Privacy Policy
Nasida Apps LLC, a limited liability company organized in Wyoming, USA ("we", "us"), operates PostDelegate. This policy explains what personal data the service handles, why, and the choices you have. For customers' end users and audiences whose messages or comments reach us through connected platforms, we act as a processor on the customer's instructions; for account, billing and security data we act as controller.
1. Data we collect
| Category | What it includes | Source |
|---|---|---|
| Account data | Email address, name, profile photo, password hash, two-factor settings, terms acceptance, workspace membership and role, last workspace used. | You, or Google if you sign in with Google |
| Connected social accounts | Account name, handle, platform ID, avatar, follower count, connection status, and OAuth access and refresh tokens, which are stored encrypted. | The platform, with your authorization |
| Content | Posts, drafts, versions, media files and thumbnails, comments from teammates and clients, approval history, calendar and queue settings. | You and your team |
| Inbox data | Comments, mentions and direct messages received on your connected accounts, with sender names and platform IDs, plus replies you send. | The connected platforms |
| Analytics | Post and account performance metrics returned by the platforms. | The connected platforms |
| Billing | Plan, subscription status, billing contact email, and Stripe customer and subscription identifiers. Card details are handled by Stripe and are not stored by us. | You and Stripe |
| AI requests | Text you submit to the AI tools (captions, drafts, messages you are replying to, brand voice settings) and a usage log of requests. | You |
| Technical data | IP address, browser and device information, request logs, and security events such as sign-in attempts. | Your browser |
| Communications | Support messages, and transactional emails and in-app notifications we send you. | You and us |
We do not sell personal data and do not use it for advertising.
2. How we use data and our legal bases
If the GDPR or UK GDPR applies, we rely on:
- Contract: to provide the service, publish your posts, show your inbox and analytics, process payments and support you.
- Legitimate interests: to secure and debug the service, prevent abuse, and improve reliability, balanced against your rights.
- Legal obligation: tax, accounting and responding to lawful requests.
- Consent: where requested, for example when you connect a platform account and approve its permissions; you can withdraw it by disconnecting.
3. AI processing
When you use the AI writer or AI reply drafts, the content you submit, and related context such as the message being answered or your workspace's brand voice, is sent to our AI model provider, Anthropic, to generate a response. According to the provider's commercial terms, content submitted through its API is not used to train its models; we do not control the provider's terms, so please review them. If your organization saves its own AI key, requests are made under your own agreement with the provider. AI features are optional and off unless used.
4. Information from connected platforms
We use data from a platform only to provide the features you ask for, and we follow each platform's developer policies. We do not use it to train generalized AI models, to advertise, or sell it to data brokers.
Google and YouTube
PostDelegate's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This covers data from YouTube and Google Business Profile. We use it only to provide and improve the user-facing features you request, do not transfer it except as needed to provide those features, to comply with law or as part of a merger, do not use it for advertising, and do not allow humans to read it except with your consent, for security, or to comply with law.
The service uses YouTube API Services. By using these features you agree to be bound by the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. You can revoke our access to your Google data at any time through the Google security settings page. Disconnecting a YouTube channel in PostDelegate deletes the data we hold from it and revokes the grant.
Meta (Facebook, Instagram, Threads)
We receive Page, profile, media, comment, message and insight data you authorize and handle it in line with the Meta Platform Terms and Developer Policies. You can remove our access in your Facebook or Instagram settings under Business Integrations, or by disconnecting the account here. If you remove the app, Meta may notify us and we delete the associated data; see Data deletion.
Other platforms
TikTok, LinkedIn, Pinterest, X, Reddit, Discord, Slack, Telegram, Tumblr, Twitch, Kick, Dribbble, Lemmy, Nostr, Farcaster, Bluesky, Mastodon, DEV.to, Medium, WordPress, Hashnode and Listmonk are handled the same way: we request only the permissions needed for the features you use, store the tokens encrypted, and revoke or delete them when you disconnect, where the platform offers a way to do so. Your use of those platforms is governed by their own terms and privacy policies.
5. Who receives data
We share data only with the service providers needed to run PostDelegate, listed on the Subprocessors page: hosting, CDN and storage, payments, AI processing and email delivery. We also disclose data to the platforms you publish to, to your teammates according to their roles, and where required by law or to protect rights and safety. If we are involved in a merger or sale, data may transfer subject to this policy.
6. Cookies and similar technologies
We use only what is needed to run the service: a session cookie that keeps you signed in, a CSRF cookie that protects forms, a short-lived timezone cookie set on the sign-up page, and a local browser setting remembering whether the sidebar is collapsed. We do not use advertising or analytics cookies, and the app's scripts, styles and fonts are served from our own servers. The only exception is the interactive API reference, which loads Swagger UI from the jsDelivr CDN, so that CDN receives your IP address when you open it (see Licenses).
7. Retention
- Account and workspace content is kept while your account is active.
- When you delete your account, your personal data is deleted immediately, and organizations you alone belong to are deleted with their content and uploaded files after their subscription is cancelled. Content you created in organizations that have other members stays with that organization, without your name.
- If an organization deletion is scheduled, it runs after a 14 day grace period.
- Billing records are kept as long as tax and accounting law requires.
- Server logs are kept for a limited period for security and debugging.
8. Deleting your data
You can delete your account in Settings, or ask us by email. Full details, including Meta's deletion callback, are on the Data deletion page.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your data, to object to or restrict processing, to withdraw consent, and to complain to your data protection authority. Email [email protected] and we will respond within the period the law requires. If you are an end user whose data reached us through a customer's connected account, please contact that customer first.
California (CCPA/CPRA)
California residents may request to know, access, correct and delete personal information and to opt out of its sale or sharing. We do not sell or share personal information for cross-context behavioral advertising, and we do not discriminate against you for exercising these rights. In the past 12 months we have collected the categories listed above (identifiers, commercial information, internet activity, and user-submitted content) for the business purposes described in section 2.
10. International transfers
We and our providers may process data in the United States and other countries, which may have different data protection laws from yours. Where required, we rely on safeguards such as the European Commission's Standard Contractual Clauses or the provider's certification under an approved framework.
11. Security
We protect data with encryption in transit, encryption of platform tokens and API credentials at rest, role-based access control, optional two-factor authentication, rate limiting and access logging. No system is perfectly secure; tell us at [email protected] if you find a vulnerability, and we will notify affected users of breaches as the law requires.
12. Children
PostDelegate is not intended for anyone under 16, and we do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
13. Changes
We may update this policy and will post the new version here with a new effective date, and notify you of material changes by email or in the app.
14. Contact
Nasida Apps LLC
[Registered business address to be completed]
[email protected]