SleuthLensLast updated: 19 October 2026. This policy explains what personal data SleuthLens collects, why, who sees it, how long we keep it and what rights you have. It covers the website sleuthlens.com, the SleuthLens web app and API (app.sleuthlens.com, api.sleuthlens.com) and the SleuthLens browser extensions. We wrote it to be read.
1. Who is responsible
The data controller is Phillip Stemann (sole proprietorship, CVR 34846227), Ved Stigbordene 41, 2450 Copenhagen SV, Denmark (“we”, “us”). You can reach us at hello@sleuthlens.com. We have not appointed a data protection officer. Questions about your data go to that address and we answer within one month.
2. The short version
- The website sets no cookies and runs no statistics unless you accept them in the banner. There is no advertising and there are no third-party scripts or fonts. If you accept, our own email platform, Mailnaptic, counts your visit.
- The app uses one cookie, the one that keeps you signed in. When you pay, Stripe’s checkout page uses its own cookies under its own policy.
- We never sell personal data and never use it for advertising.
- Everything runs on servers in the European Union (Helsinki, Finland). A few services we use may process data outside the EU. Section 9 explains which and why that is lawful.
- You can ask us to show, correct, export or delete your data at any time.
3. What we collect, why and for how long
| Situation | Data | Why and legal basis | How long |
|---|---|---|---|
| Visiting the website | IP address, browser type, page address and time, in short-lived server logs | To deliver the pages and keep the site secure and free of abuse. Legitimate interest, Art. 6(1)(f) GDPR. | In the server logs for a short period, never longer than 30 days. |
| Joining the waitlist | Email address, whether you chose “blogger / creator” or “agency / freelancer”, which form you used, the wording you agreed to, the time, whether you confirmed | To tell you when SleuthLens opens. Your consent, Art. 6(1)(a). | Deleted automatically: a sign-up you never confirm after 30 days, an unsubscribed address after 30 days, and every other address 24 months after you signed up or confirmed. You can ask us to delete it sooner at any time. |
| Having an app account | Email, name (optional), a hashed password, plan and role, sign-in times, sessions, your API keys (stored hashed) and your settings. For each API key also a record of how it is used: when it was first and last used, how many times, which program used it (for example the browser extension or an AI assistant), and the IP address and country of its use | To create and run your account, and to show you where your keys are used so you can spot misuse. Contract, Art. 6(1)(b), and legitimate interest in keeping accounts secure, Art. 6(1)(f). | While your account exists; the usage record of a key is deleted together with the key. Deleted accounts are removed within 30 days; backups holding them are overwritten within 7 days. If a subscription ends and you do not return, the account is kept for a limited time and deleted when you ask or when we review inactive accounts, at least once a year. |
| Visiting the website, only if you accept statistics | A random visitor ID in a cookie, the address and title of the pages you open, the page you came from, the time, and a few actions such as clicking a trial or demo button or sending the waitlist form. If you later click a link in one of our emails, or give us your email address in a form, the visits are linked to you | To see which pages bring people to SleuthLens and which emails lead to visits. Your consent, Art. 6(1)(a) GDPR, which you can withdraw at any time | The cookie lasts 12 months. The visits are stored in Mailnaptic until you ask us to delete them |
| Using the app | The websites, goals, alerts and notes you create; the history of edits to the titles, descriptions and links of your own pins that SleuthLens notices (the text before and after, the date, any note you add) and the results it measures for them; the client reports you create (a page and a PDF with your own numbers that anyone with its link can open until you delete it) and the address you choose for scheduled report emails; the Pinterest export files you import (impressions and clicks per day or per pin); and the pin and page checks SleuthLens runs for your own pins, including the public pages of the website you add for a Pinterest account (its sitemap and blog posts, read by SleuthLensBot, see /bot) | To provide the features you asked for. Contract, Art. 6(1)(b). | While your account exists. You can delete items yourself or ask us. |
