Privacy Policy

This Privacy Policy explains what information PostNow Labs, Inc. ("PostNow," "we," "us") collects, how we use it, how we share it, and the choices you have. It applies to the PostNow website, application, and services (the "Service").

By using the Service, you agree to the practices described in this policy. Capitalized terms used but not defined here have the meanings given in our Terms of Service.

We collect information you provide directly, information we receive from LinkedIn through our official OAuth integration, and information about how you use the Service.

• Account information: your name, email address, and LinkedIn profile data (such as your name, headline, photo, and profile URL) obtained via LinkedIn OAuth when you connect your LinkedIn Account.
• Content & AI inputs: drafts, published posts, scheduling preferences, workspace data, knowledge base materials (links, PDFs, video transcripts, voice notes), and the voice profile ("Content DNA") we build from your content.
• Usage information: pages visited, features used, publishing activity, and other interactions with the Service, including diagnostics such as error logs.
• Payment information: billing details such as your name, email, and billing address, processed by our payment provider (Stripe). We never store full credit card numbers on our servers.
• Communications: emails you send us, support requests, and responses to surveys or feedback forms.
• Cookies: information collected through cookies and similar technologies, as described in our Cookie Policy.

We use the information we collect to:

• Provide and maintain the Service, including scheduling and publishing your content via LinkedIn's official APIs.
• Operate AI features — training and tuning Content DNA on your own content so drafts match your voice, grounding drafts in your knowledge base, and generating suggestions.
• Personalize your experience, including best-time recommendations and analytics.
• Communicate with you about the Service, including service announcements, security notices, billing, and (with your consent) marketing communications.
• Detect, prevent, and address technical issues, abuse, and security incidents.
• Comply with legal obligations and enforce our Terms of Service and Acceptable Use Policy.

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we rely on the following legal bases under the General Data Protection Regulation (GDPR) for processing your personal information:

• Contract performance: processing necessary to provide the Service you've contracted for, including publishing and scheduling.
• Legitimate interests: operating and improving the Service, ensuring security, and preventing abuse.
• Consent: where you have given us consent, such as for marketing communications or optional data collection. You may withdraw consent at any time.
• Legal obligation: where processing is required to comply with applicable law.

We authenticate accounts through LinkedIn's official OAuth 2.0 flow. We never receive or store your LinkedIn password.

We request only the scopes necessary to provide the Service: reading basic profile information and publishing content on your behalf. The scopes we request are disclosed during the OAuth authorization screen.

Your LinkedIn access and refresh tokens are encrypted at rest and used solely to provide the Service. You can revoke PostNow's access at any time through your LinkedIn account settings — published posts remain on LinkedIn and are subject to LinkedIn's policies.

We do not scrape or collect LinkedIn data beyond what the official APIs authorize.

PostNow's AI features are built around your Content DNA — a voice profile derived from content you provide and approve. AI output is generated from your inputs and knowledge base, and we use your content solely to serve you.

We do not train our models on your content for other users. Your content, drafts, and voice profile are never used to generate content for any other account or shared with third-party AI providers for training purposes.

Your Content DNA profile is available to you to review and edit. You can rebuild it, remove topics, or delete it along with your account.

We do not sell your personal information. We share data only in limited circumstances:

• With LinkedIn, when you authorize us through OAuth to read and publish content on your behalf.
• With service providers who help us operate the Service — hosting (cloud infrastructure), authentication (Supabase), error monitoring (Sentry), payments (Stripe), and AI inference. These providers process data only on our documented instructions.
• When required by law, regulation, legal process, or governmental request.
• To protect our rights, property, or safety, or the rights, property, or safety of others.
• In connection with a merger, acquisition, or sale of assets, with appropriate confidentiality protections.

We engage a small, defined set of sub-processors to provide the Service, categorized as: managed cloud infrastructure, authentication, error monitoring, payment processing, and AI inference.

A current, authoritative list is maintained and updated at least 30 days before any change. Enterprise customers can request the full sub-processor list with our Data Processing Agreement.

Review our DPA at /dpa for sub-processor categories and the current authoritative list.

Where personal information is transferred outside the EEA, the United Kingdom, or Switzerland, we rely on Standard Contractual Clauses (EU 2021/914) or the UK International Data Transfer Addendum (IDTA), as applicable, together with supplementary measures where needed.

Enterprise customers can opt into EU data residency with isolated infrastructure to satisfy GDPR residency requirements.

We retain your data for as long as your account is active or as needed to provide the Service and comply with legal obligations.

When you request deletion or close your account, we delete or anonymize your personal data within 30 days, except where we are required to keep it longer by law (for example, billing records, security logs, and legal holds).

Audit and security logs are retained for 12 months minimum, consistent with our Security page.

We take reasonable technical and organizational measures to protect your information, including encryption in transit (TLS 1.2+) and at rest (AES-256), least-privilege access controls, row-level security on data storage, and regular security reviews.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a data breach, we will notify affected users and relevant authorities as required by law.

See our Security page at /security for details on encryption, access controls, audit logging, and our compliance roadmap.

Depending on your location, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing.

• Access and portability: request a copy of your data in a machine-readable format.
• Correction: update your profile and account information at any time from account settings.
• Deletion: request deletion of your account and personal data — send requests to privacy@postnow.io.
• Restriction or objection: object to processing based on legitimate interests or restrict certain processing.
• Withdraw consent: revoke the LinkedIn connection or marketing consent at any time.
• No sale: we do not sell your personal information, and we honor Do Not Track signals.

The Service is not directed to individuals under the age of 16, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us at privacy@postnow.io and we will delete it promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through an in-product notice before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

If we make a material change that reduces your privacy rights, we will provide at least 30 days' notice before the change takes effect.

If you have questions about this Privacy Policy or how we handle your data, contact our Data Protection contact at privacy@postnow.io or write to PostNow Labs, Inc., Data Protection, 100 Market Street, Suite 500, Wilmington, DE 19801, USA.