Privacy Policy

Last updated: July 27, 2026

1. Who we are

This Privacy Policy is issued by Postential, doing business as Postential ("Postential", "we", "us", "our"), located at Mississauga, Ontario, Canada. Contact us at privacy@postential.com.

2. Scope

This Policy applies to the Postential website, application, and services that link to it (together, the "Service"). It does not apply to third-party websites, apps, or services that we do not operate, including social media platforms you connect to Postential.

3. What is personal information

"Personal information" means information about an identifiable individual, or information that can reasonably be combined with other information to identify an individual, in the sense used by applicable privacy laws.

4. Information we collect

A. Account information

• Name and email address
• Password (stored as a salted hash by our authentication provider) and, where used, sign-in codes
• Business name, business type, and other profile information you provide
• Account preferences, including language and display currency
• Roles and workspace memberships within Postential

B. User-generated content

• Prompts you submit to AI features
• Captions, marketing copy, and content ideas you generate or edit
• Images, logos, videos, and other brand assets you upload or generate
• Scheduled posts, calendars, templates, tasks, and approvals you create
• Chat messages you send to the in-product AI assistant
• Auto-reply rules and other configurations

C. Social media connection information

When you connect a third-party social platform (for example, Meta/Instagram/Facebook or X), we may receive and store, depending on the permissions you grant:

• OAuth access and refresh tokens (encrypted at rest)
• Account or page identifiers and display names
• Scopes/permissions granted
• Metadata about connected pages, posts, or media required to provide the integration

D. Payment information

Payments are processed by our third-party payment provider. We do not receive or store full payment card numbers. We may receive limited billing-related information such as transaction IDs, subscription status, current plan and price, billing period, last four digits and brand of the payment method, and billing country, in order to operate subscriptions.

E. Device and usage information

• IP address and approximate location derived from it
• Browser type, device type, and operating system
• Log and diagnostic data, error reports, and performance data
• Pages viewed, features used, and referring URLs

F. Cookies and similar technologies

We use essential, authentication, and preference cookies and similar storage (such as localStorage) to operate the Service. We may also use limited analytics or product-analytics cookies where enabled. See our Cookie Policy for details. We do not currently use cookies for cross-site behavioral advertising.

5. How we collect information

• Directly from you when you create an account, use features, or contact us
• Automatically when you use the Service (for example, log data)
• From connected social media platforms, based on the permissions you grant
• From our payment processor when you subscribe
• From service providers acting on our behalf

6. Why we use your information

• Create, secure, and administer your account and workspace
• Provide the Service, including AI content generation, editing, scheduling, and analytics
• Process User Content and prompts through our AI providers to produce requested outputs
• Store your brand assets and generated media
• Publish or schedule content to social platforms you have connected
• Process payments, manage subscriptions, and handle billing
• Provide customer support and respond to your requests
• Send transactional communications (for example, sign-in codes, receipts, security notices)
• Send product updates and, where legally permitted, marketing communications
• Analyze usage to secure and improve the Service
• Detect, prevent, and investigate fraud, abuse, and security incidents
• Comply with legal obligations and enforce our Terms

7. AI processing

To generate AI outputs (text, images, or logos), we send your prompt and, where relevant, the User Content you have provided (such as an image you upload for editing or brand context you have saved) to one or more third-party AI providers acting as our processors. We only send information necessary to fulfill your request.

We do not sell your prompts or User Content, and we do not authorize our AI providers to use your prompts or User Content to train their foundation models except where their applicable terms or your configuration require it. Because AI providers operate their own systems, we cannot guarantee model behavior; we encourage you not to submit sensitive personal information as prompts.

8. AI-generated images and content

When you request an AI-generated image or logo, or ask the AI assistant to edit an uploaded image, your prompt and the uploaded media are processed by our AI providers as described above. Generated outputs are stored under your account for you to review, download, edit, or delete.

9. Legal bases and consent

Depending on your jurisdiction, we rely on one or more of the following:

• Performance of a contract with you (providing the Service you request)
• Your consent (for example, connecting a social account, or optional marketing communications)
• Our legitimate interests (for example, securing the Service and preventing fraud), balanced against your rights
• Compliance with legal obligations (for example, tax and accounting)

In Canada, we rely on express or implied consent as appropriate to the sensitivity of the information and the purpose, and on other permitted purposes recognized by applicable Canadian privacy law.

10. Sharing and disclosure

We share personal information only with the following categories of recipients, and only as needed:

• Cloud hosting and database providers
• AI/model providers that generate outputs you request
• Payment processors that handle subscriptions
• Email delivery providers used for transactional and product communications
• Analytics and product-analytics providers where enabled
• Social media platforms you connect, to publish or read what you have requested
• Customer support tooling
• Security, monitoring, and abuse-prevention providers
• Professional advisers (for example, legal or accounting)
• Authorities and other parties where required by law, to protect users, or to enforce our Terms

We do not sell your personal information.

