Translation for convenience. The legally binding version of this document is the German one. In case of any discrepancy, the German text prevails. German statutes keep their German short title and citation style, for example § 19 UStG or § 356 Abs. 4 und 5 BGB: a citation is an address, not a sentence to translate. Read the German version.
Privacy Policy
1. Controller
The controller for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:
Stefan Kern
Kleinsachsenheimer Str. 36
74343 Sachsenheim
Germany
E-mail: hello@postd.ai
2. What data we process, and what for
Account and sign-in: To set up and manage your user account, we process your e-mail address. You sign in with a magic link or a password. You can use the free Light version without an account, and then no data is created here.
Profile data: If you provide them, we process your name, display name, Instagram handle, date of birth, phone number, billing address and profile picture.
Connected social media accounts: If you connect an Instagram professional account to postd, we store that account's ID, its public account name, the account type and an access token issued by Meta. The token is stored encrypted in a separate vault, never reaches your browser and can only be read by our server functions. We use it only for these things: publishing posts on your behalf and, if you have stored one, posting the first comment under the post; loading your existing posts for the feed preview and the evaluation; reading the metrics of your account and your posts; renewing the token with Meta before it expires; and reading the comments under your posts and, when you or a member of your team triggers it in postd, replying to them, hiding them, unhiding them or deleting them. postd never responds to comments on its own. postd does not read or send direct messages. We no longer request the permission for it from Instagram; if you granted it earlier, we do not use it, and it ends as soon as you reconnect or disconnect the account. From Instagram we store only the list of your latest posts (ID, image link, beginning of the caption, time, number of likes and comments) as a cache for the feed preview, which is overwritten on every retrieval, and the metrics (for example reach, views, profile visits and followers per day, and the figures per post), so that the evaluation can show a trend. You can disconnect the account at any time in your account settings: we then try to return the permission at Instagram and delete the token and the cache immediately. If instead you remove postd in your Instagram settings, Meta tells us and we delete the token just the same. What then happens to the metrics and the log is described in section 5.
Connected Facebook Pages and Threads profiles: If you connect a Facebook Page or a Threads profile to a brand, we store for each Page or profile the ID, the public name and an access token issued by Meta. The token is stored encrypted in a separate vault, never reaches your browser and can only be read by our server functions. We use it only to publish posts on your behalf at the scheduled time and, for Threads, to renew the token before it expires. We do not read comments, messages or metrics of these channels. When you connect, our server asks Facebook for the list of Pages on which you may create posts and creates one channel for each Page you approve there. This requires the owner of the brand to have a paid plan. You can disconnect any channel at any time in your account settings: we then delete the token immediately, and scheduled posts for that channel become drafts.
Comments under your posts: If you use the evaluation in postd, we load the comments under your posts from Instagram when you open the Comments tab or a post, and show them to you: the comment text, the public username of the commenting person, the time, the number of likes, whether the comment is hidden, and the replies to it, including those from other people. We do not store these comments in our database. Our servers only pass them through; they sit in your browser's memory until you reload or leave the page. Only members of your brand with the role Owner, Lead or Editor can see them and respond; only Owners and Leads may delete. If you reply to a comment, hide it, unhide it or delete it, we carry that out through Instagram. We pass your reply text on to Instagram, where it appears as a reply from your account; we do not store it. The legal basis is Art. 6(1)(b) GDPR for the processing for you and point (f) for the processing of the public comments of third parties, which they published themselves under your post.
Inbox (switched off): The inbox for direct messages is switched off. postd does not load, display or send direct messages and no longer accepts notifications from Instagram about received messages. We never stored message texts in our database. What still remains from the time before is described in section 5.
More channels: Besides Instagram you can add further channels to a brand and schedule one post to several channels. This requires the brand's owner to be on a paid plan. There are channels for Discord, for Telegram (with your own bot, which you create at Telegram), for a webhook address of your choice, for example at Zapier or Make, and two reminder channels for WhatsApp channels and Instagram channels, which we do not connect to the respective service. Owners and leads of the brand can add, test, change and remove channels. For each channel we store a name, an identifier of the target (for Discord the webhook and channel ID, for Telegram the chat ID and the channel name, for a webhook the host name of the address) and the state of the channel. The secret parts are stored encrypted in the separate vault: the full webhook address together with its signing secret, the Discord webhook address and the bot token. They never reach your browser. Only the signing secret of a webhook is shown to you, once, when you create the channel. The list of channels is visible to the members of the brand and to people who collaborate on a calendar of the brand.
