Privacy Policy

1. Controller and contact

Pancakes World is the public name of an international food, recipe, breakfast-culture, local-guide, media, and advertising platform. The controller is Andrii Sviridov, an individual based in Germany. No company or joint controller is designated.

Privacy requests can be sent to winmarketingpartner@gmail.com. Commercial and partner contact is provided only through the advertising and partner route, which uses the same approved project email.

2. Website delivery and server logs

When you request a page, the web server necessarily receives technical data such as your IP address, date and time, requested URL, response status, amount of data transferred, referrer when supplied, and browser or device user-agent information. The server uses this data to deliver the page, maintain security, diagnose faults, and prevent abuse.

The intended legal basis is the controller's legitimate interests in providing a secure and reliable website under Article 6(1)(f) GDPR. Log data is kept only for the period needed for delivery, security, incident investigation, and technical troubleshooting, unless a longer period is required to establish, exercise, or defend legal claims.

3. Cookies and consent choices

The site stores one first-party browser preference named pancakes-world-analytics-consent in local storage. It records whether you accepted or rejected optional analytics so the site can respect your choice.

Google Analytics does not load before consent. If you accept analytics, Google Analytics may set first-party cookies beginning with _ga. If you reject or revoke analytics, the site keeps the Google tag disabled, removes accessible _ga cookies for this domain, and reloads the page when needed to stop the loaded tag.

You can change your choice at any time with the Cookie settings control in the footer. Revocation does not affect the lawfulness of processing that occurred before it.

4. Google Analytics

With your consent under Article 6(1)(a) GDPR, Pancakes World uses Google Analytics 4 measurement ID G-T8FEYXS8Q1 to understand page use. The implementation sends a page-view event and may process the page URL and title, time of visit, referrer, campaign parameters, browser and device information, session statistics, a cookie-based client identifier, and approximate location derived from the connection.

Advertising storage, advertising user data, advertising personalisation, Google signals, and advertising-personalisation signals are disabled. The site does not send names, email addresses, or form contents to Google Analytics. Google states that GA4 uses IP addresses at collection time for routing and approximate location and discards them before they are logged.

Recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may process data in other countries under its applicable data-processing terms and transfer safeguards. You can prevent or stop this processing by rejecting or revoking analytics through Cookie settings.

5. Contact and advertiser enquiries

The site has no contact form. If you use the approved email link on /advertise/, your email service sends the message directly to winmarketingpartner@gmail.com. Pancake World may process the information you provide, such as your name, business contact details, organisation, website, requested service, message, approval role, and asset-rights information.

Depending on the request, the legal basis is Article 6(1)(b) GDPR for steps requested before a contract, Article 6(1)(c) for legal obligations, or Article 6(1)(f) for accountable business correspondence and the defence of legal claims.

6. Affiliate and sponsored-content measurement

No active affiliate tracking, advertising pixel, Pinterest Tag, or advertising-conversion measurement was found in the current website. Commercial pages describe future sponsored formats, but that description alone does not activate tracking.

If Pancake World later publishes an affiliate or sponsored destination, the relationship will be visibly disclosed and paid links will use appropriate link attributes. New advertising tags, cross-site tracking, or conversion measurement require a separate privacy and consent review before activation.

7. Pinterest links, OAuth, and API processing

Organic links and campaign parameters

A link from Pinterest to Pancakes World may include UTM campaign parameters. The web server receives the requested URL and may receive Pinterest as the referrer. If you consent to Google Analytics, those campaign parameters may also be included in analytics reporting. UTM values must not contain names, email addresses, or other direct personal identifiers.

Owner-only publishing integration

Pancake World is preparing an owner-only OAuth integration called Pancake World Publisher. It is not connected or active yet. Once the owner connects it:

• OAuth will be used; Pancake World will never collect the owner's Pinterest password.
• Only boards:read, boards:write, pins:read, pins:write, and user_accounts:read will be requested.
• OAuth tokens will be stored only in protected n8n credential storage and will not be written to project files or logs.
• API data will be used only for the connected Pancake World account.
• The integration will create and verify owner-approved Pins on boards owned by the connected account.
• It will read account, board, Pin, and analytics data only when authorised and only as needed for publishing, verification, duplicate prevention, and performance reporting.
• Pinterest API data will not be sold.

The owner can revoke the integration in Pinterest account settings and request deletion of the local credential. Revocation stops future API access. Pinterest separately processes data under its own privacy policy.

8. n8n and PostgreSQL

The publishing system uses a self-hosted n8n service and PostgreSQL database on local, non-publicly exposed project infrastructure. Eleven Pinterest workflows are imported but inactive. No Pinterest credential exists, no Pinterest API response or analytics snapshot has been stored, and no Pin has been published.

Once the owner authorises and connects the integration, n8n may process approved package instructions, account and board identifiers, Pin metadata, API response status, verification results, approval records, error records, and analytics metrics. PostgreSQL may store the corresponding package, approval, idempotency, cooldown, publication, verification, and metric records. Reusable OAuth tokens belong only in protected n8n credential storage.

9. Processors, recipients, and international transfers

• Website hosting: a contracted hosting provider operates the server infrastructure that receives page requests and may keep operational logs. The provider's legal identity and transfer position are not stated in the project records used for this policy. Hosting is therefore described here as the verified recipient category for website delivery, security, and operational logging.
• Google Analytics: Google Ireland Limited receives analytics data only after consent. Google's terms provide data-processing and transfer safeguards, including the EU-US Data Privacy Framework and, where applicable, Standard Contractual Clauses.
• Pinterest: only after OAuth connection, Pinterest will issue tokens and provide or receive API data required for authorised operations. Pinterest describes adequacy decisions, the EU-US Data Privacy Framework, and Standard Contractual Clauses for relevant transfers.
• n8n and PostgreSQL: these are self-hosted software components in the current implementation, not separate external recipients.

10. Retention

• Consent preference: until you clear browser storage or replace your choice.
• Google Analytics data: according to the property's configured retention setting and any aggregate-report retention applied by Google. The exact configured period is not evidenced in the project records used for this policy.
• Server logs: only as long as needed for delivery, security, fault diagnosis, and incident handling, subject to the hosting configuration.
• Enquiries: for the enquiry and any resulting relationship, then as required for contractual, tax, accounting, limitation, and legal-defence obligations.
• OAuth tokens: until expiry, rotation, revocation, disconnection, or deletion of the credential, whichever requires removal first.
• Pinterest API response data and metrics: only as long as needed for publishing verification, duplicate prevention, reporting, security, and legal accountability.

11. Your rights and complaint rights

Subject to the GDPR's conditions and exceptions, you may request access to your personal data, rectification, erasure, restriction, and data portability. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing.

Send privacy requests to winmarketingpartner@gmail.com. You may also lodge a complaint with a data-protection supervisory authority, particularly in the EEA country where you live, work, or believe an infringement occurred.

12. Changes to this policy

This policy will be updated when processing changes, a new processor is activated, the Pinterest integration is connected, or legal requirements change. The date at the top identifies the current version. Material changes will be reviewed before publication.