PostHaste Privacy Policy
Effective date: October 22, 2026
This Privacy Policy explains how PostHaste Technologies, Inc. ("PostHaste," "we," "us," or "our") collects, uses, shares, and protects information when you use the PostHaste website at posthaste.io, the PostHaste application, and related services (the "Service"). It also explains your choices and rights.
PostHaste is a business tool. Our customers are small local businesses and the people who manage them ("owners" and "teammates"). If you have questions, contact privacy@posthaste.io.
1. Summary
- We collect what you give us, what you let us read from accounts you connect, and basic technical data needed to run the Service.
- We use it to build your brand profile, research your local market, draft posts and images for your approval, and (when available) publish the posts you approve.
- We never publish anything without your explicit approval.
- We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
- We do not use data from connected platforms (Meta, LinkedIn, Google) to train generalized AI models, and our AI providers do not use it to train theirs.
- Access tokens for connected accounts are encrypted in our application before they are stored.
- You can delete your account at any time and disconnect a connected platform at any time.
2. Information we collect
2.1 Information you give us
- Account information: your email address, password (stored by our authentication provider in hashed form), and your role on the business account.
- Business information: business name, website address, location (such as city and state), industry, goals, brand preferences, content guardrails (topics to avoid), and similar settings.
- Content you add: logos, photos, and other brand assets you upload; text you type (such as post ideas, edits, and feedback on drafts).
- Teammates: the email addresses of teammates you invite.
- Mobile number (planned): if you opt in to text alerts, your mobile number and a record of your consent.
- Support messages: anything you send us when you contact support.
2.2 Information from your website
When you give us your business website address, we retrieve the content of that website (for example, its text and images) to understand your business and build your brand profile. We retrieve only that website and any other web pages you ask us to use as sources (public sources about your area are described in Section 2.5).
2.3 Information from accounts you connect
When you choose to connect a platform, we receive information from that platform through its official API, only within the permissions you approve on the platform's own authorization screen. Section 5 lists what we receive from each platform.
2.4 Information we create
- Brand profile and research: a profile of your business's voice, audience, and offerings, and research about your local market.
- Outputs: the post ideas, captions, and images we generate for you, and your approve, edit, and skip decisions.
- Usage and account records: your plan, post counts, rate-limit counters, and product activity.
- Email delivery records: if one of our emails to an address bounces, is refused by our email provider, or is marked as spam, a record of that address and the reason (Section 9).
- Anti-abuse records: a business "fingerprint," which consists of your business name (in a standardized form), website address, and city and region, together with a one-way hash of those details. We use it only to enforce one free trial and one bonus per business, including by matching similar business names.
2.5 Information from public sources
To research your local market, we use publicly available information about your area, such as weather forecasts from the U.S. National Weather Service, news headlines, public events and civic information (including your city or county's official website), and web search performed through our AI provider. This research is about your market, not about individual people.
2.6 Billing information
Payments are handled by Stripe, Inc. on a Stripe-hosted checkout and billing portal. Stripe collects your payment card and the billing details you give at checkout (such as your billing name and address and any tax ID), and keeps them; we do not receive or store your full card number. We keep your Stripe customer and subscription identifiers, your plan and commitment, your subscription and payment status, and a record of each Post Pack you buy (its Stripe payment reference and how many of its posts you have used), as needed to manage your subscription. When you view your billing history, we show you the invoices Stripe holds for your account. When you agree to automatic renewal, we send the version of the wording you agreed to Stripe, which keeps it with your checkout. Stripe also processes this information under its own privacy policy, including for fraud prevention.
2.7 Technical information
When you use the Service, our hosting and authentication providers process technical data such as IP address, browser type, device information, pages requested, and timestamps. We set first-party cookies needed to run the Service, for example to keep you signed in, to complete a connection to a platform, and to remember choices you make in the app (such as the plan you picked). We do not use your IP address to limit free trials; the one-trial-per-business limit is enforced by the business identity check described in Section 2.4 (your standardized business name, website address, and city and region).
