Privacy Policy

1. Information We Collect

2. Connected Social-Media Platforms

You may connect accounts from Facebook, Instagram, Threads, YouTube, Pinterest, TikTok, and LinkedIn.

The information we receive depends on the platform, the account type, the permissions you approve, and the access granted to The Post Engine.

We use connected-account information to identify your accounts, publish content, provide requested analytics, and operate the features described below.

3. Publishing and Scheduling

When you schedule a post, The Post Engine stores the selected content, destination accounts, publishing time, and required platform settings.

A background service attempts to publish the content at the scheduled time. Failed publishing jobs may be retried automatically. If publishing ultimately fails, we may send you a transactional email.

The Post Engine does not publish content unless you choose to publish it immediately or schedule it.

You remain responsible for:

• The content you publish.
• The accounts you select.
• Visibility and privacy settings.
• Commercial-content disclosures.
• Your right to use uploaded or generated content.
• Compliance with each platform's rules.

4. Brand DNA

Brand DNA analyzes past content from social-media accounts you own or are authorized to manage.

When you request an analysis, we may process up to 100 recent posts, including:

• Captions.
• Images and media types.
• Publication dates and times.
• Likes, comments, views, and other available engagement figures.
• Hashtags and permalinks.

This information is sent to Anthropic's Claude API to generate a written analysis that may include:

• Content pillars.
• Tone and writing patterns.
• Posting-time patterns.
• Caption and hashtag patterns.
• High- and low-performing content.
• Suggested future content.

The resulting Brand Profile is stored in your account. Up to ten selected post images may also be stored in Cloudflare R2.

Brand DNA is provided only where the applicable platform permits this processing and where The Post Engine has the necessary authorization.

5. Public Competitor and Non-User Information

A user may request an analysis of a publicly available business, creator, professional account, channel, or website that the user does not own.

Depending on the requested feature and our approved access, we may process:

This information may relate to people who do not use The Post Engine.

We process this information to provide a limited competitive report specifically requested by a user. Where applicable, we rely on our legitimate interest in providing business and content-strategy analysis based on publicly presented professional or commercial information.

Public competitor information may be sent to Anthropic to generate the requested report. The completed report is stored in the requesting user's account.

We do not use competitor analysis to:

• Access private accounts or restricted information.
• Determine sensitive personal characteristics.
• Conduct personal surveillance.
• Create reports about children.
• Sell personal profiles or public-platform datasets.

We process platform information only where the applicable platform's terms and our approved API access permit it.

A person whose information appears in a competitor report may request access, correction, removal, or objection to future processing by contacting us. The request should identify the relevant username, profile, channel, website, or URL.

6. AI Services

The Post Engine uses:

• Anthropic Claude for captions, written content, Brand DNA analysis, and competitor reports.
• OpenAI for image generation and image editing.

When you use an AI feature, the information needed to complete your request may be sent to the relevant provider. This may include:

• Prompts.
• Brand instructions.
• Captions and written content.
• Uploaded images.
• Public competitor content.
• Selected post and engagement information.

Under our current commercial API arrangements, Anthropic and OpenAI state that API inputs and outputs are not used to train their general-purpose models by default unless the customer opts in or another agreement applies.

These providers may temporarily retain limited information for service operation, safety, abuse prevention, or legal compliance.

We do not authorize AI providers to use connected-platform data for independent advertising or marketing.

7. How We Use Information

We use information to:

• Create and manage accounts.
• Authenticate users.
• Connect authorized social-media accounts.
• Generate, schedule, and publish content.
• Provide Brand DNA and competitor reports.
• Process subscriptions and usage credits.
• Store and deliver uploaded and generated content.
• Send billing, account, security, and publishing notifications.
• Diagnose technical problems.
• Prevent fraud, misuse, and security incidents.
• Comply with legal obligations.
• Enforce our agreements.
• Improve the Service using aggregated or de-identified information.

We do not sell personal information or connected social-platform data.

