PostDelegatePostDelegate
PostDelegate · بوست ديليجيت

Privacy Policy

What PostDelegate collects, why, and who else sees it.

Placeholder — requires legal review. This policy is a draft describing the system as built. This text is a working draft written by the engineering team. It has not been reviewed by a qualified lawyer and is not yet fit to be relied on by customers.

1. Who is responsible

The controller of personal data processed through PostDelegate is [legal entity not configured], established in [jurisdiction not configured]. Data-protection enquiries: Privacy contact will be published before accounts open..

2. What we collect

  • Account data — name, email address, company name, password hash, workspace membership and role.
  • Connected channel data — access and refresh tokens for the social accounts you connect, plus the profile name, handle and avatar those platforms return.
  • Content — the posts, images, video and comments you create, schedule or upload, and their publishing history.
  • Analytics — engagement metrics we retrieve from the connected platforms about your own posts.
  • Billing data — subscription tier and payment identifiers. Card details are handled by our payment processor and never reach our servers.
  • Technical data — IP address, browser and device information, and error diagnostics.

3. Why we process it

To operate the service you asked for (performance of a contract), to keep it secure and to detect abuse (legitimate interests), to bill you and meet accounting obligations (legal obligation), and — only where you have opted in — to send product or marketing email (consent).

4. AI features and third-party model providers

Read this before using the AI features. When you use an AI feature — content generation, rewriting, the assistant, image or video generation, or automated suggestions — the text, images and related context you supply are transmitted to third-party AI model providers so they can produce a response. That content leaves PostDelegate’s own infrastructure.

These providers process the content under their own terms and may operate outside your country, including outside the GCC. Retention and whether submissions are used for model training are governed by our agreement with each provider; we select providers that offer no-training terms for business API traffic, but you should not put information into an AI feature that you would not be comfortable sharing with a processor abroad.

AI features are optional. If you do not use them, your content is not sent to a model provider. The specific providers in use for this deployment are listed on the Licences & source page and in our processor register, available on request from Privacy contact will be published before accounts open..

5. Other processors we share data with

  • Social media platforms — the accounts you connect, in order to publish on your behalf and read back your analytics.
  • Hosting, database and object storage providers — where the service and your uploads run and are stored.
  • Payment processor — to take subscription payments.
  • Email delivery provider — transactional email such as activation, password reset and notifications.
  • Error monitoring and product analytics — to diagnose faults and understand feature usage.

We do not sell personal data.

6. International transfers

Some processors above operate outside the country where your workspace is based. Where that happens we rely on the transfer mechanisms available under the applicable law and on contractual protections with each processor.

7. Retention

Account and content data are retained while your workspace is active. After deletion we remove or anonymise personal data within a defined window, except where we must keep records to meet legal, tax or accounting obligations. Concrete retention periods are to be confirmed with counsel before launch.

8. Security

Access tokens for connected channels are stored encrypted. Access to production data is restricted and logged. No system is perfectly secure; if a breach affects you we will notify you as required by the applicable law.

9. Your rights

Subject to the law that applies to you, you may request access to your personal data, correction, deletion, a portable copy, or restriction of or objection to certain processing. Write to Privacy contact will be published before accounts open.. You may also complain to your local data-protection authority.

10. Cookies

We use a session cookie to keep you signed in, a preference cookie for your language and interface settings, and — where enabled for this deployment — analytics cookies. Blocking the session cookie will prevent sign-in.

11. Children

PostDelegate is a business tool and is not directed at children. We do not knowingly collect data from anyone under the age at which consent is valid in their country.

12. Changes and contact

We will announce material changes in the product before they take effect. Questions: Privacy contact will be published before accounts open..