Privacy Policy
Effective Date: October 22, 2026
Who we are
Samantha Diaz DBA The Hot Mess Collective (THMC) (WE, US)
THMC provides business infrastructure, systems and operations consulting, CRM and automation work, websites, digital products, free diagnostics, educational content, and related services through THMC Studio, Shop the Systems, Biz Notes, and other THMC resources.
Our website is thehotmesscollective.com.
Questions about this Privacy Policy or privacy requests may be sent to sam@thehotmesscollective.com.
Information we collect
Depending on how you interact with THMC, we may collect information you provide directly, including your name, email address, phone number, business name, website or social links, application or intake responses, diagnostic responses, messages, purchase or transaction information, and other information you choose to submit through forms, email, checkout, or service interactions.
We may also receive technical and usage information when you use our website or interact with our communications. Depending on the service, technology, and your settings, this may include IP address, browser or device information, pages or content viewed, referring pages, timestamps, approximate location derived from technical data, and interactions with website content or emails.
Please do not send passwords, complete payment-card numbers, government identification numbers, medical records, or other unnecessary sensitive information through ordinary website forms or email.
How we use information
We may use information to:
Respond to inquiries and review Studio applications.
Provide services, diagnostics, resources, digital products, and customer support.
Deliver requested resources or purchased materials.
Process or reconcile payments and maintain business records.
Send transactional messages and marketing communications consistent with your choices.
Maintain subscription preferences and honor opt-outs.
Operate, secure, troubleshoot, and improve our website, systems, products, and services.
Measure website, campaign, referral, content, and product performance.
Route information between connected business systems.
Prevent fraud, misuse, or unauthorized access.
Comply with legal obligations and enforce our agreements.
Service providers and business systems
THMC uses third-party providers that may process information on our behalf or under their own terms and privacy policies.
Depending on the interaction, current providers may include:
Squarespace — website hosting, ecommerce, website forms, and site functionality.
Sender — email subscriber management, form submissions, delivery of free resources, and current nurture communications.
MailerLite — legacy or existing email marketing workflows, subscriber management, and delivery of certain email results.
Tally — forms, applications, intake, and certain diagnostic or legacy form experiences.
Stripe — payment processing where Stripe is the payment method presented.
Squarespace Payments — payment processing where enabled and presented through Squarespace Commerce.
Make — workflow automation and routing between connected systems.
Airtable — CRM and operational records where used.
Google Workspace, including Gmail — business communications and related records.
Notion — internal documentation, project records, operational systems, and planning where used.
Slack — client or team communication where it is the designated communication channel.
Metricool — social media management, analytics, and measurement where active.
Pinterest — Pinterest OAuth and the local Sandbox scheduler described below, plus content distribution, referral measurement, and tracking technologies where enabled.
The specific providers involved depend on what you do on the site and which THMC service or resource you use.
Third-party providers may collect, retain, and use information according to their own privacy policies and terms. THMC does not control the privacy practices of third-party websites, platforms, or services.
Pinterest and The Hot Mess Collective Scheduler
The Hot Mess Collective Scheduler is a local THMC tool for preparing, reviewing, and releasing Pinterest Pins from THMC-approved website and campaign content. It is currently connected to Pinterest’s Sandbox environment. Production publishing is disabled.
When you connect Pinterest, the scheduler uses Pinterest OAuth. You authorize the connection on Pinterest; THMC does not ask for or collect your Pinterest password, session cookies, or other Pinterest login credentials. The current connection requests access to boards and Pins through these scopes: boards:read, boards:write, pins:read, and pins:write. The scheduler uses that access to read the boards available for selection, create an approved image Pin, and read back the resulting Pin so the local record can be reconciled.
Access tokens, refresh tokens, and the Pinterest app secret are held in the local Python server process while the scheduler is running. They aren’t stored in browser storage, source files, SQLite, saved configuration, or exported evidence. This is a local, owner-operated tool—not a public, multi-user service—and credentials are not held in a certified encrypted vault. When the local server stops or restarts, active credentials disappear and the Pinterest connection must be established again.