We do not use analytics or advertising pixels, third-party advertising cookies, or cross-site tracking. If that changes, we will update this section first.
3. How we use information
We use information to:
- provide the Service: build your brand profile, research your market, generate drafts, and publish posts you approve;
- operate your account, including authentication, teammate access, billing, post caps, and rate limits;
- send transactional messages (verification, security, billing, and service notices) and, if you opt in, text alerts;
- keep the Service safe, including content safety filtering, fraud and abuse prevention (such as one free trial per business), and security monitoring;
- improve the Service, including creating de-identified, aggregated statistics (for example, which image styles are approved more often in an industry); these statistics never include data received from a connected platform and never identify you or your business;
- provide support; and
- comply with law and enforce our Terms.
We do not use your information for targeted advertising, and we do not sell it.
4. AI providers and how your data is used with AI
We use third-party AI providers to generate content:
- Anthropic (text generation, analysis, and web search for market research); and
- OpenAI (image generation).
We send these providers the information needed to generate your content, such as your brand profile, business details, relevant research, your instructions, logos and photos you upload (to identify your brand colors, fonts, and style and to describe your images), and content retrieved from your website (to build your brand profile). We do not send these providers information we receive from a connected platform.
We use these providers through their business APIs, under terms that do not permit them to use our API data to train their models. Under those terms, a provider may keep API data for a limited period for abuse and safety monitoring.
No training of generalized AI models. We do not use data received from Meta, LinkedIn, or Google, or your other content, to develop, improve, or train generalized or foundational AI or machine learning models, and we do not allow our AI providers to do so.
5. Connected platforms: what we receive, how we use it, and how we delete it
You can connect accounts in Settings > Connections. Platforms become available there one by one; until a platform is available it shows as "Not available yet." Publishing directly to a platform is a planned feature that becomes available platform by platform. Only an Admin or a member with edit access can connect or disconnect an account, and you can disconnect any platform at any time in Settings > Connections.
5.1 Meta (Facebook Pages, Instagram, Threads)
- What we receive: the list of Facebook Pages you manage (shown only so you can pick one; we store only the Page you select), the selected Page's ID and name, your connected Instagram Business account ID and username, your Threads profile ID and username, your Meta user ID, and the permissions you granted. Meta also returns your name when you connect; we do not store it. When publishing is available, we will also receive confirmation data for posts we publish (post ID and publish time). If you connect through Meta Business Manager, we access only the Pages and accounts you choose.
- How we use it: only to (a) let you select which accounts to connect; (b) show you in PostHaste which accounts are connected and whether a connection needs attention; and (c) when publishing is available, publish the posts you approve and show your publishing history in PostHaste. We do not read your Page's posts, and we do not use Meta data to build your brand profile or send it to our AI providers.
- What we do not do: we do not read private messages or comments, do not collect audience demographics, do not engage or post on your behalf without approval, and do not sell or share Meta data.
- Storage and deletion: access tokens are encrypted (Section 8). When you disconnect, we delete the tokens and stop scheduled posts for that account. We keep the account's name and ID so you can see in PostHaste what was connected, until you delete your account or ask us to delete them. See Section 11 and our Data Deletion Instructions for how to delete your data.
5.2 LinkedIn
- What we receive: the identifiers and names of the LinkedIn Company Pages you administer and choose to connect, and the permissions you granted. We do not request your LinkedIn profile, name, or email address. When publishing is available, we will also receive confirmation data for posts we publish.
- How we use it: only to let you select a Company Page, show you which Page is connected, and, when publishing is available, publish the posts you approve to that Company Page.
- Storage and deletion: tokens are encrypted; on disconnect we delete the tokens and stop scheduled LinkedIn posts, and we keep the Company Page's name and ID so you can see what was connected, until you delete your account or ask us to delete them. Until LinkedIn approves direct publishing, you may copy content and post it yourself.
