Privacy Policy

Personal Data: Any information about an individual from which the individual can be identified (for example, name, email, social media username, profile picture).

Usage Data: Information collected automatically when you use our Service, including device and browser information, pages visited, and timestamps.

Cookies: Small data files stored on your device by websites or apps, used to recognize your preferences and track activity. Cookies that identify you can be treated as personal data under the GDPR.

Data Controller: We (the company operating this Service) determine the purposes and means of processing your data.

Data Subject / User: You, the person using the Service and the subject of any Personal Data.

We collect several types of information to provide and improve the Service:

Personal Data: When you register or connect social media accounts, we may collect your name, email address, and any other information you choose to provide (e.g. profile data). We may also collect information from the social media accounts you link (such as your social media username, profile picture, and content you post) in order to manage your social media presence and provide analytics or machine learning features (e.g., optimizing captions).

Google Account Data: When you sign in with Google, we collect the Google account information you authorize, including your name, email address, and profile picture. We use this Google profile information strictly to authenticate you and to provide the Service features you request (e.g. account creation, profile setup). We do not use your Google account data for any other purpose.

Social Media Content and Data: Content (posts, comments, images, etc.) and associated metadata from connected social media accounts may be processed to deliver the Service (e.g. scheduling posts, providing analytics) and to train machine learning models for features like caption suggestions. We do not sell or share this content except as necessary to provide the Service.

Usage and Analytics Data: We automatically collect Usage Data such as pages you visit in the Service, the time and date of your visit, and your actions (e.g. clicks, features used). This includes technical data like your device type, operating system, browser type, and unique device identifiers. We use Google Analytics and Vercel's analytics tools to gather aggregate usage statistics. Google Analytics 4, for example, does not log your IP address and only derives coarse geo-location (city, region, country) before discarding the IP. Vercel Web Analytics uses only anonymized data and does not use cookies. Vercel Speed Insights similarly collects only anonymous performance metrics (e.g. page load times, connection speed) and country-level information, without identifying individual users.

Cookies and Tracking: We use cookies and similar technologies to improve the Service. Cookies may store a unique identifier and remember your preferences. See the Cookies and Tracking section below for details.

Advertising and Measurement Data: If you consent to marketing cookies, we load advertising measurement tags ("pixels") from our advertising partners: Google (Google Ads), Meta Platforms (Facebook and Instagram), TikTok and OpenAI (ChatGPT advertising). These partners set cookies on your device (for example Meta's _fbp and _fbc, TikTok's _ttp, and OpenAI's __oppref and __obref) and receive information about your visit: the pages you view, the actions you take on our site (such as viewing pricing, creating an account, or starting a trial), your IP address, your browser user agent, and the advertising click identifier that brought you to us (for example gclid, fbclid, ttclid or oppref).

For the same purpose, and again only with your marketing consent, we send a matching copy of these conversion events to those partners from our own servers rather than from your browser. Those server-side copies can include your email address and your Postify account identifier in irreversibly hashed form (SHA-256), which lets a partner recognise a customer it already knows without us disclosing the address itself. Hashing reduces the risk but does not make the data anonymous, so we continue to treat it as Personal Data. We do not enable our advertising partners' "automatic advanced matching" features, which would collect form fields we have not described here.

Advertising Audience Lists: Separately from the tags above, we upload lists of customer and subscriber email addresses, again irreversibly hashed, to Google, Meta, LinkedIn, Pinterest and OpenAI on a recurring basis. We use these lists to exclude existing customers from advertising they do not need to see, to reach lapsed customers, and to help our partners find audiences similar to our customers. This upload happens on a schedule rather than in your browser, so it is not governed by the cookie banner: see Your Rights below for how to object to it, and Contact Us to have your address excluded.

We use your information only as necessary to provide, maintain, and improve the Service, including for the following purposes:

• Service Provision: To operate the Service and enable its features (e.g. posting to social media, scheduling, analytics dashboards).
• Communication: To contact you about your account, respond to support requests, and send administrative messages (account confirmations, security alerts).
• Notifications: To notify you of important changes to the Service or policy updates.
• Machine Learning: To analyze data and train algorithms that improve our features (for example, to optimize post captions or recommend content). Any automated decision-making is designed to improve functionality and you will be informed of its significance and consequences.
• Research and Development: To analyze usage trends and customer needs so we can improve the Service.
• Compliance and Security: To prevent fraud and abuse, and to comply with legal obligations. For example, we may analyze usage patterns to detect unauthorized access.
• Marketing Communications: If you opt in, we may use your contact information to send newsletters or promotional materials about our products and services (you can unsubscribe at any time). We will not sell your Personal Data or use it for marketing without your permission.
• Advertising and Retargeting: To measure whether our advertising works and to decide which advertising you are shown. This covers the measurement tags and server-side conversion events described above, which tell an advertising partner that a click on one of its ads led to a signup, a trial or a subscription, and the hashed audience lists we upload so that we can exclude existing customers from our advertising and reach people similar to them. The browser-based part of this happens only with your consent to marketing cookies; the audience lists rest on our legitimate interest in marketing our own service efficiently, and you can object to it at any time.

