Privacy Policy

1. Who we are and what this policy covers

Your Way Co is the operator of the website at ywgroup.au, including the Your Way Services website and associated service pages. Your Way Co also operates Your Way Co Content Studio, an internal content-production tool for the owner’s websites and Pinterest business accounts. The tool is not offered to external customers. Its initial content source is GardenMate.

This policy explains how information is handled through the website, enquiries and the Content Studio. It also explains the limited Pinterest connection that is planned.

2. Information handled through the website

Enquiries

If you submit an enquiry, we may collect your name, email address, phone number, suburb, message, the page or service the enquiry relates to and, where relevant, service selections or an event date. We use this information to respond, assess the requested work, arrange follow-up and maintain customer and enquiry records.

Website enquiry forms are processed through Netlify. Google reCAPTCHA receives verification information and IP information to help identify automated submissions. Enquiry details are sent to ClickSend for notifications and contact handling and to a Google Apps Script CRM. The CRM uses Google Sheets, Google Contacts, ClickSend contacts and Google email services. A confirmation email may be sent to the address supplied.

The website may also make an embedded customer form available using Google Apps Script. If you use that form, the contact, address and service details you submit may be handled through the same CRM services and Google Tasks.

Analytics, reviews and technical information

The website uses Google Analytics to understand site use and improve pages and services. Google Analytics may receive device, browser, interaction, approximate location and similar technical information and may use cookies or related identifiers.

Google reCAPTCHA may also use cookies or technical signals under Google’s terms. The website displays reviews through a Supabase-backed service. Review content may include information that a reviewer made public with the original review.

Operational logs may contain technical events, IP or rate-limit information, form-source information, provider response identifiers and errors. These logs are used to operate, troubleshoot and protect the website and enquiry process.

Cookies and browser controls

Cookies and similar technologies may be set by services such as Google Analytics and reCAPTCHA. You can restrict cookies through your browser settings, although doing so may affect analytics, security checks or the operation of forms.

3. Your Way Co Content Studio

Current content-production workflow

The Content Studio reads public articles from websites controlled by the owner and records source URLs and extracted article content. It combines that material with brand information such as brand name, website, colours, logo, tone, intended audience, board suggestions and internal notes.

OpenAI receives relevant source material, brand information and drafting instructions to produce proposed Pin titles, descriptions and creative directions. Requests are configured not to use OpenAI’s application-side response storage, but OpenAI’s own service terms and data-handling practices still apply.

Pexels receives stock-photo search terms. The operator selects a photograph, and the tool records attribution and source information and downloads the selected image. Pexels does not receive Pinterest account information through this workflow.

The tool combines selected photographs with brand styling to create Pin images. The owner reviews and approves each image, title, description and alt text. Current records can include source articles, brand details, image files and attribution, generated copy, review decisions, rendered revisions and export receipts.

Approved images and accompanying content currently export to private Google Drive folders and Google Sheets for manual posting. The app uses Google authorisation credentials for this access and keeps limited exporter-account information, such as the authorised account email and an account permission identifier, in local export records.

Original content and Pinterest information are different

Articles from the owner’s websites, brand information, Pexels photographs, OpenAI drafts, edited copy, alt text, approval decisions and rendered images are created or selected independently of Pinterest. Preparing that material for a future Pin does not make it information obtained from Pinterest.

Information returned by Pinterest through its API—such as board listings or a response to a publishing request—is Pinterest-derived information and will be handled under the additional restrictions in section 4.

4. Planned Pinterest connection

Authorisation and proposed permissions

The planned connection will use Pinterest’s authorisation process. The owner will sign in with Pinterest and approve the requested permissions on Pinterest’s pages; Your Way Co Content Studio will not request or collect the owner’s Pinterest password or session cookies.

The proposed minimum permissions are:

• boards:read, to retrieve the authorised account’s available public and group boards so the owner can select a destination board; and
• pins:write, to publish an individually approved public Pin to the selected board.

Pinterest defines pins:write broadly enough to create, update or delete public Pins. The planned Content Studio use is narrower: it will use that permission to create individually approved Pins. It will not provide unrequested update or deletion features merely because the permission could technically allow them.

The planned integration does not include Pinterest analytics, advertising, audience uploads, secret boards or Pins, scraping, competitor research or access for external customers.

Information processed for the connection

During authorisation, the tool will process an authorisation code and security state value and exchange the code for an access token. It may store the resulting access token, refresh token, granted permissions and token expiry information so the authorised connection can operate.

For board selection, the tool will request board names and identifiers from Pinterest and display them to the owner. After the owner chooses a board and gives final approval, the tool will submit the selected board identifier together with the approved image, title, description, alt text and destination article URL needed to create the Pin. It will process Pinterest’s success or error response, which may include a Pin identifier and publishing status.