Where Pinterest supports refresh for a valid connection, the scheduler attempts to refresh before a protected request. If a refresh fails, credentials expire, or Pinterest permissions are revoked, the affected releases are paused and the connection must be established again. Reconnecting doesn’t automatically release queued work: items must still pass the scheduler’s review and release checks.
The active scheduler retains THMC-originated operational records: the source record and version, source and Pin approvals, approver and local approval time, THMC-approved title and description, destination URL and tracking parameters, a THMC-side board alias, image reference and checksum, campaign or offer information, the separate release decision, schedule, local job and attempt identifiers, locally generated timestamps, audit events, and a local final disposition. Pinterest-returned Pin IDs, board identifiers and metadata, account metadata, HTTP response details, and readback payloads are handled transiently in memory and are not retained in the active database, browser storage, saved configuration, logs, or new operational exports. The scheduler calls Pinterest again when current Pinterest information is needed. Credentials and raw token responses are not included in these records.
A Pin needs more than a general approval before it can be released. The scheduler requires approval of the exact source and version, approval of the exact Pin, and a separate, explicit “Release this Pin” decision. A material edit after approval makes the item ineligible again. Before release, the server checks the approved source and version, creative, board, destination URL, checksum, environment, connection health, scopes, and production-disabled state. There is no bulk “Release All” path.
You can disconnect Pinterest from the scheduler. Disconnecting clears local access, refresh, expiry, and granted-scope state, invalidates pending authorization and release selections, and pauses affected Pinterest queue records. It does not delete Pins that have already been published to Pinterest. The current local disconnect does not claim to revoke the provider-side authorization; where Pinterest does not support that operation for this token type, you’ll need to revoke access through your Pinterest account settings.
THMC retains its own operational source snapshots, approvals, release decisions, local attempt history, and audit records for history and security review unless an operator safely removes them. There is no automatic deletion deadline for these THMC-originated records. Earlier Sandbox acceptance evidence and pre-change backups are isolated outside the active integration for internal and developer-access review; they are not used as a runtime cache or as authority to retry a release. Unattempted local review records may be deleted. Local records for attempted, completed, or uncertain releases remain protected against accidental deletion and repeat creation. The scheduler does not automatically delete Pins from Pinterest.
The scheduler uses practical local safeguards, including a loopback-bound server, HTTPS for its Pinterest connection, a hard block on production publishing, one-Pin release controls, server-side approval and claim checks, and controlled evidence records. Logs and evidence are designed to exclude access tokens, refresh tokens, authorization codes, Authorization headers, cookies or session identifiers, client secrets, and known secret values across the tested paths. No method of transmission, storage, or local processing is completely secure, and this wording does not promise forensic erasure from every operating-system or third-party diagnostic surface.
Pinterest is a separate third-party platform. THMC does not own or control Pinterest, its policies, its API, its availability, or its data practices. THMC isn’t Pinterest and this scheduler isn’t endorsed, sponsored, or administered by Pinterest. Your use of Pinterest remains subject to Pinterest’s own terms and policies.
Forms and diagnostics
THMC may use forms and diagnostics to help you identify operational friction, request services, receive resources, or provide information needed for a business engagement.
Examples include Studio applications and free resources such as the Scope Creep Detector, Client Onboarding Friction Audit, and What Needs an SOP?
Information submitted through these tools may be used to deliver the requested resource, route you into the appropriate email sequence, respond to an inquiry, understand how THMC resources are being used, and improve related products or services.
Submitting a diagnostic does not automatically make you a Studio client or create a professional-client relationship.
Email communications
If you subscribe to THMC emails, request a free resource, submit a form that includes email delivery, purchase a digital product, or otherwise consent to communications, THMC may use Sender, MailerLite, or another disclosed business system to store your contact information and send messages.
