Privacy Policy

1. Data controller

PinThemAll is operated by Mu Studio, a company based in France. We are the data controller for all personal data collected through this website.

2. Personal data we collect

We only collect data that is strictly necessary to provide the service:

• Email address — used to create and identify your account, and to send transactional emails (password reset, purchase confirmation).
• Password — stored as a one-way hash (SHA-1). We never store or transmit your password in plain text.
• Images you upload — stored on Amazon S3 to generate your pins and collages.
• Payment data — if you purchase a plan, your payment is processed by Stripe. We only store a Stripe customer ID; we never handle or store card numbers.
• Session data — a session cookie is set when you log in to keep you authenticated. No tracking or advertising cookies are used.

3. Legal basis for processing (GDPR Art. 6)

• Performance of a contract (Art. 6.1.b) — account creation, image generation, subscription management.
• Legal obligation (Art. 6.1.c) — retention of billing and transaction records as required by French accounting law (10 years).
• Legitimate interest (Art. 6.1.f) — security, abuse prevention, and service improvement.

4. How we use your data

• Authenticate you and operate your account.
• Store and serve the images you create.
• Send transactional emails (password reset, purchase confirmation). We do not send marketing emails.
• Process payments for premium plans via Stripe.
• Detect and prevent abuse or fraudulent activity.

5. Data retention

• Account data (email, password, images) — retained until you delete your account. You can request deletion at any time.
• Billing records — retained for 10 years as required by French law (Code de commerce, Art. L123-22).

6. Third-party processors

We share data only with the following processors, under data processing agreements:

We do not sell, rent, or share your personal data with any other third party.

7. Cookies

We use a single session cookie to keep you logged in. This cookie is strictly necessary for the service to function and does not track you across other websites.

We do not use advertising, analytics, or tracking cookies. No third-party cookies are set by our pages.

8. Your rights (GDPR Chapter III)

As a data subject you have the following rights, which you can exercise by contacting us at speak@withmu.com:

• Right of access (Art. 15) — request a copy of your personal data.
• Right to rectification (Art. 16) — correct inaccurate data. You can update your email and password directly in your account settings.
• Right to erasure (Art. 17) — delete your account and all associated data. This option is available directly in your account settings.
• Right to data portability (Art. 20) — request your data in a structured, machine-readable format.
• Right to restriction (Art. 18) — ask us to restrict processing of your data in certain circumstances.
• Right to object (Art. 21) — object to processing based on legitimate interest.

We will respond to your request within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the French supervisory authority, the CNIL.

9. Security

All data is transmitted over HTTPS (TLS). Passwords are stored as one-way hashes and are never recoverable. Access to production systems is restricted to authorised personnel only. In the event of a personal data breach, we will notify the CNIL within 72 hours and affected users without undue delay, as required by GDPR Art. 33–34.

10. Contact

For any questions about this policy or to exercise your rights, contact us at speak@withmu.com.