privacy policy
effective date: april 1, 2026
1. data controller
App Studio (SASU) is the data controller for personal data processed through the Service. Our details are:
App Studio — RCS Marseille 917 474 207
BT B, 18 Boulevard Reynaud de Trets, 13010 Marseille, France
legal@getpostai.com
2. data we collect
We collect the following categories of personal data:
- Account information: name, email address, and password (hashed) when you register.
- Connected social accounts: OAuth tokens and profile metadata for each platform you connect (e.g. Twitter/X, LinkedIn, Instagram, TikTok).
- Content you create: posts, captions, media, schedules, and AI-generated drafts saved in your Workspace.
- Usage analytics: pages visited, features used, session duration, and error logs collected via PostHog.
- Payment information: billing address and payment method details processed and stored by Stripe. We do not store raw card numbers.
3. how we use your data
We use your personal data to: provide and operate the Service; authenticate your identity and manage your account; process subscription payments and invoices; schedule and publish content to connected social platforms on your behalf; generate AI-powered content suggestions; send transactional emails (account notifications, billing receipts, security alerts) via Resend; analyse usage patterns to improve and develop the product; and detect and prevent fraud, abuse, and security incidents.
4. data storage & security
All user data is stored in Supabase, which operates its EU region within the European Union. Data is encrypted at rest using AES-256 and in transit using TLS 1.2+. We implement role-based access controls so that only authorised PostAI personnel can access production data, and only where strictly necessary for operational support.
5. third-party sub-processors
We share data with the following third-party sub-processors to operate the Service. This list covers every provider that receives personal data or user content, including the AI providers behind text, image, video, audio, and B2B-contact features — not only our core infrastructure. Where we don't have a precise, published figure for retention or a confirmed training policy from a vendor, we say so rather than guess. As a default position, we do not authorize any sub-processor to train their general models on your account content; where a provider's standard API/enterprise terms already exclude training by default, we rely on that.
| Provider | Function | Data received | Region | Used to train models? | Transfer mechanism |
|---|---|---|---|---|---|
| Supabase | Database, authentication, file storage | All account and content data | EU (Supabase EU project) | No | N/A — EU |
| Stripe | Payment processing | Billing details, payment method | Not independently confirmed which processing region Stripe uses for this account | No | SCCs |
| Trigger.dev | Background job execution and scheduling | Job payloads, which may include content or tokens in transit | Not independently confirmed | No | SCCs (assume non-EU pending region confirmation) |
| Resend | Transactional email delivery | Email address, message content | Not independently confirmed | No | SCCs (assume non-EU pending region confirmation) |
| Vercel | Application hosting | Request data, logs | Global edge network; company is US-based | No | SCCs |
| PostHog | Product analytics (event tracking only — no session recording is configured) | Usage events, device/browser metadata | EU cloud instance | No | N/A — EU |
| Anthropic (Claude) | AI text generation | Prompts, source content you provide, generated drafts | US | No — API usage is excluded from model training by Anthropic's standard commercial terms | SCCs |
| OpenAI | AI text/image generation (GPT, Sora 2) | Prompts, source content, generated media | US | No — API usage is excluded from training by OpenAI's API terms | SCCs |
| Google (Gemini / Veo 3) | AI text/video generation | Prompts, source content, generated media | US/Global | No — API usage is excluded from training by Google's API terms | SCCs |
| xAI (Grok) | AI image generation | Prompts, generated images | US | Not independently confirmed | SCCs |
| fal.ai | Hosted video model inference (e.g. Kling, Wan) | Prompts, generated video | US | Not independently confirmed | SCCs |
| ARK (Seedance) | AI video generation | Prompts, generated video | Not confirmed | Not independently confirmed | SCCs |
| Runway | AI video generation (Gen-4) | Prompts, generated video | US | Not independently confirmed | SCCs |
| ElevenLabs | AI voice/audio generation | Text input, generated audio | US/EU | Not independently confirmed | SCCs |
| Cartesia | AI voice/audio generation | Text input, generated audio | US | Not independently confirmed | SCCs |
| MiniMax | AI voice/audio generation | Text input, generated audio | Not confirmed | Not independently confirmed | SCCs |
| Suno | AI music generation | Prompts, generated audio | US | Not independently confirmed | SCCs |
| Udio | AI music generation | Prompts, generated audio | US | Not independently confirmed | SCCs |
| Pexels / Pixabay / Freesound | Stock media search (b-roll, sound) | Search queries only — no user content sent | US/EU | No — search only | SCCs |
| Apollo.io | B2B contact data enrichment | Search filters you enter; no PostAI user data is sent to build the underlying dataset | US | N/A — PostAI is a data recipient, not a trainer of Apollo's dataset | SCCs |
| Typesense (self-hosted via apps/jobs) | Search indexing | Indexed content (e.g. viral post corpus) | Depends on hosting region — not independently confirmed | No | N/A |
This table was last reviewed against our codebase on August 11, 2026. "Not independently confirmed" means we have not yet completed a documented review of that vendor's current data-use terms — we are not asserting a policy we haven't checked. This same table is shared by the DPA and GDPR pages so the three can't drift out of sync with each other again.
6. data retention
We retain personal data for as long as your account is active. If you cancel your subscription, your data is retained for 90 days to allow reactivation, after which it is permanently deleted from production systems. Anonymised analytics data may be retained indefinitely. Stripe retains payment records for the period required by applicable tax and financial regulations.
7. your rights
Under GDPR you have the following rights regarding your personal data:
- Right of access: obtain a copy of the data we hold about you.
- Right to rectification: correct inaccurate or incomplete data.
- Right to erasure: request deletion of your personal data.
- Right to data portability: receive your data in a structured, machine-readable format.
- Right to restriction: request that we limit processing of your data.
- Right to object: object to processing based on legitimate interests.
To exercise any of these rights, email legal@getpostai.com. We will respond within 30 days.
8. cookies
We use the following cookies:
- Auth session cookie (Supabase) — strictly necessary to keep you logged in.
- PostHog analytics cookies — used to understand how users interact with the product. You can opt out via our cookie banner.
- Stripe cookies — used during the checkout flow for fraud prevention.
9. children's privacy
The Service is a business tool and is not directed at minors. You must be at least 18 years old, or a duly authorized agent of a business acting on its behalf, to create an account. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.
10. international transfers
We process and store data within the EU wherever possible. Where data is transferred outside the EU (e.g. to a sub-processor without an EU region), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure an adequate level of protection.
11. contact & dpo
For any privacy-related enquiries or to exercise your rights, contact us at legal@getpostai.com. You also have the right to lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).