Posts on further channels: At the scheduled time our servers send the post to the channel, not your browser. A webhook receives a message with the title, caption, first comment, format, scheduled time, the name and ID of the brand, the channel name and addresses of the images or videos. These addresses can be opened without signing in for six hours. Discord receives the caption, the first comment, the brand name as the sender name and the files themselves as attachments. Telegram receives the caption, the first comment and addresses of the files, which are valid for one hour. Your name and your email address go to none of these recipients. When you add a channel we query Discord and Telegram once for the name and permissions of the target. For the reminder channels we send nothing to third parties. At the scheduled time we instead send an email to the person who created the post, with the post title, the brand name, the channel name and a link; you then post the text and images yourself. If you do not mark the post as sent within seven days, it counts as expired. If a recipient reports an error, we store up to 300 characters of its reply in the error message on the post and in our error log.
Calendar subscription link: If you enable a subscription link for the editorial plan, it gives anyone who knows the address, without signing in, the title, time, state, format and channel name of the scheduled and published posts, and for a webhook channel the host name of the address. It contains no images, no texts and no names of people. We store when the link was last retrieved. You can revoke it at any time.
Saved projects: We store what you create in the tool (projects, drafts) so you can open it again and keep working.
Trash: If you delete a project, yourself or through your connected AI, we put it with its content into the trash for 14 days so that you can restore it. For this we record who deleted it, when, and whether this was done through an AI, with its name. The person who deleted it can see and restore it, for private projects you yourself, and in a brand owners and leads. A share link of the project ends when it is deleted and does not come back when it is restored.
Connection with your AI: You can connect postd to an AI that you use yourself, for example Claude, ChatGPT, Codex or Gemini. There is an interface for this based on the Model Context Protocol at postd.ai/mcp. When you connect, you sign in to postd and explicitly allow access. For this we store the name the AI gives, its redirect address, your consent with the time, and the access keys the AI receives in your name. The AI works with your rights: it only sees brands you are a member of, and within them only what you may see yourself. When it asks, we give it names and identifiers of your brands, colours, fonts and details from the brand kit, names, texts and structure of your posts, names and content of your moodboards as texts, shapes and arrangement (for an image only that one is there, not the file), your folders, scheduled and published posts with title, time, status and channel name, and what you have currently selected in postd. The interface does not disclose image files, email addresses, access credentials of your channels or payment data. What the AI orders, we first store as an order: the requested texts and details, the name of the AI, notes from our check, the status of the order (waiting, being built, built, undone, discarded or failed with a short reason), for text changes and new colours the values before the change so that you can undo them, and the times. Your open postd app picks up the order and builds a post, a text change, an entry in the moodboard or the brand kit, or a calendar entry from it, without you having to confirm every step. If postd is closed, this happens the next time you open it. A post that is meant to be published is placed in the calendar for approval: it is only published after you or someone with the role lead or owner has approved it there. In the Claude tab you see the history and can undo every change. We also record which AI called which function and when, on which project or board, whether it worked, and a short error message, but no content and no inputs to the AI. We do not see what you write to the AI in the chat. You can disconnect the connection at any time in postd in the Claude tab under Connected AIs.
What you are currently selecting: If an AI is connected, we store what you have currently selected in postd so that your AI knows what you are referring to: the area (moodboard, editor or explorer), the identifier of the board or project and of the brand, the selected objects, text passages or projects with their names, and a short description such as “2 objects on the board”. There is only one such entry per account. It is overwritten with every new selection and counts as empty after 30 minutes. As long as postd is open and an AI is connected, the app renews it every 45 seconds; this is how the AI recognises whether postd is currently open and builds its order immediately. Only you and your AI can see it.
Content of other members: If you work with others in a brand, a member's connected AI can also read the posts, moodboards and texts you created there, as far as this member may see them in postd. The interface does not disclose your name or your email address in the process. The legal basis is our and your legitimate interest in working together in the brand (Art. 6(1)(f) GDPR).
Moodboards: A moodboard belongs to a brand. We store its name, its content (images, texts, notes, shapes, drawings and their arrangement) and a small preview image for the overview. Uploaded images are kept in private storage. Depending on the setting, a board is visible to all members of the brand, with the role guest for viewing only, or only to you and the people you add.
