, external fonts, scripts or forms. It is served by Cloudflare Pages (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which processes technically necessary data such as IP address, time, requested page and browser information to deliver and protect the site (Art. 6(1)(f) GDPR). Cloudflare acts as processor under the Cloudflare Data Processing Addendum, which forms part of Cloudflare's terms, and is certified under the EU-U.S. Data Privacy Framework; retention of these data follows Cloudflare's rules. See the Cloudflare privacy policy.
4. Pinterest integration
ExpertFlow uses the Pinterest API v5 to publish approved videos as video Pins to a board of the operator's own Pinterest account.
- Sign-in: official Pinterest OAuth; the operator grants access on Pinterest's own page. ExpertFlow never receives a password.
- Scopes:
user_accounts:read(username and account type),boards:read(own boards: ID and name, to choose the target board),pins:readandpins:write(create own video Pins and check their processing status). - Data stored: access and refresh token with expiry times, username, account type and the IDs and names of the own boards – in an encrypted file (AES-256-GCM) on the operator's computer, with the key kept separately; Pin ID, link and the Pin texts in ExpertFlow's local database, as proof of publication and to prevent duplicate posts.
- Data sent to Pinterest: the video, title, description, cover frame time and the AI-generated content disclosure.
- Not done: no access to other users' data (profiles, Pins, followers, comments, analytics), no sharing with third parties, no advertising, no profiling, no automated decisions. Tokens are never stored in plain text, shown or logged.
- Legal basis: Art. 6(1)(f) GDPR – publishing own content to the own account. Recipient: Pinterest (EU: Pinterest Europe Ltd., Palmerston House, Fenian Street, Dublin 2, Ireland); see the Pinterest privacy policy.
- Retention and revocation: tokens, account name and boards are kept until the connection is removed; access can be revoked at any time in Pinterest's settings under connected apps. Publication records (Pin ID, link, texts) are kept as proof of publication and to prevent duplicate posts for as long as ExpertFlow is operated; no automatic deletion is set up.
5. YouTube (Google)
ExpertFlow uses YouTube API Services to upload approved videos to the operator's own channel. By using it, the YouTube Terms of Service and the Google Privacy Policy apply. Scopes: youtube.upload and youtube.readonly (own channel ID and name). Stored: the encrypted refresh token, channel ID and name, and the video ID and link of each upload. Sent: video, title, description, tags and the synthetic-content disclosure. Revoke access at myaccount.google.com/permissions.
6. Instagram, Facebook and TikTok
A connection to Instagram and Facebook (Meta) is prepared but not set up. If set up, ExpertFlow processes data as in section 4 (encrypted access data, name and ID of the own Facebook Page and linked Instagram account, ID and link of own posts); recipient: Meta Platforms Ireland Ltd. (Meta privacy policy). TikTok is used without an API: the operator posts there manually.
7. Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15–18, 20, 21 GDPR). Contact the email address above. You may also lodge a complaint with a data protection supervisory authority, The competent authority for the operator is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.