| Connecting an AI assistant (optional) | An API key you create, or your approval when you sign in to SleuthLens to connect an app (the app gets an access token that lasts an hour, and a refresh token, both stored hashed; the app’s name and the date you approved it are kept so you can disconnect it), and what your assistant asks for through it: your own pin numbers, website posts, edits and reports. It is read-only: the connector cannot post or change anything | To let the assistant you chose answer questions about your own results. Your consent, Art. 6(1)(a), given when you create the key and add it to the assistant. | Until you delete the key or your account. SleuthLens does not keep what the assistant asked for, apart from the usage record of the key described above. |
| Your own keys | An Anthropic API key, if you add one for the AI writer; optional email or webhook settings | To run the AI writer and notifications for you. Contract, Art. 6(1)(b). | Until you remove them or delete your account. Keys are stored encrypted. |
| Paying for a plan | Name, email address, billing address, VAT number (if you enter one), the plan and billing period, and the status and dates of your subscription, and your invoices. Your card details go straight to Stripe and never reach us | To sell and bill the subscription, send invoices and keep the records the law requires. Contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c), under the Danish Bookkeeping Act. | While your subscription exists. Invoices and accounting records are kept for 5 years, as the Bookkeeping Act requires. |
| Connecting your Pinterest account (optional) | If you choose Connect Pinterest and approve it on Pinterest: your Pinterest username, profile picture, follower and pin counts, your boards, and the analytics Pinterest reports for your own pins (impressions, saves, clicks, engagement), plus an access token that lets us read these. We read only your own data, never anyone else’s through your connection, and we never post or change anything | To show you the performance of your own pins and boards. Your consent, Art. 6(1)(a), given when you approve the connection on Pinterest. | Until you disconnect (Account, then Disconnect), when we delete the token and all this data, or until you delete your account. You can also withdraw access in your Pinterest settings. |
| Emails we send you | Your email address and the email itself (invitations, password resets, account notices) | To run your account securely. Contract and legitimate interest, Art. 6(1)(b) and (f). | Our email platform keeps a record that an email was sent. It is removed when you ask us to delete your data. |
| Using the browser extension | Your API key, and, in the Pin writer, the keyword and the title, description and link you typed | To show you writing suggestions and checks for your draft. Contract, Art. 6(1)(b). | Requests are answered and not kept as a log of what you looked at, apart from the data you chose to save in your account. |
| Security | IP addresses and email addresses of sign-in attempts | To stop password guessing and abuse. Legitimate interest, Art. 6(1)(f). | Kept in memory for at most an hour, then forgotten. Not stored with your account. |
4. Website visitors
sleuthlens.com sets no cookies and loads nothing from other companies until you accept statistics in the banner at the bottom of the page. If you decline, or do nothing, nothing is set or loaded. If you accept, the page loads a script from Mailnaptic, our own email platform (api.mailnaptic.com, on our server in Helsinki). It sets one cookie, _mn_aid, with a random visitor ID that lasts 12 months, and sends Mailnaptic the address and title of the pages you open, the page you came from, the time, and a few actions such as clicking a trial or demo button or sending the waitlist form. Your choice is saved in your browser (not in a cookie) and you can change it at any time with Cookie settings in the footer; declining removes the cookie. The pages are delivered through Cloudflare, which means your request passes through Cloudflare’s network and your IP address is processed by Cloudflare for delivery and protection against attacks (see section 8). Our web server writes a short log line for each request (IP address, time, page, browser) so that we can fix errors and spot abuse. We do not combine these logs with any other data and we do not use them for profiling.
The sign-up form protects itself against bots with a hidden field and a limit on attempts per hour. For the limit we use a one-way (hashed) form of your IP address that expires after an hour and is not stored with your sign-up.
5. The waitlist
When you join the waitlist we ask for your email address and which description fits you best. By ticking the box you consent to being emailed when SleuthLens opens. We use double opt-in: we send one email asking you to confirm, and only confirmed addresses are emailed about the launch. We record when you agreed and the exact wording you saw, because the law requires us to be able to prove it.