5.3 Google Business Profile
- What we receive: when you connect, Google asks you to let PostHaste manage your Business Profile. We use that permission to read the list of Business Profile accounts and locations you manage, with each location's name (shown only so you can pick one; we store only the location you select), and to publish posts you approve to that location. For the selected location we store its Google resource name (which includes the ID of the Business Profile account it belongs to), its name, and the permissions you granted. We do not store your Google sign-in identity, your name, or your email address. When publishing is available, we will also receive confirmation data for posts we publish (the post's ID and publish time).
- How we use it: only to (a) let you select which location to connect; (b) show you in PostHaste which location is connected and whether the connection needs attention; and (c) when publishing is available, publish the posts you approve to that location and show your publishing history in PostHaste. We do not use Google data to build your brand profile, and we do not send it to our AI providers.
- What we do not do: we do not read, receive, or store your Google reviews or the questions and answers on your profile, we do not change your business information, and we do not post on your behalf without your approval.
- Storage and deletion: access tokens are encrypted (Section 8). When you disconnect, we delete the tokens and stop scheduled posts for that location. We keep the location's name and ID so you can see in PostHaste what was connected, until you delete your account or ask us to delete them. You can also remove PostHaste's access in your Google Account's security settings (third-party connections); that stops our access. To have the location's name and ID deleted, disconnect it and ask us to delete them, or delete your account (Section 11).
Google API Services User Data Policy disclosure. PostHaste's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we use Google user data only to provide and improve user-facing features that are visible in PostHaste; we do not transfer it to others except as needed to provide those features, to comply with law, or as part of a merger or acquisition; we do not use it for advertising; we do not sell it; we do not allow humans to read it except with your consent, for security purposes, to comply with law, or when aggregated and anonymized for internal operations; and we do not use it to develop, improve, or train generalized AI or machine learning models.
6. How we share information
We share information only as described here:
- With the platforms you connect, to publish the content you approve (Section 5).
- With service providers who process data for us under contract (Section 7).
- With your teammates, who can see your business account's content according to their access.
- For legal reasons, if we believe in good faith that disclosure is required by law, or needed to protect the rights, safety, or property of PostHaste, our customers, or others.
- In a business transfer, such as a merger, acquisition, or sale of assets, subject to this Privacy Policy.
- With your consent or at your direction.
We do not sell personal information and do not share it for cross-context behavioral advertising. We do not share mobile numbers or SMS opt-in consent with third parties for their marketing purposes.
7. Service providers (subprocessors)
| Provider | Purpose | Data involved |
|---|---|---|
| Vercel | Website and application hosting | All data passing through the application; technical data |
| Supabase (running on Amazon Web Services) | Database, authentication, and file storage | Account data, business data, content, uploaded assets, encrypted tokens |
| Anthropic | AI text generation, analysis, image understanding, and web search | Brand profile, business details, instructions, relevant research, uploaded logos and photos, and content retrieved from your website |
| OpenAI | AI image generation | Image prompts derived from your brand profile and post content |
| Resend (sending through Amazon SES) | Transactional email | Email address, message content |
| Stripe, Inc. (including Stripe Billing, Stripe Checkout, and Stripe Tax) | Checkout, subscriptions, payments, invoices, sales tax | Billing contact, business name and tax ID, and payment details (collected by Stripe), plan, invoice and payment data |
When text alerts become available, we will add the provider that delivers them to this list before we send any text.
