This Privacy Policy describes how Pineapple Studio Collective (“we”, “us”, “our”) collects, uses, and protects your personal data when you interact with the website pineappleco.studio or any of our services. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who We Are
Pineapple Studio Collective is a UK-based creative studio. Contact: hello@pineappleco.studio.
2. What We Collect
Depending on how you interact with us, we may collect:
- Contact info you voluntarily provide (e.g., email when joining the waitlist or emailing us).
- Technical data via Cloudflare hosting: IP address, browser type, pages viewed. Used only for site security and aggregate analytics.
- Communications you send us by email.
3. How We Use It
- To respond to your enquiry or notify you at launch (only if you ask).
- To operate, secure, and improve the website.
- To comply with legal obligations.
4. Legal Basis
We process your data under the following UK GDPR bases: consent (waitlist), legitimate interest (site security, basic analytics), and legal obligation (where required by law).
5. Sharing — named processors
We do not sell your personal data. We use a small number of service providers under data processing agreements:
- Buttondown (Buttondown LLC, USA) — waitlist email storage and the single launch notification. Buttondown receives your email address and may receive your IP address at signup. Transfer to the USA relies on the UK International Data Transfer Addendum (UK IDTA) with EU Standard Contractual Clauses (SCCs). Buttondown’s privacy notice: buttondown.email/privacy.
- Cloudflare, Inc. (USA) — hosting, CDN, DDoS mitigation, tunnels, edge functions for the waitlist endpoint. Cloudflare receives request metadata (IP, user-agent, paths). Transfer relies on UK IDTA with SCCs. Cloudflare’s privacy notice: cloudflare.com/privacypolicy.
- Payment processors (Stripe, Whop, Digistore24) — only invoked when a transaction starts; receive name, email, and payment metadata required to process the charge. Each has its own published privacy notice and SCC framework.
We may disclose data if required by law (court order, regulatory request).
6. Retention
We keep your data only as long as needed for the purpose it was collected, or as required by law. You can ask us to delete your data at any time.
7. Cookies
We use only essential cookies required for site functionality. We do not use tracking or advertising cookies. If we ever introduce optional cookies, we will request your consent first.
8. Your Rights (UK GDPR)
- Access your personal data
- Rectify inaccurate data
- Request deletion
- Restrict or object to processing
- Data portability
- Withdraw consent at any time
To exercise any of these, email hello@pineappleco.studio.
9. Third-Party Platforms
We integrate with third-party platforms including TikTok, Pinterest, YouTube, Instagram, and Facebook. Those platforms have their own privacy policies; please review them when interacting with content published through them.
9.1 TikTok integration
Where you choose to connect your TikTok account to Pineapple Studio, we use the TikTok Login Kit and Content Posting API. We request only the OAuth scopes required to operate the connection you initiated:
user.info.basic— the TikTok display name, avatar URL, and open ID associated with your account. We use this solely to show which TikTok account is connected inside the Pineapple hub UI; it is not used for advertising or shared with any third party.video.upload— the ability to upload a video file you have prepared inside Pineapple Studio to your own TikTok account as a private draft. We never upload, modify, or delete videos without an explicit per-video user action.video.publish— the ability to publish a previously uploaded draft to your own TikTok feed when you click “Publish” in the Pineapple hub. No automated publishing occurs without that explicit click.
What we store and for how long:
- The TikTok OAuth access token and refresh token, encrypted at rest, scoped to the connecting Pineapple Studio account. Tokens are stored only for as long as the connection remains active. When you disconnect TikTok in Pineapple Studio (Settings → Connected Accounts → Disconnect TikTok), the tokens are deleted within 24 hours.
- The TikTok display name, avatar URL, and open ID returned by
user.info.basic, kept only to render the “Connected as @username” UI element. Deleted when you disconnect. - An audit record of each video you publish to TikTok (timestamp, video ID returned by TikTok, source draft ID inside Pineapple Studio). This is for your own publishing history; we never share or sell it.
What we do not do with TikTok data: we do not sell or share TikTok user data with any third party, we do not use it for advertising, we do not aggregate it across users, and we do not use it for any purpose other than the connection and posting flow you initiated. We do not access TikTok data of users who have not personally connected their account to Pineapple Studio.
To revoke access from TikTok’s side at any time: go to tiktok.com/setting/manage-app and remove the Pineapple Studio app. Your TikTok-side revocation is honoured by Pineapple Studio within 24 hours and the corresponding stored tokens are deleted.
9.2 Pinterest, YouTube, Instagram, Facebook
Where you connect any of these platforms, we follow the same principle as the TikTok section above: we request only the OAuth scopes required for the publishing actions you initiate, store only the access and refresh tokens necessary to operate the connection, and delete those tokens within 24 hours of you disconnecting the platform inside the Pineapple hub. We do not aggregate, share, sell, or use platform-specific user data for any purpose other than the publishing flow you initiated.
10. International Transfers
Some service providers may process data outside the UK. Where this happens, we rely on Standard Contractual Clauses or equivalent safeguards.
11. Children
Our services are not directed at children under 16 and we do not knowingly collect personal data from them.
12. Changes
We may update this policy from time to time. Updates will be posted on this page with a new “Last updated” date.
13. Complaints
If you’re not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).