PostBandit Privacy Policy

1. Information We Collect

Account Information: When you create an account: name, email address, and password (hashed — we never store plaintext passwords).

Payment Information: We use Stripe to process payments. We do not store your card number, CVC, or full payment details. Stripe stores this information under their own privacy policy (stripe.com/privacy). We store your Stripe customer ID and subscription status to manage your account.

Connected Social Accounts: When you connect a social media account, we receive and store OAuth access tokens that allow us to publish content on your behalf. These tokens are encrypted at rest. We access only the permissions required to publish content — we do not read your followers, messages, or private data.

Content You Upload: Videos you upload or import, transcripts generated from those videos, clips you create, captions, and social media copy. Source video files are deleted after processing. Transcripts and clip data are retained while your account is active.

Usage Data: Log data including pages visited, features used, API calls made, error events, and timestamps.

Device and Browser Information: IP address, browser type, operating system, and referral URL.

2. How We Use Your Information

We use your information to provide, operate, and maintain the Service; process your subscription and manage billing; publish content to your connected social accounts; generate AI-powered clip suggestions, captions, and social copy; send transactional emails; monitor and improve Service performance; detect and prevent fraud and security incidents; respond to support requests; and comply with legal obligations.

We do not sell your personal information. We do not use your content to train AI models.

3. Third-Party Services

We share data with the following third parties only as necessary to operate the Service:

• Stripe — Payment processing (stripe.com/privacy)
• YouTube / Google — Publishing to YouTube (policies.google.com/privacy)
• TikTok — Publishing to TikTok (tiktok.com/legal/privacy-policy)
• Meta (Instagram, Facebook, Threads) — Publishing to Meta platforms (facebook.com/privacy/policy)
• X Corp — Publishing to X (twitter.com/privacy)
• DeepSeek — AI copy generation (deepseek.com)
• Sentry — Error monitoring (sentry.io/privacy)
• Backblaze / Cloudflare — Cloud storage (backblaze.com/company/privacy)

We do not share your data with advertising networks or data brokers.

4. Data Retention

Source video files are deleted after processing and export. Transcripts and clip data are retained while your account is active. Publish history is retained while your account is active. OAuth tokens are deleted when you disconnect the platform or delete your account. Account data after cancellation is retained for 90 days, then permanently deleted. Payment records are retained for 7 years (legal/tax requirement). Usage logs are retained for 12 months.

5. Security

OAuth tokens are encrypted at rest. All data is transmitted over HTTPS. Payment processing is handled by Stripe (PCI-DSS compliant). API keys are stored as SHA-256 hashes — plaintext keys are shown only once and never stored. Access to production systems is restricted and monitored.

6. Your Rights

You may request to access, correct, delete, or export your personal data by emailing postbanditsupport@gmail.com. We will respond within 30 days.

California Residents (CCPA): You have the right to know what personal information we collect, to delete it, and to opt out of its sale (we do not sell personal information).

EU/UK Residents (GDPR): Our legal basis for processing your data is performance of a contract, legitimate interest, and your consent where applicable. You have the right to lodge a complaint with your local data protection authority.

7. Cookies

We use essential cookies required for authentication and session management. We do not use advertising cookies or third-party tracking cookies.

8. Children's Privacy

PostBandit is not directed to children under 18. We do not knowingly collect personal information from anyone under 18.

9. Changes to This Policy

We will notify you of material changes by email or dashboard notice at least 14 days before they take effect.

10. Contact

Privacy questions or requests: postbanditsupport@gmail.com

BANDAMONT LLC | postbandit.com