Privacy Policy

Who we are

Postpane (“we,” “our,” or “us”) runs postpane.com and the Postpane studio, where you plan, create and publish social media posts (the “Services”). This policy explains what personal data we collect, why, who we share it with, and the choices you have. We are the controller of the personal data described here.

We don’t sell your personal data, and we don’t share it for cross-context behavioural advertising.

What we collect

• Account data: your name, email address, password (stored hashed), time zone and preferences.
• Workspace and team data: workspaces, brands, the people you invite and their roles.
• Content you create: posts, captions, drafts, schedules, designs, hashtag groups, and the images and videos you upload to your media library.
• Connected account data: for each social account you connect, its id on the network, username, display name and profile picture. See Connected social accounts.
• Imported posts: when you import past posts from a channel, we store each post’s text, a link to it, its first image or video thumbnail and when it was published.
• Post activity: delivery status, comments and replies, and analytics such as likes, views and reach that the networks report for your posts.
• AI inputs and outputs: the prompts, topics and settings you give our AI features, the brand details they use, and what they produce.
• Billing data: your plan, subscription status and credit balance. Creem, our merchant of record, collects your payment details. We never see your full card number.
• Usage and device data: pages viewed, features used, browser and device type, IP address and approximate location derived from it.
• Marketing attribution: how you found us, such as the referring site and campaign (UTM) parameters. See Cookies and analytics.
• Messages: what you send us when you email us for support.

How we use it

• to create your account, sign you in and keep it secure;
• to run the Services: store your content, publish and schedule posts to the accounts you choose, import posts, and show comments and analytics;
• to run the AI features when you use them;
• to bill you, track credits and enforce plan limits;
• to send you service emails, such as sign-up verification, invitations and alerts when a post fails;
• to understand how the Services are used, fix problems and decide what to build;
• to prevent fraud and abuse; and
• to meet legal obligations and enforce our Terms.

Legal bases

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:

AI features

When you use an AI feature, we send the data it needs to an AI provider, which returns the result to us:

• Text generation (captions, post ideas, design copy, and brand details read from a website you give us) receives your prompt, topic, tone, audience and brand details. Our text provider processes this data in the People’s Republic of China. See International transfers.

We don’t use your content, prompts or AI output to train AI models, and we choose AI providers whose terms don’t allow them to either. Please don’t put sensitive personal data, such as health information, into prompts.

Who we share data with

We share personal data only with the service providers that help us run Postpane, and only as they need it to do so. They act on our instructions under data processing agreements and may not use your data for their own purposes. The categories are:

Business customers who need the current list of named providers, for example for their own data processing records, can ask us at hello@postpane.com.

We also share data with:

• The social networks you publish to. When you publish, we send your post and its media to the network you chose, through our social publishing provider. What happens next is governed by that network’s own privacy policy.
• X (Twitter), in the same way.
• Other people in your workspace, who can see the workspace’s content according to their role.
• Advisers and authorities, when the law requires it or to protect rights and safety.
• A buyer or successor, if Postpane is sold or merged. This policy would continue to apply to your data.

Connected social accounts

You can connect Instagram, Facebook, LinkedIn, TikTok, Threads, Bluesky, Pinterest and YouTube accounts. When you connect one:

• The network asks you to approve access. The access token it issues is held by our publishing provider, not in our own database.
• We store the account’s id on the network, its username, display name and profile picture, so we can show it in your workspace.
• We use that access only for what you ask Postpane to do: publish and schedule posts, import your past posts, and read the comments and analytics for your posts. We don’t read your private messages or contacts.
• You can disconnect an account at any time from the Channels page of your studio. See Data deletion for what that removes.

Google and YouTube

If you connect a YouTube channel, we use YouTube API Services to read your channel’s basic details and, once video publishing is available, to upload the videos you choose. Postpane’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We don’t use data from Google APIs for advertising, we don’t sell it, and we don’t use it to train AI models. Google’s handling of your data is described in the Google Privacy Policy. You can remove Postpane’s access to your Google account at any time from your Google security settings, as well as by disconnecting the channel in Postpane.

Data deletion (including Meta)

You can remove your data in these ways:

Disconnect a channel

Go to Channels in your studio and disconnect the account. We tell our publishing provider to remove the account, which deletes the access token it held, and we delete the channel from your workspace. Then:

• anything scheduled to go to that account is stopped and will not be published;
• the history of posts you already published stays in your workspace, so your calendar and posts list stay complete;
• drafts are kept;
• posts you imported from that account are kept for 30 days in case you reconnect, then deleted.

Delete posts

When you delete a post in Postpane, we cancel anything still scheduled for it, delete it from our database, and ask our publishing provider to delete its copy.

Delete your account

Email hello@postpane.com with the subject “Data Deletion Request” from the address on your account. We will delete your account and its personal data, including your workspaces, content and connected channels, except what we must keep by law (such as billing records). We aim to finish within 30 days and will confirm when it’s done.

If you connected Facebook, Instagram or Threads

You can also remove Postpane from your Meta account: in Facebook, go to Settings & privacy, then Settings, then Apps and websites, and remove Postpane. You can ask us to delete the data we received through Meta at any time by emailing hello@postpane.com with the subject “Data Deletion Request.” We will delete it as described above and confirm by email.

TikTok, LinkedIn, Pinterest, Bluesky and X

TikTok

With your permission, we receive your TikTok profile details (display name, avatar and account id), publish the videos and photos you choose using the privacy and interaction settings you pick, and read basic stats for your posts. We use this data only to provide those features and never sell it. You can revoke access from the security settings in the TikTok app, or by disconnecting the channel in Postpane.

LinkedIn

We receive your LinkedIn profile or Page details, publish posts you choose to your profile or the Pages you manage, and read their engagement. We don’t use LinkedIn data for advertising or to build profiles of LinkedIn members.

Pinterest

We receive your Pinterest profile and list of boards so you can choose where to publish, and we create Pins you ask us to. We don’t use Pinterest data for any other purpose.

Bluesky

Bluesky is a public network. Anything you publish there through Postpane is public and may be copied by other services on the AT Protocol. Deleting a post in Postpane may not remove every copy that others have made.

X (Twitter)

We use data from the X API only to publish and manage the posts you ask us to, and to show their replies and metrics. We do not sell X data or use it to build profiles of X users. If you delete a post in Postpane or disconnect your X account, we delete the X content we hold for it.

How long we keep data

International transfers

Our providers process data outside your country. Most process it in the United States, and media is stored in the European Union and delivered through a global network. If you use our AI text features, your prompts and brand details are also processed in the People’s Republic of China, which does not have an adequacy decision from the EU or UK. Where the law requires it, we rely on safeguards such as the European Commission’s Standard Contractual Clauses for these transfers.

Cookies and analytics

We use these cookies and similar storage:

You can block or delete cookies in your browser settings. Blocking the session cookie will stop you signing in. You can opt out of Google Analytics with Google’s browser add-on.

Security

We use encryption in transit, access controls and reputable providers to protect your data. No system is perfectly secure, so please use a strong, unique password. If a breach affects your personal data, we will tell you and the authorities as the law requires.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict how we use it, and to withdraw consent you have given. California residents have the right to know, delete and correct, and not to be discriminated against for using these rights. We don’t sell or share personal data as California law defines those terms.

To use any of these rights, email hello@postpane.com. We may need to confirm your identity first, and we will reply within the time the law sets. You can also complain to your local data protection authority.

Children

Postpane is not for anyone under 16, and we don’t knowingly collect personal data from them. If you think a child has given us personal data, email us and we will delete it.

Changes to this policy

We may update this policy. We will post the new version here and change the “Last updated” date. For material changes, we will tell you in the app or by email before they take effect.

Contact

Questions or requests about your data: hello@postpane.com.