Privacy Policy

Account information. When you sign up, we collect your name, email address, and authentication credentials via Firebase Authentication (including Google sign-in, if you use it).

Workspace and product data. Information you enter about your workspace and the products/brands you manage: names, brand voice descriptions, color palettes, and similar.

Uploaded content. Images and other media you upload as assets for your products or posts, stored via Google Cloud Storage (Firebase Storage).

Connected social media account data. When you connect a social media account, we store what's needed to publish on your behalf — account identifiers, display names, and access credentials for that connection. These credentials are encrypted at rest and are never sent to your browser or displayed in plaintext.

Post and content data. Draft and published post content, captions, hashtags, scheduling information, and the AI-generation history behind a given draft (e.g., which image and context produced it).

Billing information. Subscription plan, billing status, and subscription history. Payment card details are collected and processed directly by Paddle, our payment processor and merchant of record — we do not receive or store your full card number.

Usage and log data. Standard technical information (IP address, browser/device type, pages visited, timestamps) generated by using the Service, for security and diagnostic purposes.

Local preferences. A small amount of data is stored in your browser's local storage rather than our servers — for example, your light/dark theme preference and which workspace you last had active. This stays on your device and isn't something we collect centrally.

We use the information above to:

• provide, operate, and maintain the Service (authenticate you, save your workspace/product data, schedule and publish your posts);
• generate AI-assisted caption drafts (see Section 3);
• process billing and manage your subscription (via Paddle);
• provision and maintain platform-managed Postiz hosting where applicable;
• monitor for and prevent abuse, fraud, and security incidents;
• communicate with you about the Service (account notices, support responses, and — only with your consent where required — product updates or marketing); and
• comply with legal obligations.

We do not sell your personal information.

When you generate a caption, the image and any text context you provide are sent to our AI provider, Anthropic (Claude), to produce draft captions. Anthropic processes this data to generate a response but does not use customer content submitted via its API to train its models by default. See Anthropic's own privacy documentation for how they handle data submitted through their API.

We share information with the following categories of service providers, each acting on our behalf and only to the extent necessary to provide the Service:

We may also disclose information if required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets (with notice to you where required).

We use reasonable technical and organizational measures appropriate to the sensitivity of the data involved — including encryption of sensitive credentials (such as connected-account and hosting secrets) at rest, and access controls scoped to your workspace's members. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We are based in Pakistan, but our service providers (Google Cloud, Anthropic, Paddle, Hostinger) operate infrastructure in other countries, including the United States, the European Union, and elsewhere. By using the Service, you understand that your information may be processed in countries outside your own, which may have different data protection laws than your home country. We rely on our providers' own safeguards (such as standard contractual clauses, where applicable) for these transfers.

We retain your information for as long as your account is active. If you cancel a platform-managed hosting subscription, the underlying instance and its data are retained for 7 days as a grace period, then permanently deleted (see the Terms of Service, Section 4). If you close your account entirely, we delete or anonymize your personal information within [a reasonable period, e.g., 30-90 days], except where we're required to retain records for legal, tax, or accounting purposes.

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• request correction of inaccurate information;
• request deletion of your information (subject to Section 7's retention exceptions);
• export your data in a portable format;
• object to or restrict certain processing; and
• withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at [SUPPORT EMAIL]. We'll respond within a reasonable time and in accordance with applicable law.

The Service is intended for business use and is not directed at individuals under 18. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. We'll post the updated version with a new effective date, and for material changes we'll make reasonable efforts to notify active customers.

Questions about this Privacy Policy or your data: [SUPPORT EMAIL]

[Business address.]