Privacy policy · Postfig

Draft for legal review. Have counsel review this policy before launch.

Who we are

Postfig is provided by Allyce AI Ltd., a company registered in Ireland (“we”, “us”). We are the controller of the personal information described in this policy. Contact us at privacy@postfig.app.

Information we collect

What	Details	Why
Your account	Email address; your name and profile picture if you sign in with Apple or Google; how you signed in.	To create your account and sign you in.
Business details	Business name, website, type of business and time zone, if you provide them.	To set up your workspace and schedule in your time zone.
Connected accounts	For each social account you connect: its platform identifier, name, username or Page name, profile picture, the permissions you granted, and the access tokens the platform issues.	To publish the posts you schedule, to the accounts you choose.
Your content	Posts you write: captions, photos and videos, schedule times, per-platform settings, and the result of each publish.	To store, preview and publish your posts.
Security records	IP address, device and browser type, and the time of security-relevant events (for example sign-ins and connecting an account).	To keep your account and the service secure.
Payments	Your plan and subscription status. Card details are handled by our payment provider and never reach us.	To provide your subscription.
Support	What you send us when you contact support.	To help you.

We use this information because we need it to provide Postfig to you under our terms, apart from security records, which we keep because we have a legitimate interest in protecting your account and the service, and billing records, which the law requires us to keep.

We don’t use advertising or analytics trackers, we don’t build profiles about you, and we don’t use your content to train AI models. The only cookie we set is the one that keeps you signed in.

Information from social platforms

When you connect an account, the platform asks for your permission and then gives us access to do the specific things listed below. We use that access only to provide Postfig to you — showing which account you connected, and publishing the posts you create — and for nothing else.

Instagram, Facebook and Threads (Meta): your account or Page’s basic profile, and permission to publish content you create in Postfig.
LinkedIn: your basic profile, and permission to publish posts to your profile or to Pages you administer.
TikTok: your basic profile and the posting options your account allows, and permission to publish posts you create in Postfig.
YouTube: your channel’s basic details, and permission to upload the videos you choose.

Access tokens are stored only on our servers, encrypted, and are never shared with anyone or sent to your devices. When you disconnect an account we delete its tokens.

Google and YouTube

Postfig’s use and transfer of information received from Google APIs to any other app will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements. Postfig uses YouTube API Services; by connecting YouTube you also agree to theYouTube Terms of Service, and Google’s handling of your information is described in theGoogle Privacy Policy. You can remove Postfig’s access at any time on Google’ssecurity settings page.

Who we share it with

We don’t sell or rent your information. We share it only with:

The platforms you post to, when you publish — they receive the post you chose to publish.
Service providers that run parts of Postfig for us under contracts that protect your information: Cloudflare (hosting, database and file storage), our email provider (sign-in codes and service emails) and our payment provider (subscriptions).
Authorities, when the law requires it, and only as much as required.
A successor, if Allyce AI Ltd. is involved in a merger or acquisition, with this policy continuing to apply.

Where it’s stored

Our service runs on Cloudflare’s global network, so your information may be processed outside your country. Where the law requires, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

How long we keep it

Your account, business details, posts and media: for as long as your account is open, or until you delete them.
Connected-account tokens: until you disconnect the account or delete your account.
Security records: up to 12 months.
Billing records: for as long as tax law requires, which in Ireland is six years.
After you delete your account, everything else is removed from our live systems straight away and from backups within 30 days.

Security

We protect your information with encryption in transit and at rest, passwordless sign-in, strict access controls and regular testing. Readhow we protect your accounts.

Your rights and choices

Delete everything: in the app, open the workspace menu and choose Delete account. See deleting your data.
Disconnect an account: in Channels, at any time. You can also remove Postfig from the platform’s own settings.
Access, correct, export, restrict or object: email privacy@postfig.app. We’ll respond within 30 days.
Complain to a regulator: Ireland’s Data Protection Commission supervises us, and you can also contact the data-protection authority where you live or work.
California: we don’t sell or share personal information as those terms are defined there.

Children

Postfig is for businesses and isn’t meant for anyone under 16. We don’t knowingly collect information from children.

Changes

If we change this policy we’ll update the date above, and for significant changes we’ll tell you by email or in the app before they take effect.

Contact

Email privacy@postfig.app. Our company details are at the end of our terms.