Privacy Policy

1. Information we collect

Account and profile information

We collect information you provide when creating and managing an account, such as your name, email address, profile image, account role, authentication provider, and connected sign-in methods. We receive limited profile information from providers such as Apple, Google, GitHub, or X when you choose to sign in or connect an account through them.

Workspace and product information

We process information you add to organizations, projects, and workspaces, including product names, websites, descriptions, brand direction, team membership, schedules, draft content, images, videos, feedback, and other product context.

Connected-service information

When you connect an integration, we receive the data and permissions needed to provide the features you request. Depending on the integration, this may include:

• GitHub account, organization, repository, branch, commit, pull request, release, and installation information;
• X account, profile, post history, publishing status, and approved post actions;
• Instagram professional account, profile, publishing status, media, and approved post actions;
• public website content and metadata from websites you ask us to analyze; and
• connection status, access scopes, provider identifiers, refresh history, and error information needed to maintain integrations.

The information available to Postede depends on the permissions you approve with each provider. You can revoke provider access through the relevant provider and remove supported connections in the Service.

YouTube account connections and publishing

Postede uses YouTube API Services when you connect a YouTube channel. We use channel identifiers, channel profile information, authorization permissions, and upload results to connect your selected channel, publish videos you authorize, and show delivery status. You choose the video, title, description, audience setting, and visibility before publishing.

Post for Me processes the connection and uploads on our behalf. It handles the Google access and refresh tokens needed to maintain your connection. Postede stores the account references, selected publishing settings, content, and delivery records needed to provide these features. Disconnecting a channel does not delete videos already uploaded to YouTube or content saved in your Postede library.

You can request removal of stored YouTube connection data in Publishing settings. This removes the connection and saved YouTube results; shared projects can remove their own copy without removing the original owner's connection. Your original media and captions remain in Postede, and uploaded videos remain on YouTube. Contact hello@postede.com if a removal request needs attention.

Postede's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. You can revoke access in your Google Account connections and request deletion of connected-account data by contacting us using the details below. Revoking access stops future authorized API access; it does not itself remove previously uploaded videos. Google handles information according to its Privacy Policy.

Generated content and AI processing

We process the instructions, project context, source material, draft content, images, videos, and feedback needed to generate or refine launch content. These inputs and outputs may be sent to AI providers such as OpenAI or Anthropic when the relevant feature is used.

Billing and transaction information

Stripe processes checkout, subscriptions, billing details, invoices, payment methods, and the customer billing portal. Postede does not receive or store complete card numbers or card security codes. We receive limited transaction information such as a Stripe customer or subscription identifier, plan, payment status, amount, currency, trial status, and cancellation status.

Communications

We collect messages, feedback, support requests, survey responses, and other communications you send to us. We also maintain delivery status for account, product, billing, and team notifications.

Information collected automatically

When you use the Service, we and our service providers may automatically receive technical information such as your IP address, browser and device type, operating system, referring page, pages visited, approximate location derived from your IP address, timestamps, interactions, performance information, and errors.

2. How we use information

We use personal information to:

• create, authenticate, secure, and recover accounts;
• provide organizations, projects, team access, and billing;
• connect requested services and import the product activity you ask us to use;
• generate, organize, edit, schedule, and publish content at your direction;
• provide images, videos, project context, notifications, and support;
• process payments and maintain transaction records;
• prevent fraud, abuse, and unauthorized access;
• operate, troubleshoot, analyze, and improve the Service;
• enforce our Terms of Service and protect our rights; and
• comply with legal, tax, accounting, and regulatory obligations.

3. Legal bases for processing

Where applicable law requires a legal basis, we process personal information because it is necessary to perform our contract with you, because we have a legitimate interest in operating and securing the Service, because we must comply with law, or because you have given consent. Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that already occurred.

4. How we disclose information

We do not sell personal information, and we do not use personal information for cross-context behavioral advertising. We may disclose information in these circumstances:

• Service providers. Providers that help with hosting, databases, authentication, file storage, isolated processing, AI generation, analytics, email, billing, security, video, and related operations. Depending on the feature used, these providers include Vercel, Convex, Stripe, Resend, PostHog, Google Analytics, Apple, OpenAI, Anthropic, Cloudflare, Post for Me, and YouTube.
• Connected services. GitHub, X, twitterapi.io, Linear, and other services you choose to connect or direct us to use. Their handling of information is governed by their own terms and privacy policies.
• Team members and collaborators. Information in a shared organization or project may be available to other members according to their role and access.
• At your direction. When you publish a post, display a public profile, join a public founder wall, share content, or otherwise direct the Service to make information public.
• Legal and safety reasons. When reasonably necessary to comply with law or legal process, enforce agreements, investigate fraud or abuse, or protect Postede, our users, or others.
• Business transfers. In connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of the business, subject to appropriate protections.

6. Data retention

We keep personal information only as long as reasonably necessary to provide the Service, maintain accounts, fulfill the purposes described here, resolve disputes, enforce agreements, and meet legal, tax, accounting, and security obligations. Retention varies based on the information and why it was collected.

• Account, organization, project, integration, and generated-content information may be retained while your account or workspace is active and for a reasonable period afterward.
• Payment and subscription records may be retained for financial, tax, fraud-prevention, and legal purposes.
• Provider data may be refreshed, replaced, or removed when a connection is revoked or deleted, subject to backup and legal retention needs.
• Limited information may remain in logs and backups until those systems are overwritten through their normal lifecycle.

7. Security

We use reasonable technical and organizational safeguards intended to protect personal information, including access controls, authenticated application areas, provider authorization, environment separation, and payment processing through Stripe. No internet transmission or storage system is completely secure, so we cannot guarantee absolute security.

You are responsible for protecting your password, connected accounts, and team access and for notifying us if you believe an account or connection has been compromised.

8. International data transfers

Postede is based in the United States, and our service providers may process information in the United States and other countries. Those countries may have different privacy laws than your country. Where required, we use legally recognized safeguards for international transfers.

9. Your rights and choices

Depending on where you live, you may have the right to request access to, correction of, deletion of, or a portable copy of personal information; to object to or restrict certain processing; to withdraw consent; or to appeal a privacy decision. You may also have the right not to receive discriminatory treatment for exercising a privacy right.

You can update supported profile and workspace information, manage connected services, change notification and analytics preferences, manage billing through Stripe, and use available deletion controls from the Service. For other requests, email hello@postede.com. We may need to verify your identity and authority before completing a request.

10. Children

The Service is not directed to children under 18, and we do not knowingly collect personal information from children under 18. If you believe a child has provided personal information, contact us so we can take appropriate action.

11. Changes to this policy

We may update this Privacy Policy as the Service, our practices, or legal requirements change. We will update the date at the top and provide additional notice when required by law or when a change is material.

12. Contact us

Questions or privacy requests can be sent to Pep Tech Studios, LLC at hello@postede.com.