11. Social media platforms

When you connect a social account, information is exchanged between Postential and that platform as needed to provide the integration you requested (for example, posting on your behalf). Those platforms have their own privacy policies, which govern how they handle your information.

12. Your responsibility for third-party personal information

If you upload content about your customers or other individuals — for example, client photos, before-and-after images, testimonials, reviews, or names — you are responsible for ensuring that you have the legal authority, consent, and permissions required to do so. You are the controller of that content, and we act as your processor for it.

13. Data retention

We retain personal information for as long as necessary to provide the Service, fulfill the purposes described in our Privacy Policy, comply with legal and accounting obligations, resolve disputes, enforce our agreements, and maintain security. When personal information is no longer required, we will delete, anonymize, or securely dispose of it in accordance with our data retention practices and applicable law.

• Account information: retained while your account is active and for as long as necessary afterward for legal, security, fraud-prevention, dispute-resolution, and other legitimate business purposes.
• User Content: retained while your account is active and for as long as necessary to provide the Service; deleted when you delete the content or your account, subject to legal, security, backup, and other legitimate retention requirements.
• Deleted account data: deleted or anonymized when no longer required for legal, security, fraud-prevention, dispute-resolution, or other legitimate purposes; backup copies may remain until they are overwritten or securely deleted according to the applicable backup cycle.
• Billing records: retained for as long as required by applicable tax, accounting, financial, and legal obligations.
• Security logs: retained for as long as reasonably necessary to maintain security, detect and investigate fraud or abuse, troubleshoot issues, and comply with legal obligations.

14. Data deletion

You can delete individual items (for example, scheduled posts, media, chat threads) from within the Service where the feature is available. You can request account deletion from your account settings or by contacting privacy@postential.com. After account deletion, we remove or anonymize your personal information, subject to the exceptions in Section 13. Deletion may take a reasonable period to complete across our systems and backups.

15. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete personal information
• Request deletion of your personal information
• Receive a copy of your personal information in a portable format
• Withdraw consent where processing is based on consent
• Object to, or restrict, certain processing
• Make a complaint to a privacy regulator

16. How to exercise your rights

Contact us at privacy@postential.com. To protect your data, we may need to verify your identity before responding. We will respond within the time required by applicable law.

17. Security

We use safeguards designed to protect personal information, including:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest for social media OAuth tokens
• Access controls and role-based access for staff
• Row-level security policies on our database
• Authentication, session management, and email-code verification
• Logging and monitoring of security-relevant events

No method of transmission or storage is 100% secure. Please use a strong, unique password and keep your credentials confidential.

18. Data breach and security incidents

We will assess and respond to security incidents affecting personal information and will notify you and the appropriate authorities where required by applicable law.

19. International data transfers

Your information may be processed in countries outside Canada, including in jurisdictions whose privacy laws differ from your own. Where required, we use appropriate contractual or legal safeguards for these transfers.

20. Service providers

Our third-party providers process personal information on our behalf and are contractually required to protect it and use it only for the purposes we specify.

21. Cookies

See our Cookie Policy for information about the cookies and similar technologies we use, and how to manage them. Disabling essential cookies may prevent parts of the Service from working.

22. Analytics

We use limited product analytics to understand how the Service is used and to improve it. We do not currently use analytics for cross-site behavioral advertising.

23. Marketing communications

We send transactional messages (for example, sign-in codes, receipts, security alerts) and product-update communications. Where required, we will obtain your consent before sending marketing messages, and you can unsubscribe from marketing at any time using the link in the message or by contacting us. You may still receive essential service communications.

24. Children

The Service is not directed to children under 18, and we do not knowingly collect personal information from them. If we learn that we have collected personal information from a child under 18, we will delete it.

25. Sale and targeted advertising

We do not sell personal information, and we do not use personal information for cross-context behavioral advertising, in the senses defined by applicable privacy laws.

26. Canadian privacy laws

For individuals in Canada, we handle personal information in accordance with applicable Canadian privacy laws, including federal legislation and applicable provincial legislation. This Policy is not a legal opinion or a certification of compliance.

27. Quebec residents

If you are a Quebec resident, additional transparency and privacy rights may apply to you. Contact privacy@postential.com for questions about our practices, or to exercise rights available under Quebec law.

28. U.S. privacy rights

Residents of certain U.S. states may have additional rights under state privacy laws (for example, in California, Colorado, Connecticut, Utah, and Virginia). Availability of these rights depends on your state of residence and whether applicable statutory thresholds apply to Postential. Contact us at privacy@postential.com to exercise any rights you may have.

29. Changes to this Privacy Policy

We may update this Policy from time to time. When we do, we will update the "Last updated" date above and communicate material changes by email or in-app notice.

30. Contact

Privacy Contact — Postential
Postential
Mississauga, Ontario, Canada
Email: privacy@postential.com