AtlasCore Market

Pinterest Shopping Legal addendum · Legal version v1 · Last updated: July 13, 2026

Pinterest Shopping DPP Compliance

Last updated: August 24, 2026

AtlasCore is an independent software application. Pinterest and related marks are trademarks of Pinterest, Inc. AtlasCore is not sponsored, endorsed, or affiliated with Pinterest.

This addendum describes AtlasCore’s Pinterest-owned data-protection practices for connected Pinterest Shopping merchant accounts.

Retention schedule

AtlasCore runs a Pinterest-owned retention worker (`pinterest_pii_retention_service`) that redacts stored Pinterest operational data on the following clocks:

- 30 days after a terminal state: catalog items that are inactive, deleted, or delisted, measured from the inactive/delist status change (`inactive_since`), and `channel_orders` rows in a terminal delivery or completion status (`delivered`, `completed`, `cancelled`, or `fulfilled`)

  • 90 days for open orders: `channel_orders` rows that are not in a terminal state, measured from the cache pull timestamp
  • Active / in-stock catalog items are never redacted by the catalog retention clock

Redaction overwrites catalog JSON with a secure marker and replaces buyer-bearing order payloads with an encrypted redaction blob. Purge events are recorded in the enterprise audit log.

Catalog allowlisting

Cached Pinterest catalog rows persist only an operational allowlist:

- `item_id`

  • `title`
  • `description`
  • `price`
  • `availability`
  • `link`

Seller-facing `GET /api/v1/pinterest/catalogs/` and `GET /api/v1/pinterest/items/` return this minimized cache row contract. They do not proxy unrestricted Partner catalog JSON.

Anti-rehydration

When a catalog row has already been marked DPP-redacted, later catalog syncs and webhook ingest skip overwrite. AtlasCore does not restore previously redacted catalog blobs.

Webhook ledger

The Pinterest webhook ledger stores an encrypted operational envelope only (`event_id`, `event_type`, `merchant_id`, `object_id`, `status`). Buyer blocks and unrestricted notification bodies are not retained on the ledger.

Isolation model

Pinterest Shopping data is stored on a B2C seller base (the signed-in user). An optional enterprise workspace slug may further scope the connection (`tenant_id`). Personal-mode connections may have a null workspace binding. AtlasCore does not treat `X-Tenant` as the only isolation key.

Deauthorization

Merchant deauthorization events resolve every matching Pinterest account for the merchant identifier across workspaces. AtlasCore persists a durable compliance receipt, then executes the tenant-scoped Pinterest purge for each account.

Seller controls

- Disconnect Pinterest Shopping in AtlasCore to purge encrypted tokens and cached catalog metadata for the active connection

See also Pinterest Shopping Data Handling and our Privacy Policy.