8. Service Providers

We use the following service providers:

• Anthropic — AI text generation and analysis.
• OpenAI — AI image generation and editing.
• Stripe — payment and subscription processing.
• Cloudflare R2 — media and file storage.
• Neon — PostgreSQL database hosting.
• Upstash — Redis, caching, and job queues.
• Resend — transactional email delivery.
• Vercel — application hosting and delivery.
• Railway — background workers and supporting services.

These providers process information only as necessary to provide their services to us, subject to their contractual and legal obligations.

We may also disclose information:

• When required by law or a valid legal request.
• To investigate fraud, abuse, or security incidents.
• To protect our users, rights, property, or safety.
• As part of a merger, financing, acquisition, restructuring, or sale of the business.
• At your direction, including when you publish content to a connected platform.

Each connected social-media platform separately processes information according to its own privacy policy and terms.

9. Legal Bases

Where the GDPR, UK GDPR, or similar laws apply, we rely on one or more of the following legal bases:

• Contract — to create your account and provide requested services.
• Consent — when you authorize connected platforms or where consent is otherwise required.
• Legitimate interests — to operate and secure the Service, prevent misuse, and provide limited analysis of publicly available professional or commercial information.
• Legal obligations — to comply with tax, accounting, regulatory, and legal requirements.

You may withdraw consent by disconnecting a platform or contacting us. Withdrawal does not affect processing that occurred before consent was withdrawn.

10. Retention, Disconnection, and Deletion

We retain account information while your account remains active and for as long as necessary to provide the Service.

Uploaded media, generated content, Brand Profiles, and competitor reports remain in your account until you delete them, close your account, or a shorter platform-specific retention period applies.

Access tokens are retained only while necessary to maintain an authorized connection. When you disconnect an account or delete your The Post Engine account, we revoke or delete applicable access tokens and platform data as required by the relevant platform.

Billing and transaction records may be retained for tax, accounting, fraud-prevention, and legal purposes.

Security and audit logs may be retained for a limited period to protect the Service and investigate misuse.

Deleted information may remain temporarily in encrypted backups until those backups are overwritten. We may retain limited information where required by law, necessary to resolve disputes, or needed to prevent fraud.

You may request deletion by:

• Deleting content or reports from your account.
• Disconnecting a social-media account.
• Using the account-deletion controls available in The Post Engine.
• Submitting a request at thepostengine.com/data-deletion.
• Emailing support@thepostengine.com.

Deleting your The Post Engine account does not automatically delete content already published on a third-party platform.

We may need to verify your identity before completing a request.

11. Your Rights

Depending on where you live, you may have the right to:

• Access your personal information.
• Correct inaccurate information.
• Request deletion.
• Request restriction of processing.
• Object to processing based on legitimate interests.
• Withdraw consent.
• Request a portable copy of certain information.
• Make a complaint to a privacy regulator.

To exercise these rights, contact support@thepostengine.com.

If your request concerns public non-user information, identify the relevant username, account, channel, website, or URL.

12. Security

We use reasonable administrative and technical safeguards designed to protect information, including:

• AES-256-GCM encryption for stored platform access tokens.
• Bcrypt hashing for passwords.
• JWT-based session management.
• Encryption during transmission.
• Restricted access to production systems.
• Security and audit logging.
• Payment processing through Stripe.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. International Transfers

The Post Engine and its service providers may process information in Canada, the United States, and other countries.

Where required, we use contractual safeguards and other lawful transfer mechanisms intended to protect personal information transferred outside its country of origin.

14. Children

The Post Engine is intended for businesses and creators. It is not directed to children under 13 or the minimum age required by the applicable platform.

We do not knowingly collect personal information from children. Contact us if you believe a child has provided information to us.

15. Changes to This Policy

We may update this Privacy Policy when our services, integrations, legal obligations, or information practices change.

We will update the effective date and provide additional notice where legally required or where a change materially affects how personal information is used.

16. Contact

Questions, complaints, privacy requests, deletion requests, and non-user removal requests may be sent to: