Privacy Policy

Information we collect

• Account information. Your email address and name. If you sign up with email and password, your password is handled by our authentication provider (Google Firebase) and never stored by us in readable form. If you sign in with Google, we receive your name, email address and profile picture.
• Product information. The website or app store link you add, and the public content we read from it (page text, headings, images, screenshots and app store details) to build your product’s brand brief.
• Connected social accounts. When you connect an account (X, Facebook, Instagram, LinkedIn, Threads, Reddit and others we may add), we receive the account’s name, handle, profile picture and identifiers, plus the access credentials needed to post on your behalf.
• Content. Brand briefs, vibes, schedules and settings you configure; posts the agent drafts or publishes; images it generates, screenshots it captures and photos you upload.
• Comments on your posts. To reply for you, we read comments left on posts the agent published — including the commenter’s public name or handle and the comment text — and store them with the replies drafted or sent.
• Billing information. Your plan, subscription status and billing history. Card details are collected and stored by Stripe, not by us.
• Usage and technical data. Logs needed to operate and secure the Service, such as publishing results, errors, IP address (and the approximate country derived from it) and browser type.
• Analytics. We use Google Analytics to understand how the Service is used (pages visited, sign-ups, checkouts). It uses cookies; in the EEA, UK and Switzerland they are only set if you accept them in our cookie banner, and you can decline anywhere. See how Google uses this data.

How we use information

• To create and run your account and authenticate you.
• To study your product, write posts in the vibes you choose, create or select images, and publish posts to your connected accounts on your schedule (after your approval, or automatically if you turn on Autopilot).
• To read comments on those posts and draft or send replies (automatically only if you turn on Autopilot replies).
• To send you service emails and in-app notifications, such as posts waiting for approval, failed posts, trial and billing notices. You can control post emails per product in Account → Email preferences.
• To process payments, prevent fraud and abuse, and enforce our Terms.
• To maintain, secure, troubleshoot and improve the Service.

We do not sell your personal information, and we do not use your content or connected-account data to target advertising.

AI processing

To write posts, briefs and replies, we send relevant text — your product’s public content, brand brief, vibe settings, recent posts and the comment being answered — to our AI model provider (OpenAI). To create images, we send an image description (and, for some features, reference images) to our image-generation provider (fal.ai). These providers process the data to return results to us and, under their API terms, do not use it to train their models. AI output can be inaccurate; you can review everything before it is published.

Data from social platforms

We access your connected accounts only to provide the features you use: identifying the account, publishing the posts you approve (or set to publish automatically), and reading and replying to comments on those posts. Some platforms are connected through our integration partner Zernio, which securely holds the platform credentials and relays our requests. Your use of each platform is also subject to that platform’s terms and privacy policy (for example Meta, X, LinkedIn and Reddit).

Google user data and Limited Use

If you sign in with Google, we use your name, email address and profile picture only to create and identify your account. Where the Service connects to YouTube (for example to upload videos you choose to publish), it uses YouTube API Services; by using that feature you also agree to the YouTube Terms of Service, and Google handles data under the Google Privacy Policy. You can revoke access at any time in your Google Account settings.

Postleet’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, and do not allow humans to read it unless you give explicit consent, it is necessary for security or to comply with law, or it has been aggregated and anonymized.

Who we share data with

We share data only with service providers that help us run the Service, and only as needed:

• Social platforms you connect — to publish your posts and replies, and read comments on them.
• Zernio — social account connection, publishing and comments for platforms routed through it.
• OpenAI and fal.ai — AI text and image generation, as described above.
• Stripe — payments, subscriptions, tax and fraud prevention. For purchases, Stripe acts as the reseller / merchant of record and processes your payment details under its own privacy policy.
• Google (Firebase Authentication, Google Cloud) — sign-in, email verification and secure storage of service credentials.
• Resend — sending service emails.
• Google Analytics — usage analytics, subject to your cookie choice.
• Hosting and infrastructure providers — servers, databases and file storage.
• Legal and safety — where required by law, or to protect the rights, property or safety of Postleet, our users or others. If Postleet is involved in a merger or acquisition, data may transfer as part of that transaction under this policy.

How we protect data

Connection credentials are encrypted at rest (AES-256-GCM) and service secrets are kept in a managed secrets vault. Data is sent over encrypted connections, and access to production systems is restricted. No system is perfectly secure, but we take reasonable technical and organizational measures to protect your information.

Retention and deletion

• We keep your data while your account is active.
• Disconnect an account in a product’s Channels tab to remove its stored credentials (you can also revoke Postleet’s access from the platform’s own settings).
• Delete a product in its Account tab to remove its brief, queue, drafts and history.
• Delete images from the Assets page.
• To delete your whole account and associated data — including data received from Facebook, Instagram or other connected platforms — email [email protected] from your account email. We complete deletion within 30 days, except where we must keep limited records (for example billing records) to meet legal obligations.
• Posts already published stay on the social platforms; you can delete them there.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, email [email protected]. You may also complain to your local data protection authority. If you are in the EEA or UK, we process your data to perform our contract with you, based on our legitimate interests in running and securing the Service (including reading comments on your posts so we can reply), and to meet legal obligations. Your data may be processed in countries other than your own, including the United States, with appropriate safeguards.

If someone commented on a post published through Postleet and you want your comment data removed from our systems, email [email protected] with a link to the comment.

Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data.

Changes to this policy

We may update this policy from time to time. We will update the “Last updated” date above and, for material changes, notify you by email or in the app.

Contact us

Questions about privacy or your data? Email [email protected].