Privacy Policy

When you visit postos.space. Usage analytics through PostHog: the pages you view, the demo controls you use, and your approximate location, browser and device. If you book a demo, the name, email and details you enter go to Cal.com, our scheduling provider. If you type your email into our “book a demo” form, we pass it to Cal.com only to pre-fill the booking.

Account information. Your name, email address and password when you sign up for the app. We store only a one-way hash of your password (argon2id), never the password itself.

Workspace and brand content. What you put into PostOS: brand profiles (tone, audience, industry, guidelines, do and don’t lists), campaigns, drafts, captions, scheduled and published posts, the images and videos you upload, and your conversations with the PostOS assistant.

Connected social accounts. When you connect a social account, we receive and store the platform’s account ID, account name, profile picture, follower count and the permissions you granted, along with the access and refresh tokens that let us act for you. Tokens are encrypted before they are stored. We also store analytics for that account and for posts published through PostOS, such as impressions, reach, views, likes, comments and shares.

Payment information. Your plan, billing period, amount, currency and the order and payment references from our payment processor, Razorpay. Card, UPI and bank details go directly to Razorpay; PostOS never receives or stores them.

Session and technical information. When you sign in we record the IP address and browser (user agent) of that session so you and we can spot unfamiliar sign-ins. Our servers also keep standard request logs for security and debugging.

Public information about other businesses. If you use competitor and trend research, PostOS reads publicly available information about the business or creator Instagram accounts you name (or approve from our suggestions), such as their public posts, captions, hashtags, and like, comment and view counts. It does this through Meta’s official Business Discovery API. We do not collect information about private individuals’ accounts.

• To provide PostOS: create your workspace, draft and adapt posts, run approvals, schedule and publish to the accounts you connect, and show you analytics.
• To publish only what you approve. PostOS publishes to a social account only after someone in your workspace with permission approves the post.
• To suggest content: studying how your past posts performed and what is working for the accounts you track, so the assistant can propose better posts.
• To process payments and keep billing records.
• To understand how people use our website so we can improve it, and to schedule the demos you book.
• To keep the service secure: authentication, abuse and fraud prevention, rate limiting and troubleshooting.
• To communicate with you about your account, security and important changes to the service.
• To meet legal obligations and enforce our terms.

PostOS uses large language models and image models to write, adapt and check posts. To do this, we send the relevant content to our AI providers: your prompts, brand profile, drafts, assistant conversations, and the performance and public competitor signals the assistant needs. Our providers today are Google (Gemini API), Anthropic (Claude API) and an image-generation service we run on Cloudflare.

These providers process the content to return a result for us, under their commercial API terms. We do not sell your content, and we do not use it to train AI models of our own. AI output can be wrong, so PostOS always puts drafts in front of a person for approval before anything is published.

You choose which accounts to connect: X, Facebook, Instagram, LinkedIn, Threads, Bluesky, Mastodon, YouTube, TikTok, Pinterest and Dribbble. We request only the permissions needed to publish your posts and read their analytics. We use the data we receive only to provide PostOS features to you, and we do not sell it or use it for advertising.

You can disconnect an account in PostOS at any time. Doing so deletes the stored access and refresh tokens straight away. You can also revoke PostOS’s access from the platform itself:

• Google / YouTube
• Facebook and Instagram (Business Integrations)
• X (Connected apps)
• LinkedIn (Permitted services)
• TikTok, Pinterest, Threads, Dribbble, Bluesky and Mastodon: in each app’s security, apps or connected services settings.

YouTube. PostOS uses YouTube API Services. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and Google’s handling of your data is described in the Google Privacy Policy. When you disconnect YouTube or revoke access, we delete the tokens immediately and delete the other YouTube data we stored within 30 days, unless you reconnect.

Google API data. PostOS’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell or rent your personal information. We share it only in these cases:

Images on our website are served by Unsplash, which receives your IP address and browser details when they load. We may also share information when the law requires it, to protect the rights, safety and property of PostOS, our users or others, or as part of a merger, acquisition or sale of assets. In that case we will tell you before your information becomes subject to a different privacy policy.

Inside a workspace, your name, the posts you create and approve, and the content you upload are visible to the other members of that workspace.

We do not use advertising cookies. Our website uses PostHog analytics cookies; the PostOS app uses only what it needs to keep you signed in and remember your settings.

You can block or delete cookies in your browser settings; the website still works without them. Cal.com and Razorpay may set their own cookies when their windows open. Those are covered by their privacy policies.

• Account and workspace content: for as long as your account is active, or until you delete it.
• Social account tokens: until you disconnect the account, when they are deleted immediately.
• Sign-in sessions: up to 30 days, or until you log out.
• Competitor and trend research data: deleted automatically after 90 days.
• Website analytics: for the retention period of our PostHog plan, or until you ask us to delete it.
• Payment records: as long as tax and accounting laws require.
• After you delete your account: we delete or anonymise your personal information within 30 days, except what we must keep by law. Copies in backups are removed as those backups expire.

Depending on where you live, including under India’s Digital Personal Data Protection Act, 2023 and the EU and UK GDPR, you may have the right to:

• access the personal information we hold about you and get a copy of it;
• correct or update it;
• delete it;
• withdraw consent you have given, for example by disconnecting a social account;
• object to or restrict certain processing;
• nominate someone to exercise these rights for you if you are unable to; and
• complain to your local data protection authority.

You can edit your profile, brand content and posts, delete uploads and conversations, and disconnect social accounts in the app. For anything else, email privacy@postos.space. We will respond within 30 days and may need to confirm your identity first.

To delete your PostOS account and the data linked to it, including data received from Facebook, Instagram, Threads, YouTube or any other connected platform:

1. Email privacy@postos.space from the address you signed up with, with the subject “Delete my account”.
2. We confirm the request and delete your account, workspace content, connected-account tokens and analytics within 30 days.
3. We email you when the deletion is complete.

To remove only one platform’s data, disconnect that account in PostOS under Connections, or revoke PostOS’s access in that platform’s settings (see “Data from social platforms”), then email us if you also want its stored posts and analytics deleted.

We protect your information with encryption in transit (HTTPS), encryption of social-account tokens at rest, hashed passwords and API keys, httpOnly session cookies, role-based access inside workspaces and restricted access to production systems. No system is perfectly secure. If we learn of a breach that affects your personal information, we will notify you and the relevant authorities as the law requires.

We store app data in India. Some of our providers, including our AI, analytics and scheduling providers, process data in other countries such as the United States. When we transfer data abroad, we rely on our providers’ contractual commitments to protect it and comply with the transfer rules that apply to us.

PostOS is a business tool and is not meant for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us information, email privacy@postos.space and we will delete it.

We will update this page when our practices change and revise the effective date above. If a change is significant, we will also tell you by email or in the app before it takes effect.

Questions, requests or complaints about privacy go to our grievance officer at privacy@postos.space. We acknowledge complaints within 72 hours and aim to resolve them within 30 days.