The confirmation email is sent from our own server, from [email protected]. Once you confirm, your address is stored in Mailnaptic, our own email platform, which will send the launch email. Every email from the platform contains an unsubscribe link. You can withdraw your consent at any time, with no reason, and withdrawing does not affect anything we did before. After you unsubscribe we delete your address within 30 days. Sign-ups that are never confirmed are deleted after 30 days. In any case we delete waitlist data 24 months after you signed up or confirmed. This deletion runs automatically, and it also removes the address from our email platform unless it is also on another of our mailing lists, in which case it stays there until you ask us to remove it.
6. App accounts and the API
You create an account when you start a trial or a subscription, or when you accept an invitation. When you do, we store the data in section 3. Your password is never stored; we keep a salted scrypt hash. API keys are shown once and stored only as hashes. Any Anthropic key you add is stored encrypted. Each user’s data is kept in a separate database file, and one user can never see another user’s data.
We use your email address for messages about your account and the service: invitations, password resets and important notices (for example about security, changes to these terms or the end of the service). If you switch them on under Alerts, Email settings, we also email your weekly digest and alerts about your own results (for example an edit report or a new post on your website that is not on Pinterest yet). New app users also get a short series of getting-started tips by email in their first weeks, suggesting next steps in the app. Every tip has a link to stop them, and we stop at once when you use it. A reminder before a free trial ends is a service message and is sent in any case. Apart from this we do not send marketing emails to app users unless you separately agree to receive them.
The app sets one cookie, called psid. It keeps you signed in, it is only readable by our server (HttpOnly), it is sent only over encrypted connections, it expires after 30 days or when you sign out, and it is strictly necessary for the service, so no consent banner is needed. The app also stores display preferences, such as which menu sections are open or compact rows, in your browser’s local storage. This never leaves your device. We use no analytics, advertising or tracking technologies in the app. If a script error happens in the app, your browser sends us a short error report so that we can fix it: the error message, the name of the page (without anything after a question mark) and the app version. It does not include your name, your data or what you were looking at, and it is kept only in our short-lived server logs. The demo at app.sleuthlens.com/demo runs in your browser on made-up sample data: it sends nothing about you to us, sets no cookie, and keeps one flag in your browser’s session storage until you close the tab.
7. Your Pinterest account
If you connect your own Pinterest account, SleuthLens uses Pinterest’s official sign-in. You approve it on Pinterest’s own page, we never see your Pinterest password, and the connection can only read your analytics, pins and boards. You can disconnect in SleuthLens (we then delete the token and the data we saved from it) or remove SleuthLens under your Pinterest account’s connected apps.
SleuthLens cannot post or change anything on your Pinterest account. To check your pins, it also opens the web pages your pins link to, the way a visitor would, and reads their title, text and links.
8. Who receives your data
We do not sell or rent personal data. These companies handle data on our behalf, or you choose to send data to them:
| Company | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Hosts the server that runs the website, the app, the database and our outgoing email | Data centre in Helsinki, Finland (EU) |
| Cloudflare, Inc. | DNS and delivery network and security in front of sleuthlens.com, app.sleuthlens.com and api.sleuthlens.com. Sees the traffic to and from these sites | Global network; the company is in the United States |
| Mailnaptic | Our email platform, which we operate ourselves. Stores confirmed waitlist addresses and sends the launch email. If you accept statistics on the website, it also receives your visits (see section 4). Invitations, password resets and waitlist confirmations are sent directly from our own server | Our server in Helsinki, Finland (EU) |
| Anthropic PBC | Only if you add your own Anthropic key and use the AI writer: the keyword, and any draft or notes you give it, are sent to Anthropic to produce suggestions. This happens under your own account with Anthropic and its terms | United States |
| Stripe Payments Europe, Limited and Stripe, Inc. | Payment processing for subscriptions, invoices, VAT calculation and the customer portal where you manage your subscription. Stripe handles your card details and is responsible for them under its own privacy policy | Ireland and the United States |
| Pinterest, Inc. | Only if you connect your account: you approve the connection with Pinterest, which sends us your own analytics, pins and boards through its official API. Pinterest handles the sign-in and is responsible for it under its own privacy policy | Pinterest’s own, including the United States |
| The AI assistant you connect | Only if you connect one (for example Anthropic’s Claude, OpenAI’s Codex or Cursor): what it reads from your SleuthLens account at your request is processed by that provider under your own account with it and its terms | Their own, including the United States |
| Chrome Web Store (Google) and Firefox Add-ons (Mozilla) | Distribute the extensions. They receive standard install information under their own privacy policies; we do not receive it | Their own |
We may also disclose data if a law, a court or an authority requires it, or to protect our rights or the safety of others.