Different THMC resources may use different email systems because some older workflows remain active while newer funnels use Sender.
You may unsubscribe from marketing emails using the unsubscribe link included in the message.
Unsubscribing from marketing does not necessarily stop transactional, purchased, service-related, account-related, or other communications necessary to fulfill a request or existing business relationship.
Purchases and payment information
When you purchase a THMC product or service, payment information may be processed by Squarespace, Stripe, Squarespace Payments, or another payment provider presented at checkout.
THMC generally does not receive or store your complete payment-card number. Payment providers process that information under their own terms and privacy policies.
THMC may retain transaction details such as your name, email address, product purchased, payment status, transaction date, and related business records.
Cookies, analytics, and tracking technologies
Squarespace and services connected to the THMC website may use cookies, pixels, tags, scripts, or similar technologies for website operation, security, preferences, analytics, campaign measurement, and referral attribution.
THMC currently uses website and social measurement tools such as Squarespace Analytics and Metricool. Other measurement technologies, including Pinterest tracking or conversion tools, may be enabled, disabled, or adjusted as THMC tests and measures traffic, signups, leads, applications, and purchases.
See the Cookie & Tracking Notice for more information.
Your browser or device may also offer controls for managing certain cookies or tracking technologies.
Affiliate and referral links
THMC may use affiliate, partner, or referral links.
When you follow one of these links, the destination provider may use cookies, referral codes, tags, or other attribution technology to determine whether a qualifying purchase or signup came from THMC.
THMC does not control how a third-party provider performs its own attribution or handles information after you leave the THMC website.
See the Affiliate Disclosure for more information.
How we disclose information
We may disclose information to third parties when reasonably necessary to operate THMC, including:
Service providers that host, automate, measure, communicate, or support the business.
Payment and ecommerce providers.
Delivery and fulfillment providers.
Professional advisers where appropriate.
Authorities or other parties when legally required.
Parties involved in a merger, acquisition, financing, sale, restructuring, or other business transfer.
Others where reasonably necessary to protect THMC, our users, our systems, or the rights and safety of another person.
THMC does not sell or rent personal information for money.
We do not make a blanket representation about statutory definitions of “sale,” “sharing,” targeted advertising, or similar concepts because those definitions vary by jurisdiction and may depend on the technology being used.
Retention and security
We retain information for as long as reasonably necessary for the purpose for which it was collected, including service delivery, product fulfillment, business records, accounting, dispute resolution, legal obligations, security, and legitimate operational needs.
Different systems may retain information for different periods depending on their function and configuration.
We use reasonable administrative, technical, and organizational safeguards appropriate to a small online business.
No method of transmission, storage, or online processing is completely secure, and absolute security cannot be guaranteed.
Your choices and privacy rights
Depending on where you live and which laws apply to THMC, you may have rights relating to your personal information, including rights to request access, correction, deletion, or other available privacy choices.
California residents may exercise any rights available to them under applicable California privacy law. THMC will not unlawfully discriminate against a person for exercising an applicable privacy right.
To make a privacy request, email sam@thehotmesscollective.com.
We may need to verify your identity before completing certain requests, and we may retain information where permitted or required by law.
You may also:
Unsubscribe from marketing emails using the link provided in the message.
Use available browser or device controls to manage certain cookies.
Contact us if you believe information associated with you is inaccurate or should be reviewed.
Children
THMC’s website, products, content, and services are not directed to children under 13.
We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to THMC, contact us so we can review and delete it where appropriate.
External links
THMC may link to third-party websites, tools, products, marketplaces, referral programs, and other resources.
Once you leave the THMC website, the collection and use of information by those third parties are governed by their own privacy policies and terms, not this Privacy Policy.
Changes to this policy
We may update this Privacy Policy as our tools, services, products, technology, business practices, or legal obligations change.
The current version and effective date will be posted on this page.
Contact
The Hot Mess Collective
Samantha Diaz DBA The Hot Mess Collective