Privacy Policy

1. Introduction

Welcome to PostMind.io ("we," "our," or "us"). We are committed to protecting your privacy and ensuring you have a positive experience on our platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered social media content generation service.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, password, company name
• Brand Information: Website URLs, brand colors, logos, brand voice preferences, products/services
• Content: Posts, captions, images you create or generate through our platform
• Payment Information: Credit card details (processed securely through Stripe)
• Communications: Messages you send to our support team

2.2 Automatically Collected Information

• Usage Data: Pages visited, features used, time spent on platform
• Device Information: IP address, browser type, operating system
• Cookies: Small files stored on your device to improve your experience
• Analytics: Performance metrics, error logs (via Sentry)

2.3 Third-Party Data

• Social Media: When you connect your Instagram, Facebook, Twitter, or LinkedIn accounts, we access basic profile information and posting permissions
• OAuth Providers: If you sign up via Google or Facebook, we receive your name, email, and profile picture

2.4 Meta Platform Data (Instagram & Facebook)

When you connect your Instagram Business or Creator account, or a Facebook Page, via Meta Login, we collect and store:

• Account identifiers: Instagram Business Account ID, Facebook Page ID, Page name
• Profile metadata: Username, profile picture URL, follower count, media count
• Access tokens: Long-lived user access token and Page access token, used to publish content and retrieve insights on your behalf. Tokens are stored encrypted in our database and never shared.
• Permissions granted: instagram_basic, instagram_content_publish, pages_show_list, pages_read_engagement, business_management
• Published post metadata: Post IDs, scheduling status, engagement counts (likes, comments, shares, reach, impressions) — used only to power your analytics dashboard inside PostMind.

We do not store the actual content of Instagram comments, DMs, or messages — none of those features are enabled in PostMind at this time. We never use Meta platform data for advertising or share it with third parties for marketing purposes.

3. How We Use Your Information

• Provide Services: Generate AI content, schedule posts, analyze performance
• Brand Extraction: Analyze your website to extract brand colors, voice, and identity
• AI Generation: Use your brand information to create personalized content that matches your voice
• Account Management: Process payments, send notifications, provide customer support
• Improve Platform: Analyze usage patterns, fix bugs, develop new features
• Communications: Send product updates, marketing emails (you can opt out anytime)
• Security: Detect fraud, prevent abuse, protect user accounts

4. AI and Data Processing

We use third-party AI services (OpenAI GPT-4, DALL-E 3, Anthropic Claude) to generate content. When you use our AI features:

• Your brand information and prompts are sent to these AI providers
• AI providers may use data to improve their models (per their policies)
• We do not use your content to train our own models without explicit consent
• Generated content belongs to you and can be deleted at any time

5. How We Share Your Information

We do NOT sell your personal information. We may share data with:

5.1 Service Providers

• OpenAI & Anthropic: AI content generation
• Stripe: Payment processing
• Vercel/Railway: Hosting infrastructure
• Sentry: Error monitoring
• Email providers: Transactional and marketing emails

5.2 Social Media Platforms

When you choose to publish content, we send it to the platforms you've connected (Instagram, Facebook, etc.) via their official APIs. Once content is published on those platforms, it lives on their servers and becomes subject to their own privacy policies and retention rules (Instagram, Facebook/Meta). PostMind cannot delete content from those platforms on your behalf — you must do so directly inside the platform.

5.3 Legal Requirements

We may disclose information if required by law, court order, or to protect our rights and safety.

6. Data Security

We implement industry-standard security measures:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest for sensitive data
• Secure password hashing (bcrypt)
• Regular security audits
• Access controls and authentication
• Automatic security updates

However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

7. Your Rights and Choices

7.1 Access and Control

• Access: View all your personal data in Settings
• Edit: Update your profile, brand information anytime
• Delete: Remove specific content or your entire account
• Export: Download your data (request via support)

7.2 Communication Preferences

• Opt out of marketing emails via unsubscribe link
• Manage notification settings in your account
• You'll still receive essential service emails (receipts, security alerts)

7.3 Cookies

You can disable cookies in your browser settings. Note that some features may not work properly without cookies.

8. Data Retention

• Account Data: Retained until you delete your account
• Content: Retained until you delete it or close your account
• Meta Platform Data: Access tokens and account metadata are retained until you disconnect the account from Settings → Connected Accounts or revoke our app inside Meta. Engagement metrics we've cached are retained for 90 days after disconnection, then deleted.
• Deleted Data: Permanently removed within 30 days (except where required by law)
• Backups: May persist in backups for up to 90 days

8.1 Data Deletion

You can delete the data we hold about you in three ways:

1. Disconnect a social account: In PostMind → Settings → Connected Accounts → Disconnect. This deletes the stored access tokens and account metadata for that platform immediately.
2. Delete your entire PostMind account: Settings → Account → Delete Account, or email [email protected]. We permanently remove your data within 30 days.
3. Remove the PostMind app from Meta: In Facebook → Settings & Privacy → Settings → Apps and Websites → PostMind → Remove. Meta will send us a deauthorization callback and we will disable our copy of your data within 24 hours. To request full deletion via Meta, use the data deletion link in that same Meta settings screen — our automated callback handles the request and provides a confirmation code at postmind.io/data-deletion.

9. Children's Privacy

Our service is not intended for users under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.

10. International Users

PostMind.io is operated from the United States. If you're accessing our service from outside the US, your information may be transferred to and processed in the US. By using our service, you consent to this transfer.

For EU users, we comply with GDPR principles including data minimization, purpose limitation, and your rights to access, rectification, and erasure.

11. Third-Party Links

Our platform may contain links to third-party websites (e.g., your brand's website, social media platforms). We are not responsible for their privacy practices. Please review their privacy policies.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We'll notify you of significant changes via email or through the platform. Your continued use after changes constitutes acceptance.

13. Contact Us

If you have questions, concerns, or requests regarding your privacy:

• Email: [email protected]
• Support: [email protected]
• Address: [Your Company Address]

14. Your California Privacy Rights

California residents have additional rights under CCPA:

• Right to know what personal information is collected
• Right to know if personal information is sold or shared
• Right to opt out of sale (we don't sell your data)
• Right to deletion
• Right to non-discrimination for exercising your rights

To exercise these rights, email [email protected]