9. Transfers outside the EU
Our servers and our email platform are in the EU. Cloudflare, Stripe, Anthropic and the providers of AI assistants you choose to connect are, or have a part, in the United States. Where personal data reaches them we rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework for companies that are certified under it, or on the Standard Contractual Clauses approved by the Commission. You can ask us for details.
10. Security
- All traffic between your browser, the extensions and our servers is encrypted (TLS).
- Passwords are stored only as salted scrypt hashes; API keys and sign-in links as hashes; stored third-party keys are encrypted with AES-256-GCM.
- Sign-in attempts are limited per address and per network, and sign-in links and password-reset links work once and expire.
- Browser requests that change data must come from our own app, and the API accepts keys only as a bearer token.
- Users’ data is kept in separate database files. Nightly backups are kept on the server for 7 days.
- Server access is restricted to key-based logins for the operator.
No system is perfectly secure. If a breach puts your rights at risk we will tell you and the authorities as the law requires.
11. Your rights
Under the General Data Protection Regulation (GDPR) you have the right to:
- Access the personal data we hold about you and get a copy.
- Correct data that is wrong or incomplete.
- Erase your data (“the right to be forgotten”), for example by deleting your account.
- Restrict how we use your data in certain cases.
- Receive your data in a common, machine-readable format and have it passed to someone else (data portability). You can download it yourself in the app under Account, Your data: a ZIP of CSV files with everything we hold about your account, except your password, key secrets and tokens.
- Object to processing that is based on our legitimate interest.
- Withdraw consent at any time where we rely on it, such as for the waitlist.
To use any of these rights email hello@sleuthlens.com. We may ask you to prove who you are before we hand over or delete data. We answer within one month. If you are not happy with how we handle your data you can complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk) or to the data protection authority in your own country. We would appreciate the chance to put things right first.
12. Children
SleuthLens is a professional tool for adults. It is not meant for anyone under 18 and we do not knowingly collect data from children. If you think a child has given us data, tell us and we will delete it.
13. The browser extension
The extension adds the SleuthLens pin writer to Pinterest’s pin creation page. It keeps your API key in the browser’s extension storage and sends it, with each request, to api.sleuthlens.com only. In the Pin writer it sends the keyword you type and, to check and write for you, the title, description and link you have entered there. It does not read your messages, your passwords or any other page content, it does not run on other websites, and it contains no advertising or analytics code.
The data the extension receives from SleuthLens is used only to provide the extension’s features. We do not sell it, we do not use it to decide on credit or lending, and we do not use it for anything unrelated to the extension’s purpose. You can disconnect the extension at any time from its popup, which deletes the stored key from your browser.
14. Changes to this policy
If we change this policy in a way that matters to you we will tell you by email or in the app before the change takes effect, and we will update the date at the top. Older versions are available on request.
15. Contact
Phillip Stemann (sole proprietorship, CVR 34846227), Ved Stigbordene 41, 2450 Copenhagen SV, Denmark
Email: hello@sleuthlens.com