Invitations and read-only links for moodboards: From the Pro plan on you can invite people outside your brand to a board by email, to view, comment or edit. For this we store the invited person's email address, the role, a secret invitation code, the person who invited, the chosen language and the times of sending, opening, accepting, declining or withdrawing. The invitation is valid for 14 days and only for this address. For every invitation email Resend tells us whether it was delivered, delayed, bounced or reported as spam. We store this status with the email ID and, for a bounce, with the error message. We do not invite an address that has bounced or complained again for 180 days. When someone accepts the invitation, we create access to the board for that person: account ID, role, who granted it, time and last opening. The owner of the board and, for shared boards, owners and leads of the brand see the people with access together with name, email address, role and the time they last opened the board. You can also create a read-only link. Whoever knows it can view the board without an account, but cannot change or comment on it. For the link we store the code, the creator, the expiry, how often it was redeemed and when it was last read, but not who read it. We show the board's images to these visitors through addresses that are valid for five minutes. If a person with an account chooses “Add to my boards” via the link, we treat them like an invited person; the owner then sees their name in the list of people.
Real-time collaboration: When several people work on a moodboard at the same time, they can see each other. For this the open windows send your display name, your account ID, a color, the position of your mouse pointer on the canvas and the objects you have selected over a private real-time channel of the board (Supabase Realtime). We do not store this information. It exists only while the board is open in your window and sits in the other people's working memory. As display name we use the name you gave in the brand, otherwise your profile name, otherwise it says “Guest”. We never show your email address. Everyone who may at least view the board can see and be seen, including invited people outside the brand. Anyone who opens a board only through a read-only link without an account appears nowhere and sees nobody. We also store every change to the board as a change packet with your account ID, the time and a random window identifier. The same packets are also sent at once to the other open windows over the real-time channel. A packet contains the change itself, so also texts you type and the paths of uploaded images. The change log makes sure everyone sees the same state and nobody overwrites work. The account ID is a random value without a name or email address; it is technically visible to other people with access to the board, but it is not displayed.
Comments, mentions and history in moodboards: Whoever may comment on a board can pin a note to a spot or an object and reply to it. We store the text (up to 2,000 characters), your account ID, your display name at the time of writing, the position, the times and whether the note is resolved. Everyone with an account who has access to the board can read, writing requires the role Comment, and you yourself, the owner of the board and, for shared boards, owners and leads of the brand can delete. With “@” you can mention people who have access to the board. For this, commenters see the display names of all people with access, including invited people outside the brand. For each mentioned person we store the account ID, whether they opened the note and the status of the email; whoever may read the board sees who was mentioned. A mentioned person receives an email at their login address with the name of the writer, the names of board and brand, a link and a short excerpt of the comment (up to 160 characters), which is left out if it contains a link, an address or an “@”. Each person receives at most one email per comment, and we send at most 60 such emails per hour and writer. This email is a notification about the collaboration and currently cannot be unsubscribed from individually. We also create versions of the board in the background, a complete copy of the content with the time and the person whose window triggered it: automatically at most every ten minutes after a change, named when someone with edit permission creates a version, and before every restore. Only people who may edit the board can see this history.
Contract and billing data: For the paid versions we process your entitlements and your subscription status.
Local storage: We use your browser's localStorage for your settings. It also holds the position and zoom with which you last looked at a moodboard, and a moodboard you create without an account. We keep your current draft and images that you load into the feed preview for viewing only in your browser's IndexedDB. All of this data stays on your device, we do not transmit it. We keep the access code of a read-only link that you opened in the sessionStorage for the duration of the tab; it goes to us only to load the board.
Remove background: The function runs in your browser, on the graphics unit of your device. Your photo goes neither to us nor to third parties for this. The first time you use it, your browser downloads the computing model (about 115 MB) once from our file storage at Supabase and the runtime (about 27 MB) from postd.ai. The model stays in your browser’s cache storage so that it does not have to be loaded again every time.
Device check for Remove background: If your device has the required graphics unit, your browser asks briefly, as soon as you open the editor, whether the files are available. It only requests the headers, not the content of the files. If the model is already in the cache storage, the request to Supabase is skipped. For these requests Supabase and Netlify technically see your IP address and the browser identification, even if you work without an account. Your browser checks for itself whether your device can run the function; the result does not leave your device. If the function fails twice because the hardware is not sufficient or it takes too long, your browser remembers this for 14 days in its localStorage and hides the function. The cache storage for the model and this marker are technically necessary for the function (§ 25 Abs. 2 Nr. 2 TDDDG).