Pinterest information boundaries

When the connection is enabled, board listings and publishing responses will be processed transiently for board selection, publication and immediate confirmation. They will not be added to local content archives, OpenAI prompts, Pexels requests, Google Drive files or Google Sheets exports.

Pinterest-derived information will not be sold, shared with third parties, combined with information from other Pinterest accounts, or matched or combined with identifying personal information, including website enquiries and CRM contacts. It will not be used for advertising outside Pinterest or to train, fine-tune or develop artificial intelligence or machine-learning models. Pinterest credentials will not be sent to OpenAI, Pexels or Google content exports.

The tool will access only Pinterest business accounts authorised by the owner and only for the functions explained here. Each Pin must be individually reviewed and approved before a publishing request is made. The tool will not scrape Pinterest or publish unreviewed Pins automatically.

5. Services that receive information

These providers may process information using infrastructure outside Australia. Processing locations can vary with provider infrastructure, service configuration and provider terms, so this policy does not state a fixed list of countries or claim that information remains in Australia.

6. Storage, retention and security

Website and CRM records

Website enquiry and CRM records are held in the services described above. The current systems do not apply an automatic deletion schedule to those records, and archiving a CRM record does not delete it. Records may therefore remain until they are reviewed and removed through the relevant systems.

Original Content Studio material and Google exports

Source extracts, brand details, selected photographs, generated and edited copy, alt text, approval records, rendered images and export receipts are stored in the operator’s local working environment. Approved content is also stored in Google Drive and Google Sheets. The current tool does not automatically delete these records or apply a fixed retention period.

Google credentials

Google access and refresh credentials are stored outside public website code so the internal tool can access its authorised Drive and Sheets resources. They remain until manually replaced or removed. Removing a locally stored credential stops the tool from using that copy but does not necessarily revoke the authorisation at Google; revocation must also be completed through the relevant Google account controls.

Planned Pinterest credentials and API responses

When Pinterest access is enabled, we will keep the app secret and tokens out of public code and logs, restrict credential access to the operator, use secure Pinterest API connections and remove stored Pinterest credentials when the connection is ended. Authorisation codes will be used for token exchange rather than retained as content records.

Access and refresh tokens, granted permissions and expiry information will be kept only while needed for the authorised connection. Board listings and publishing responses will be processed transiently and not retained in the local or Google content records described above.

When the Pinterest connection is enabled, we will erase Pinterest-derived information under our control promptly, within 30 days at the latest, when authorisation is withdrawn, the account holder or Pinterest requests deletion, the Pinterest account is deleted, the information is no longer needed, our Pinterest agreement ends, or deletion is legally required. This includes copies and derived records. This maximum deadline does not permit routine retention of API responses, which remain transient as described above.

7. Disconnecting the planned Pinterest integration

The Pinterest connection is still under development, so there is no working disconnect button at present. Before API access is enabled, we will provide a process for the operator to end the connection.

Once enabled, ending the connection will stop further Pinterest API access by the Content Studio and remove the Pinterest credentials stored for that connection. The owner will also be directed to Pinterest’s account or app-authorisation controls where separate withdrawal or revocation is required. Deleting a local token is not, by itself, the same as revoking Pinterest’s authorisation.

Disconnecting the tool will not delete Pins already published to Pinterest. Those Pins must be managed separately through Pinterest or an authorised Pinterest API function.

8. Access, correction and deletion requests

You may ask about personal information connected with you, request access or correction, or ask that information be deleted by emailing yourwaytweed@gmail.com. Please include enough detail for us to identify the relevant enquiry or record without sending unnecessary sensitive information.

We will review the request and may need to verify your identity before disclosing, changing or deleting information. If information cannot be removed immediately from every relevant provider, technical record or backup, or if a record needs to be retained for an applicable operational or legal reason, we will explain the constraint that applies. A request does not automatically delete information held independently by a third-party provider under its own terms.

The general retention provisions for website enquiries, CRM records, original Content Studio material and Google exports do not override the Pinterest-specific deletion commitment in section 6.

9. Privacy questions and complaints

If you believe information has been mishandled, email the privacy contact with the nature of your concern and the outcome you are seeking. We will review the matter, may request information needed to confirm the circumstances or your identity, and will respond with the outcome or any next steps. Information about privacy rights and complaints is also available from the Office of the Australian Information Commissioner.

10. Changes to this policy

We will update this policy when the website, Content Studio, provider arrangements, Pinterest integration or information-handling practices change. The current version will be published at this URL with a revised last-updated date.