We also request public information from these services. They receive no personal information about you:
| Service | Purpose | What we send |
|---|---|---|
| OpenStreetMap Nominatim | Converting your city and state to map coordinates for local weather | City and state only |
| U.S. National Weather Service | Local weather forecasts | Map coordinates of your area only |
| Wikidata and Wikipedia (Wikimedia Foundation) | Finding the official websites of your city or county and your area's universities, and a picture of your city for your Research page | City and state only |
| Your city or county's official website, and local university and community event calendars | Local civic information and events | Nothing beyond a request for their public pages |
| Google News | Current news headlines | Nothing beyond a request for the public headline feed |
| Pexels | Stock photos shown on your Research page | Search terms describing a topic |
8. How we protect information
- Token encryption. Access and refresh tokens for connected accounts are encrypted in our application with AES-256-GCM, using a separate key derived for each business account from a master key held outside the database, before they are stored. Tokens are decrypted only in server memory when needed to connect, refresh, or publish, and are never exposed to your browser.
- Encryption at rest and in transit. Our database and file storage are encrypted at rest (AES-256) by our infrastructure provider, and data is encrypted in transit using TLS.
- Account isolation. Database row-level security limits each business account to its own data.
- Access limits. Staff access to customer data is limited to what is needed to operate and support the Service.
No system is perfectly secure. If we learn of a security incident affecting your personal information, we will notify you as required by law.
9. Retention
| Data | How long we keep it |
|---|---|
| Account, business, and content data | While your account is active |
| After your account is closed (a free trial ends without a paid plan, a subscription ends, a final payment fails, or a charge is disputed) | We keep it in a restricted state for 90 days so you can reactivate (after a disputed charge, by contacting us), download your approved posts, or delete it sooner, then delete it automatically |
| Connected-platform access tokens | Until you disconnect the platform or delete your account, then deleted |
| Other data received from a connected platform (account, Page, and Business Profile location names and identifiers, your Meta or Threads user ID, the permissions you granted, and the platform's ID for each post we published there) | While your account exists, including after you disconnect, so you can see what was connected and what was published. Deleted when you delete your account or ask us to delete it, or, for Facebook, Instagram, and Threads, when Meta or Threads sends us your deletion request (Section 11; see the next row for what we keep after that request, and our Data Deletion Instructions for the one copy of each post's ID we keep in our delivery log until your account is deleted) |
| Record of a Meta or Threads deletion request (a keyed one-way hash of your user ID, the confirmation code, and when the request was received and completed) | Kept indefinitely, so you can check the request's status and so we can recognize a repeated request; it is never the ID itself |
| Business fingerprint (standardized business name, website address, city and region, and a one-way hash of them) and trial/bonus eligibility markers | While your account exists. When your account is deleted, we keep only a keyed one-way hash of the fingerprint (it cannot be reversed into your business details without a secret key we hold) and whether the one-time bonus was used, to prevent repeat free trials and bonuses. We keep it indefinitely for that purpose only; it contains no personal information about you, and a deletion request does not remove it |
| Email delivery problems (an email address that one of our emails bounced from, that our email provider would not deliver to, or that marked one of our emails as spam; the reason; the email provider's reference for the event; and when) | Kept indefinitely, even after your account is deleted, so that we do not send email to that address again, unless you ask us to try your own address again in your email settings; it is not linked to your account |
| Billing records (payment details, invoices, receipts, and tax records) | Kept by our payment processor, Stripe, as tax and accounting law requires. Our own copy of your plan and payment status is deleted with your account. Stripe's customer record for your business keeps our internal account number |
| Records of billing problems flagged for our staff (the payment processor's reference number and the reason, with no name, email, or business details) | Kept indefinitely, so that we can answer later questions about a payment |
| Backups | Deleted data may persist in encrypted backups until they expire on our hosting provider's normal backup cycle |
When you delete your account in Settings > Account, your access ends at once and your account is scheduled for deletion immediately rather than held for 90 days. If you have an active subscription, it is cancelled when we act on the deletion (at once in Settings, or when we act on an emailed request): nothing more is charged, and the time left on it is not refunded. Whether you delete it there or ask us by email, your data is deleted within 30 days, subject to the exceptions above. Billing records held by our payment processor are kept by it as required by law.