Counter for Remove background: The function needs an account. After each successful cut-out we count how often you have used it in the current calendar month, in every plan. For this we store your account ID, the month, the number and the time of the last count. On the Free plan the counter enforces the limit of five cut-outs per month.
Chat with Posty: You can chat with Posty on our info pages. To answer, your messages (the last six per request) go to our server function and from there to Anthropic's AI, which writes the reply. In the editor, Posty answers questions about how to use the app; for this your question, the chat so far and the state of your draft (number of slides, format, chosen template and topic) go to the same AI. For a caption suggestion we transmit the headline of your post and the format. We do not send any data from your Instagram account to any AI. Please do not enter sensitive data in the chat. We do not store the chat unless you send us a request via the mail card. As an abuse brake we form an irreversible check value from IP address, browser identifier and a daily changing key; we do not store the IP address itself.
Requests via Posty: If you send a request via the mail card, we process your email address, your name if you give it, your message, the chat so far and the page you come from, in order to reply to you personally (Art. 6(1)(b) and (f) GDPR). We delete the request once it is dealt with and no longer needed, after twelve months at the latest.
Tips, news and offers by email: If you tick the box for this when you create your account or later in your account, we first send you an email in which you confirm that you want these emails (double opt-in). Only then do you get at most one email a week with guides, tips, pointers to features and free tools, news from our Discord and from Posty, and the occasional offer. For this we process your email address, your first name, when you ticked the box, confirmed the email or unsubscribed, when you signed up, which of these emails we sent you and when, whether you have a paid subscription and your current streak in the editor (so we do not write to you while you are working every day anyway). For an offer we create a one-time code at Stripe that carries your account ID. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 7(2) UWG). You can withdraw it at any time: with the unsubscribe link in every email, with the unsubscribe function of your mail program or in your account under “Friends & streak”. You get emails about your account and your payments regardless.
Waitlist for the apps: If you sign up on our website to be notified about the desktop app or the app for iPhone and Android, we process your email address, the list you chose, the language of the page, when you signed up and confirmed, and an irreversible check value of your IP address as an abuse brake (it is deleted as soon as you confirm). We first send you an email in which you confirm that the address is yours (double opt-in). Only after that, as soon as the respective app is out, do you get one email with the link to the app and a gift of three months of Studio. For the gift we set up access for your email address, which you can accept in the email. In the same email you can agree to receive tips, news and offers afterwards. If you do, we carry your agreement over into the consent for tips, news and offers. If you do not, we will not write to you about the waitlist again. The legal basis is your consent (Art. 6(1)(a) GDPR, section 7(2) UWG). You can withdraw it at any time: with the unsubscribe link in every email, and we delete your entry when you do.
Requests by email: If you write to us at hello@postd.ai, for example with a question or with proof that you are enrolled so that Pro is free for you, we process your sender address, your message and anything you attach, in order to reply to you and handle your request (Art. 6 (1) (b) and (f) GDPR). We use proof only to check it.
Errors and usage: So that we can find bugs and improve the service, we record technical events: which function was used, for example an export, a new project or a question to our help, as well as program errors with the error message, file and line, page and a coarse browser label. If you are signed in, these entries belong to your account, otherwise to no person. We do not transmit the contents of your posts; for questions to our help we count only the number of characters, not the text.
Problem reports: If you report a problem to us through the form, we process your text, your email address if you provide one, and the technical environment: page, browser, window size, language and the most recent error messages from your browser. The form shows you everything that is sent along before you submit.
Visit statistics: We count page views on our website, which sections of a page were seen, the time spent, the scroll depth, the device category and the origin, meaning only the domain of the referring page plus campaign parameters from the link. We use no cookies for this and store nothing on your device. To tell visitors apart we derive a non-reversible checksum from the IP address, the browser identification and a key that changes daily; we do not store the IP address itself. Recognising anyone beyond a single day is therefore ruled out. We respect a “Do Not Track” signal from your browser.