Apart from the advertising partners named in this policy, and only in the ways described here, we do not share personal data with third parties for their own marketing. Our advertising partners act as independent controllers for some of this data and may use it in ways described in their own privacy policies. We do not sell or rent any Google user data under any circumstances, and we never disclose the content of your connected social media accounts to an advertising partner. We only disclose data as described below or as required by law.

We retain your Personal Data only as long as needed for the purposes outlined above. We determine retention periods based on the nature of the data and legal requirements. For example, we keep billing and account records for financial and legal compliance. OAuth authentication data (including Google access tokens) are retained only as long as necessary to provide the Service and are automatically deleted when you disconnect your account or delete your Postify account. When personal data is no longer needed, we securely delete or anonymize it.

Our servers and service providers may be located worldwide. If you are outside our home country, your Personal Data may be transferred to, stored, or processed in countries with different data protection laws.

The recipients established in the United States currently include Google, Meta Platforms, TikTok, OpenAI, LinkedIn, Pinterest, Stripe, WorkOS, Vercel, Sentry and PostHog. For these transfers we rely on the European Commission's Standard Contractual Clauses, and, where the recipient is certified under it, on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. We combine those with the supplementary technical measures described in this policy, in particular the irreversible hashing of email addresses and account identifiers before they reach an advertising partner. You may request a copy of the relevant safeguards by contacting us.

We use third-party service providers to support the Service. Most process your data only on our behalf and are contractually bound to protect it; the advertising partners listed below are the exception, and act as independent controllers for part of what they receive.

• Analytics: Google Analytics (Google LLC), PostHog (product analytics) and Vercel's analytics tools, to analyze Service usage. Google Analytics does not store IP addresses. Vercel's Web Analytics only stores anonymized visitor data and uses no cookies. Vercel Speed Insights collects only anonymous performance data.
• Error Monitoring: Sentry, to record diagnostic information when something in the Service fails. Reports can include your account identifier, the page you were on and technical details of the error.
• Advertising Partners: Google (Google Ads), Meta Platforms (Facebook and Instagram), TikTok and OpenAI (ChatGPT advertising) for measurement and retargeting, plus LinkedIn and Pinterest, which receive the hashed audience lists only. With your marketing consent the measurement partners receive the data described under Information We Collect, both from tags in your browser and as a matching server-side copy. The hashed email lists described there go to Google, Meta, LinkedIn, Pinterest and OpenAI. Each has its own privacy policy and, for some of this data, its own responsibilities as a controller.
• Consent Management: Cookiebot (Usercentrics), which presents the cookie banner and records your choice so we can honour it.
• Authentication: WorkOS, which handles sign-in and account security.
• Hosting and Infrastructure: We rely on cloud hosting (such as Vercel's platform). These providers may collect system logs or crash reports.
• Payment Processors: If you make payments through the Service, we use PCI-compliant processors (e.g. Stripe, Apple Pay) and do not store your payment card details. (These processors have their own privacy policies.)

We may share your Personal Data in the following situations:

• Legal Compliance: If required by law, regulation, or valid governmental request, we may disclose your data. We will respond to lawful requests by public authorities (e.g. court orders, subpoenas).
• Protecting Rights: We may share information if needed to protect our rights, property or safety, or the rights, property or safety of others. This includes enforcing our terms of use or preventing fraud.
• Business Transfers: If our company is involved in a merger, acquisition, or sale of assets, your Personal Data may be transferred as part of that transaction. We will notify you before any such transfer.
• Service Providers: We share data with vendors who perform services on our behalf (as noted above). They have access only to the data necessary to perform their functions and are not allowed to use it for other purposes.

Google Account Data: We do not share, sell, or rent your Google account information to third parties for their own marketing, advertising, or any other purposes beyond those listed above. Your Google account data is used solely for authentication and providing our Service to you.

We use cookies and similar technologies to improve your experience. Cookies are strictly necessary, functional, performance, or marketing as defined below.

• Strictly Necessary (Essential) Cookies: These are essential for the Service to function (e.g. secure login sessions, anti-fraud checks). You cannot opt out of these cookies, but we explain their use and necessity.
• Preference Cookies: Also known as "functionality cookies," these remember choices you make (such as preferred language or region). They allow the Service to provide personalized features.
• Analytics/Performance Cookies: These collect information about how you use the Service (pages visited, feature usage) in aggregated, anonymized form. We use Google Analytics, PostHog and Vercel analytics tools for this purpose. Google Analytics and the Vercel tools do not identify you individually. PostHog, which we use inside the product, does link activity to your Postify account so that we can see how the features you use actually behave; it is loaded only with your consent to statistics cookies.
• Marketing/Advertising Cookies: We do use these, and only with your consent. When you accept marketing cookies we load measurement tags from Google (Google Ads), Meta Platforms (Facebook and Instagram), TikTok and OpenAI (ChatGPT advertising), which set cookies on your device so those partners can tell that an ad they showed you led to a visit, a signup or a subscription, and so they can show you our advertising again on their own platforms. If you decline, these tags are never loaded and none of their cookies are set: they are blocked before they run, not merely silenced afterwards. You can change your mind at any time through the cookie settings link in the site footer.

