Privacy Policy

We collect information you provide directly, information collected automatically, and information from third parties.

Name, email, password hash, phone number, locale, and authentication preferences you provide during registration and profile updates.

Agency and brand membership, roles, invitations, and workspace settings.

Briefs, comments, approvals, revisions, deliverables, and other content you create within the platform.

Files you upload (images, documents, assets) and their metadata. Files are stored on our infrastructure or configured storage providers.

IP address, browser type, device information, access times, pages viewed, and interaction data collected via server logs and analytics.

We use essential cookies for authentication, session management, and security. We do not use third-party advertising cookies.

Login timestamps, refresh tokens (hashed), MFA secrets (encrypted), and device trust records for security purposes.

Subscription plan, billing period, and invoice history. Payment card details are processed by Paddle and not stored by PostPiloter.

As Merchant of Record, Paddle processes payments and collects necessary billing data per their privacy policy. PostPiloter receives only transaction status and subscription updates.

We send transactional emails (verification, password reset, notifications) via Resend. You can manage notification preferences in settings.

We implement appropriate technical and organizational measures including encryption, access controls, and regular security reviews.

We retain personal data while your account is active and as needed to provide services, comply with legal obligations, and resolve disputes.

You may request account deletion from settings. Deletion removes personal data within 30 days, except where retention is legally required.

We use subprocessors for hosting (Hetzner), email (Resend), payments (Paddle), and WhatsApp (Twilio). Each has a data processing agreement.

Data may be processed in the EU, US, and other jurisdictions. We rely on standard contractual clauses and adequacy decisions where applicable.

You have rights to access, rectify, erase, restrict, and port your data. Contact us at privacy@postpiloter.com to exercise these rights.

For users in Turkey, we comply with the Law on Protection of Personal Data (KVKK). You have rights under Article 11 of KVKK.

For users in the EEA, we comply with GDPR. Legal bases include contract performance, legitimate interest, and consent where required.

PostPiloter is not directed to children under 16. We do not knowingly collect personal data from children.

We may update this policy. Material changes will be communicated via email or in-app notice with a revised effective date.