Notes on shared links: Anyone who receives a share link from you can leave a note on an individual slide without signing in. For this we process the name that person enters themselves and their text. So that they can withdraw their own note again, we store a random identifier in their browser’s localStorage; it is not linked to any person, we do not evaluate it, and it only leaves the device as a value to compare against. We use the IP address transiently as an abuse brake and do not store it. As the creator of the link you are notified about new notes by email; you can delete them at any time and turn them off entirely for a link.
3. Legal bases
We process your data to perform the contract with you or to take steps prior to entering into a contract (Art. 6(1)(b) GDPR). Where we process data for technical operation, for security and to improve the service, we rely on our legitimate interests (Art. 6(1)(f) GDPR).
For collaborating in moodboards and for sending posts to further channels, the basis is the usage contract (Art. 6 (1) (b) GDPR). Towards people you invite or mention, and towards the other members of a brand, the processing rests on our legitimate interest in enabling collaboration in the team and protecting the service from abuse (Art. 6 (1) (f) GDPR).
4. Recipients and processors
An overview of all processors and where they process data is on the page Security and privacy. Business customers sign a data processing agreement.
Supabase: For hosting, database, authentication, the real-time transmission when collaborating on moodboards and the delivery of the computing model for “Remove background” we use Supabase as a processor. Processing takes place in the United Kingdom (London region). The legal basis for this data transfer is the adequacy decision of the European Commission for the United Kingdom, which confirms a level of data protection comparable to the EU.
Stripe: Payments are handled by Stripe Payments Europe, Ltd. (Ireland) as our contractual partner. As part of payment processing, data may be transferred to affiliated Stripe companies in the USA (Stripe, Inc.), for example for technical processing and fraud prevention. That transfer is based on the standard contractual clauses of the European Commission or on the EU-US Data Privacy Framework. Your payment data itself is processed directly by Stripe and held there, not with us.
Netlify: We use Netlify, Inc. (USA) for static hosting and delivery through a content delivery network. This involves processing IP addresses and server log data, among other things. The transfer to the USA is based on the standard contractual clauses of the European Commission or on the EU-US Data Privacy Framework.
Resend: For internal notification emails to us as operator, for example on a purchase or cancellation, for the confirmation to you when you report an error through the form and give your email address, for the notification to you when someone leaves a note on a link you shared, for the invitation we send on behalf of an owner or lead to the email address of a new person in the team, for invitations to moodboards, for the notification of a person who is mentioned in a moodboard comment, for the “Time to post” reminder to the person who created a post for a reminder channel, for tips, news and offers if you agreed to them, and for the confirmation and app email of the waitlist we use the email service Resend (USA). Resend reports the delivery status of invitation emails back to us. The transfer to the USA relies on standard contractual clauses of the EU Commission or the EU-US Data Privacy Framework.
Anthropic: Posty's replies and the caption suggestions are generated by Anthropic's AI (Anthropic PBC, USA), to which your chat messages and the details about your draft named in section 2 are transmitted for this purpose. The transfer to the USA relies on the EU Commission's standard contractual clauses or the EU-US Data Privacy Framework.
Your connected AI: If you connect postd to an AI such as Claude (Anthropic), ChatGPT or Codex (OpenAI) or Gemini (Google), we give this AI the data named in section 2 as soon as it asks for it. You choose the provider yourself; it does not work on our behalf but on the basis of your own contract with it, and processes the data under its terms and its privacy policy, including what it stores and whether it uses it to improve its models. The providers are mostly based in the USA or process data there. The transfer takes place at your request and is necessary for the performance of the contract with you (Art. 49(1)(b) GDPR). Postd itself pays for and operates no AI for this connection.
Meta: If you connect an Instagram professional account, a Facebook Page or a Threads profile, our servers query Instagram, Facebook or Threads on your behalf, services of Meta Platforms Ireland Limited (Ireland): to publish posts; for Instagram also to load posts, metrics and comments, to reply to, hide, unhide or delete comments; and to renew the access token and return the permission when you disconnect. In doing so, Meta processes data under its own terms and its own privacy policy.
Discord: If you set up a Discord channel, our servers send posts on your behalf to the webhook address you provided, to Discord (Discord Netherlands B.V., Netherlands, for users in the European Economic Area; group companies in the USA). Section 2 lists which data this is. Discord processes it under its own terms and privacy policy. According to Discord, the transfer to the USA relies on standard contractual clauses of the EU Commission or the EU-US Data Privacy Framework.