10. Your choices
- Disconnect a platform at any time in Settings > Connections. This deletes the access tokens we hold for it. To also remove PostHaste from the platform itself, use that platform's own settings (for example, Facebook "Business Integrations").
- Edit your information in your account settings.
- Email: transactional emails are needed to run your account. If we send marketing email, you can unsubscribe using the link in it.
- Text messages (when available): reply STOP to any text, or turn texts off in Settings (Section 13).
11. Deleting your data
You can ask us to delete your account and associated data at any time by:
- choosing Delete account in Settings > Account (available to an account Admin), or
- emailing privacy@posthaste.io from the email on your account with the subject "Delete my data."
Full steps, including for Facebook, Instagram, Threads, and Google Business Profile users, are on our Data Deletion Instructions page at posthaste.io/data-deletion.
Meta data deletion callback. If you remove PostHaste from your Facebook settings (this also covers an Instagram account connected through your Facebook Page) and ask for your data to be deleted, Meta notifies us through our data deletion callback. When we receive that request, we delete the data we received from Meta for that connection and give you a confirmation code and a status page where you can check progress. Threads works the same way: if you remove PostHaste from your Threads account and ask for your data to be deleted, Threads notifies us through its own callback, and we delete the data we received for your Threads profile and give you a confirmation code and status page. If you are not shown a confirmation code, email us as described on the Data Deletion Instructions page.
Deleting your PostHaste data does not delete posts you already published on a platform; those are controlled by you on that platform.
12. Your privacy rights (including California)
Depending on where you live, you may have the right to:
- know what personal information we collect, use, and disclose, and get a copy;
- correct inaccurate personal information;
- delete personal information;
- opt out of the sale or sharing of personal information (we do not sell or share it);
- limit the use of sensitive personal information (we do not use it for purposes that require this right); and
- not be discriminated against for exercising these rights.
California residents (CCPA/CPRA). In the past 12 months we have collected these categories: identifiers (email address, IP address, and account IDs); commercial information (plan and purchase history); internet activity (usage of the Service); geolocation at the city/state level (business location); professional information (business details); audio/visual information (images you upload); and inferences (your brand profile). We collect them from you, from platforms you connect, and automatically, for the purposes in Section 3, and disclose them to the service providers in Section 7 for business purposes. We do not sell or share personal information, and we have no actual knowledge of selling or sharing personal information of anyone under 16. We keep each category for the periods in Section 9.
How to make a request. Email privacy@posthaste.io. We will verify your identity by confirming control of the email address on the account, and respond within the time the law requires (45 days under California law). You may use an authorized agent, whom we will ask for proof of authorization.
13. Text messages (SMS)
If you opt in to text alerts (planned):
- We use your mobile number only to send the account alerts you asked for, such as posts awaiting approval and day-of publishing alerts.
- We do not sell, rent, or share your mobile number or SMS opt-in consent with third parties or affiliates for their marketing or promotional purposes. We share it only with the SMS provider that delivers our messages.
- Message frequency varies with your account activity. Message and data rates may apply.
- Reply STOP to opt out at any time. Reply HELP for help, or email support@posthaste.io.
Full SMS Terms are in Appendix A of our Terms of Service.
14. Children
The Service is for businesses and is not directed to children. We do not knowingly collect personal information from children under 13, or from anyone under 16, and accounts are limited to people 18 and older. If you believe a child has given us information, contact privacy@posthaste.io and we will delete it.
15. International transfers
PostHaste is based in the United States, and we store and process information in the United States. If you use the Service from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live.
16. Changes to this policy
We may update this Privacy Policy. If we make a material change, we will notify you by email or in the app before it takes effect, and update the effective date above. We will not use information in a materially different way than described at collection without your consent where the law requires it.
17. Contact us
PostHaste Technologies, Inc. 28390 South Larch Road Saint Maries, ID 83861 Privacy: privacy@posthaste.io Support: support@posthaste.io Legal: legal@posthaste.io