When you first visit, we obtain your consent for non-essential cookies via a banner (in compliance with GDPR and the ePrivacy Directive). You may manage your cookie preferences at any time: most browsers allow you to refuse or delete cookies. For example, you can learn how to manage cookies at allaboutcookies.org. Note that blocking cookies may break certain features of the Service. To withdraw consent for analytics/marketing cookies, you can usually do so in your browser settings or by using opt-out add-ons (e.g. Google Analytics Opt-out). We make it as easy to withdraw cookie consent as to give it.

Depending on where you live, you may have the following rights regarding your Personal Data:

• Access: You can request a copy of the personal data we hold about you.
• Correction: You can request that we correct any inaccurate or incomplete data.
• Deletion: You can request that we delete your personal data from our systems (the "right to be forgotten"), subject to legal exceptions (e.g. data we must retain for legal compliance).
• Portability: You can request a copy of your data in a common electronic format so you can transfer it to another service.
• Restriction: You can request that we temporarily limit how we use your personal data.
• Objection: You can object to our processing your data for certain purposes, including direct marketing, online advertising and the measurement and audience activity described in this policy. An objection to direct marketing is always honoured. To stop the browser-based advertising tags, decline or withdraw marketing consent in the cookie banner; to be excluded from the hashed advertising audience lists, contact us and we will remove you.
• Withdraw Consent: If we are processing your data based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing done before withdrawal.
• Lodge a Complaint: You have the right to file a complaint with a data protection authority if you believe we are not complying with applicable laws.

If you wish to exercise any of these rights, please contact us (see Contact below). We will verify your identity before fulfilling such requests. We aim to respond within one month, as required by law.

We implement security measures (encryption, access controls, secure servers) to protect your data, including your OAuth authentication tokens (including Google OAuth tokens), and are transmitted over TLS 1.2+ connections to our servers. However, no system is 100% secure. We cannot guarantee the absolute security of your information. In the event of a data breach, we will follow applicable laws in notifying affected users and authorities. Only authorized personnel have access to your Personal Data, and they are bound by confidentiality obligations.

Our Service is available globally. If you are accessing the Service from the EU or other regions with data protection laws, please note that your data will be processed in compliance with those laws (e.g. GDPR). By using the Service, you consent to the transfer of information to countries outside your own jurisdiction (such as the U.S. or Canada) and storage on servers located there, with appropriate safeguards in place.

The Service is not intended for children under 13. We do not knowingly collect personal information from users under 13. If we learn that we have collected such information without parental consent, we will promptly delete it. If you believe a child under 13 may have provided us with personal data, please contact us to have it removed.

We may update this Privacy Policy occasionally to reflect changes in our practices or legal requirements. When we make changes, we will update the "Effective Date" at the top and notify users (e.g. via email or an in-app notice) before the changes take effect. Please review this policy periodically for any updates.

In accordance with GDPR and ePrivacy laws, we provide the following details about our use of cookies and similar technologies. We categorize cookies as described above in Cookies and Tracking, and we obtain your consent where required. You can always change or withdraw your consent by adjusting your browser settings or via the cookie banner/consent tool. For more information on cookies in general, see allaboutcookies.org.

• Enabling/Disabling Cookies: You may block or delete cookies via your browser (Chrome, Firefox, Edge, Safari, etc.) as described on sites like allaboutcookies.org. However, disabling cookies may limit your use of some features.
• Advertising Opt-Out: The most direct control is the cookie banner: decline marketing cookies, or withdraw your consent later through the cookie settings link in the site footer, and no advertising tag is loaded at all. In addition, you can use industry opt-out mechanisms (for example the Digital Advertising Alliance, Your Online Choices in the EU, or Google Ads Settings) and each advertising partner's own ad preferences to control ad personalisation on your device.
• Full Cookie List: The complete, automatically maintained list of the cookies we set, including their provider, purpose and duration, is shown in the cookie declaration in our consent banner, which you can reopen at any time from the cookie settings link in the site footer.

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:

Email: privacy@postify.tech

Mail: BUSINICE S.R.L., Strada Fetesti nr 52, Bucharest, Romania

For EU residents: You may also lodge a complaint with your local Data Protection Authority if you believe your rights have been violated. We will cooperate with authorities to resolve any complaints.

Thank you for trusting us with your data. We are committed to transparency and will not use or share your information beyond the purposes described above.