Telegram: If you set up a Telegram channel, our servers send posts on your behalf through the bot you provided to Telegram (Telegram Messenger Inc., British Virgin Islands). We store the bot token encrypted in the vault for this. There is no adequacy decision of the EU Commission for the British Virgin Islands. The transfer takes place at your request and is necessary for the performance of the contract with you (Art. 49 (1) (b) GDPR). Telegram processes the data under its own terms and privacy policy.
Webhook recipients: You determine the address of a webhook channel yourself. We do not know who operates it and where; it can also be a recipient outside the EU. By entering the address you decide who receives the posts. The transfer takes place at your request and is necessary for the performance of the contract with you (Art. 49 (1) (b) GDPR).
5. How long we store data
We store your data for as long as we need it for the stated purposes, as a rule at most for as long as your user account exists. The exception for shared moodboards is described under “After account deletion”.
Measurement data: We delete usage events after 180 days, error data after 90 days and visit statistics after 400 days. We treat problem reports like correspondence: we delete them once they are resolved and no longer needed.
Tips, news and offers: We keep the details of your consent as long as you receive the emails, and for three years after you withdraw it, so that we can prove that you had agreed. We delete the record of which emails we sent you together with your account.
Waitlist: We delete unconfirmed entries after 7 days. Once you have confirmed, we delete your entry 30 days after we sent you the email about the app. The exception is if you agreed to the newsletter in that email and do not have an account yet: then your agreement stays stored until you sign up, at most until you unsubscribe. When you unsubscribe we delete at once. We keep the details of the gift (email address, term) as long as the gift is open or running, and delete them on request.
Requests by email: We treat them like correspondence and delete them once the request is dealt with and we no longer need them. We keep proof for the free Pro access of students only for as long as we need it for the check and for the duration of the free access.
Counters against abuse: For invitations, changes to the board, comments, mention emails, calls via read links and calls by your connected AI, we count actions per account or link so that nobody overloads the service or misuses emails. The counters contain the account identifier or the identifier of the link and are deleted after about two hours.
Counter for Remove background: The counter belongs to your account and stays for as long as it exists. If you delete your account, we delete the counter with it.
After the contract ends: If your subscription or contract ends, your projects saved in the cloud remain available for seven more days so that you can export them in peace. After that we delete them, together with existing share links. We do not delete moodboards and posts automatically when the contract ends. They stay stored as long as nobody deletes them; whether you or others can still open them then depends on the plan.
Shared preview links: When you create a share link, we store a copy of the slides as images for it, plus an editable copy of the draft so that authorised viewers can take it over into their own account. Font files from your own brand kit are not included. We delete both copies automatically when the link expires: seven days after creation on the Free plan, after 30 days with a subscription or Lifetime. If you revoke a link yourself before then, the preview stops working immediately and we delete the copy at the next cleanup run. When your contract ends, we delete existing share links together with your projects, even if their own period is still running.
Notes: Notes that viewers leave on a shared link are deleted together with that link, so at the latest when it expires. If you turn notes off for a link, they are no longer visible to viewers; that alone does not delete them, which you can do individually.
Invitations and read-only links: Open invitations are valid for 14 days. Ended or expired invitations, including email address and delivery status, we delete 90 days after they end, and 180 days after a bounced or spam-reported email. A read-only link is valid for at most 30 days if the brand's owner is on a paid plan, otherwise for at most seven days. We delete revoked links after 90 days. A person's access ends as soon as it is withdrawn or they give it up; we then delete the row with their account ID immediately.
Change log and history: We delete change packets once they have been merged into the board's state and are older than 30 days. We delete automatic versions after 30 days and keep at most 40 per board. Named versions and versions before a restore (together at most 40 per board) stay until someone with the necessary rights deletes them or the board is deleted. An object you delete from a board therefore remains in automatic versions for up to 30 days and longer in named versions. We do not store presence, mouse pointer or selection.
Comments in moodboards: Comments and mentions stay until they are deleted: by the author, by the board's owner or, for shared boards, by an owner or lead of the brand, together with the board or together with the brand. If you withdraw someone's access or someone leaves the brand, their comments remain, and they can no longer read them. We cannot take back a mention email that has already been sent; it sits with Resend and in the recipient's mailbox.
Deleting moodboards: If you delete a moodboard, we delete it immediately and permanently, with all comments, mentions, the history, the change log, the invitations, links and uploaded images. The owner of the board and, for shared boards, owners and leads of the brand can do this. Moodboards also disappear together with the brand and with your account if you are the only member of the brand. Images that are not removed immediately when you delete, for example when you delete an entire brand, are removed by our daily cleanup run, usually within three days.
Remains of the former inbox: From the time the inbox was in operation, entries still exist, without message text and without the names of conversation partners: notifications about received messages (ID of your account, type of event, ID of the message, time), the reply log (Instagram account, member, time, whether it succeeded) and the record of who connected the Instagram account and to whom that person had granted access to read the messages. We no longer use them and keep them only until deletion (Art. 6(1)(f) GDPR). We delete the notifications after 30 days and the entries of the reply log after 90 days, all of it at the latest together with the connection to your Instagram account, your brand or your account.
Access to connected accounts: We store the access token of a connected Instagram, Facebook or Threads account for as long as the connection exists. If you disconnect it in your account or remove postd in your Instagram settings, we delete it immediately, as well as the cache of the feed preview. The metrics and the log of comment actions then remain, so that your history stays readable, until you delete your brand or your account or request deletion of your data through Instagram. In that case we delete the connection, the token, the metrics stored with it, the log of comment actions and any remaining entries of the former inbox in full, and give you a confirmation code you can use to look the process up.
Log of comment actions: When you or a member of your team replies to a comment, hides it, unhides it or deletes it, we record on which Instagram account, by which member and when it happened, which action it was, the ID of the comment and whether it succeeded. We do not store the comment text, the reply text or the name of the commenting person for this. Only Owners and Leads of the brand can view the log. It serves traceability within the team and limiting misuse: we allow at most 20 deletions per hour and member and 120 actions per hour and Instagram account (Art. 6(1)(f) GDPR). We delete the entries after 90 days, at the latest together with the connection to your Instagram account, your brand or your account. If a member deletes their own account, we remove their identifier from the entries.
Trash: A deleted project stays in the trash for 14 days. After that we delete it permanently, also if the owner, a lead or the person who deleted it deletes it permanently before then.
Connection with your AI: The consent and the access keys remain until you disconnect or delete your account; then they become invalid immediately. Orders that postd could not pick up because the app was not opened expire after 30 days. We delete built, undone, discarded, failed and expired orders 90 days after completion; after that, undoing them in the history is no longer possible either. We delete the log of calls after 90 days. The entry for your current selection is overwritten by each new selection; it disappears with your account. What the AI stores with its provider, for example your chat history, is governed by your contract with the provider; you can delete it there.
Posts and channels: We do not delete posts (title, caption, first comment, time, state, error text and the ID of the message at the recipient) automatically. They stay until an owner or lead deletes them or the brand is deleted. If you remove a channel, we immediately delete its credentials in the vault and the channel itself; open posts of the channel become drafts, already published ones remain. We do not revoke anything at the provider: you have to remove a Discord webhook or a Telegram bot there yourself if needed. Messages that have already gone to a recipient stay with them, and we cannot delete them. We delete error messages in the error log after 90 days.
Rendered post files: When you schedule a post, your browser turns the slides into an image or video file and stores it in private storage so that Instagram, Telegram or a webhook recipient can fetch it at the scheduled time; we upload it to Discord. If you schedule a post to several channels, we create a separate copy of the files for each channel. 30 days after a post has been published or has finally failed, we delete these files. Files whose post no longer exists we delete in the next cleanup run. We cannot delete copies that are at Discord or Telegram.
After you delete your account: If you delete your account, we delete your data without delay and completely, including projects, uploaded images, profile data and shared links. We delete moodboards in brands that only you use together with the brand, including comments and history. If a board belongs to a brand with other members, it remains for them, and ownership passes to the owner. Your comments, the change packets and the versions in it then remain without a link to your account; your comments keep showing the display name you had when writing. On request to hello@postd.ai we delete or anonymize them earlier. Also excluded is data that we have to keep because of statutory retention obligations, such as invoice data under commercial and tax law. Payment data is held by Stripe and subject to its retention periods.
6. Your rights
You have the right of access, rectification, erasure, restriction of processing and data portability, and a right to object to processing. An informal message to the contact details above is enough. You can also delete your account yourself at any time in the Account area.
7. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement.