Privacy policy
Last updated
This policy explains what personal data Postmosis collects, why we collect it, who we share it with and what you can do about it. It covers the Postmosis app at app.postmosis.com and this website, postmosis.com.
Postmosis is run by D'Marketing Agency Pte. Ltd. (UEN 202024837C) ("we", "us"), 1 Tampines North Drive 1, #08-37 T-Space, Singapore 528559, and we handle personal data under Singapore's Personal Data Protection Act 2012 (PDPA). If you have a question about anything in this policy, write to our Data Protection Officer at hello@postmosis.com.
The short version
- We collect what you give us when you use Postmosis: your sign-in email, your brands, the posts, slides, videos and plans you make, and the social accounts you connect.
- We use it to run the features you use. Some features send your content to AI providers to write, check or make things for you.
- We don't sell your personal data, and we don't use it for advertising.
- You can ask to see, correct or delete your data at any time. Our data deletion page explains how.
What we collect and why
Your account
- Your email address, and a password if you set one. Sign-in is handled by Supabase, our database provider. You can sign in with your password or with a link or code we email you.
- Your name, if your account has one.
- Your sign-in session, kept in your browser so you stay signed in.
Your account is made when you pay or start a trial on our pricing page. Stripe, our payment provider, takes your card details on its own page, and we never see your full card number. If you ask to see Postmosis on a call first, the booking page collects the details you enter so we can hold the time.
Why: to set up your account, sign you in and keep you signed in.
What you make in Postmosis
- Your brands and brand kits: names, colours, headshots, sign-offs and what you do.
- Posts and drafts with their captions, carousels and video scripts, and the plans and calendar slots they sit in.
- Sample posts you paste for your voice, and the voice summary made from them.
- Post numbers you type in, such as views, likes, comments and shares.
- Pictures, videos and sound you add, when a feature needs to send them to our servers or a provider. For example, when you ask for captions, the sound from your video is sent to make a transcript.
Your work is saved in your browser first and copied to our database, so it follows you between devices.
Why: to run the features and keep your work in sync.
Connected social accounts
When posting is on for your account, you can connect Instagram, Facebook, TikTok, LinkedIn, YouTube and Threads accounts through Zernio, the posting service we use. You sign in to each network on its own page; Zernio holds the connection, and we keep which accounts you connected and whether each one still works. When you schedule a post or send it now, we send its text, pictures or video, the time and your settings for each network to Zernio, which posts it to that network.
Why: to post for you, to the accounts you chose.
Account audits and tracked accounts
When you run an audit on an Instagram or TikTok account, or track a public account, we use Apify to read that account's public profile and its recent public posts with their public numbers (for an audit, up to 30 posts). We don't log in to the account and can't see anything that isn't public. We keep the profile details, the posts and their numbers, our analysis and a history of summary numbers for each refresh.
Tracked accounts usually belong to other people. Only track accounts whose public posts you have a fair reason to study.
Why: to show what works on your account and on accounts you follow, and to suggest what to post next.
Review links and teams
- Review links: Anyone who has a review link can read the post it shows and leave a comment without an account. We keep the name they type and their comment. Comments are deleted with the link.
- Teams: If you add people to review your posts, we keep their email and role, and the record of who approved what and when.
Link in bio and tracked links
- Link in bio: Your page shows the name, line, photo and links you choose. We count clicks on each link per day. We don't record who clicked.
- Tracked links: When someone taps a tracked link, we count the tap. To count unique people, we store a one-way hash of their IP address and browser details, mixed with a secret value. We never store the IP address itself. Each hash is deleted 90 days after that person's first tap.
Claude
If you make a connection link on the Connect Claude page and add it to Claude, Claude can read your posts, plan and brand kit and add drafts through that link. What Claude does with what it reads is covered by your own agreement with Anthropic, which makes Claude. You can turn the link off at any time on the same page.
Alerts and emails
- Phone and browser alerts: When you turn alerts on, your browser gives us an address at its push service (run by Google, Apple, Mozilla or Microsoft), and we send alerts through it.
- Emails: The Monday email and other account emails go to your sign-in email through Resend, an email delivery service.
The assistant and feedback
The in-app assistant and the feedback board run on a separate service we operate. When you use them we receive your messages, the page you were on and your name; feedback posts and support messages also carry your email. Votes on the board use your account ID.
Crash reports and usage counts
- Crash reports: If the app hits an error while you're signed in, it sends us the error, its technical trace, the page, the app version, your browser type and your account ID, at most 5 reports per page load.
- Usage counts: We count how often you use each AI feature every day, to apply the daily limits shown in the app.
Hosting, analytics and fonts
- Vercel hosts the app and this website. Vercel and Supabase receive your IP address and standard request details when you use them, and keep them in server logs.
- The app uses Vercel Web Analytics to count page views. Vercel says it uses no third-party cookies and doesn't identify individual visitors. This website has no analytics.
- The app loads its fonts from Google Fonts, so Google receives your IP address when a page loads.
Your browser
The app keeps your sign-in session, your work and a list of changes waiting to sync in your browser's local storage, not in advertising cookies. Signing out leaves your saved work on that device; clear this site's data in your browser to remove it.
How we use AI
Some features send your content to an AI provider to do their job.
| Feature | What is sent | Provider |
|---|---|---|
| Writing: hooks, posts, voice summary, carousel text, scripts, plans, audit advice and post ideas | What you type and choose, what you do, your sample posts, and for audits the public account data | OpenAI |
| Captions for your videos | The sound from your video | OpenAI |
| Checks and picks, such as whether a post sounds human and its predicted engagement score | The text of the post | TypeSafe |
| Videos made without filming, and AI pictures | Your photo, your script and the voice for it, or a description of the picture | Higgsfield |
| Voiceover from text | Your script | ElevenLabs |
| Watching your edited video like a viewer would | The exported video | Google (Gemini) |
| Free stock photos and videos | The words you search for | Pexels |
OpenAI says data sent to its API isn't used to train its models unless the customer opts in, and is kept for up to 30 days to monitor abuse. AI output can be wrong, so read every draft before you post it.
Who we share data with
We share personal data only with the service providers that help us run Postmosis, when the law requires it, or when you ask us to.
| Provider | What they do for us |
|---|---|
| Supabase | Sign-in, database and server functions |
| Vercel | Hosting the app and this website, and app analytics |
| Zernio | Connecting your social accounts and posting to them |
| OpenAI | Writing, transcripts and audit advice |
| TypeSafe | Checks and picks on post text |
| Higgsfield | Videos without filming and AI pictures |
| ElevenLabs | Voiceover from text |
| Video review (Gemini) and web fonts | |
| Pexels | Stock photo and video search |
| Apify | Reading public Instagram and TikTok data |
| Resend | Sending emails |
| Stripe | Payments, if you pay inside the app. Card details are entered on Stripe's page and we never see your full card number |
When you post, the network you post to (for example Instagram or LinkedIn) receives the post and handles it under its own terms and privacy policy.
Transfers outside Singapore
Some of these providers store or process data outside Singapore, for example in the United States. When personal data leaves Singapore, we rely on the providers' data processing terms so that it is protected to a standard comparable to the PDPA.
How long we keep data
| Data | How long |
|---|---|
| Your account and your work | Until you delete it or ask us to delete your account |
| Audits, their history and post ideas | Until you stop auditing the account, or your account is deleted |
| Review link comments | Until the link is deleted |
| Tracked link hashes | 90 days after a person's first tap |
| Crash reports and usage counts | Until your account is deleted |
| Data sent to OpenAI | Up to 30 days, per OpenAI |
| Server logs and backups | Until they expire on our providers' schedules |
| Payment records | As long as the law requires |
How we protect data
- Our database only lets a signed-in person read their own rows.
- The keys for our AI, posting and payment providers stay on our servers, never in the app you load.
- Review links and Claude connection links are stored as one-way hashes.
- The app, this website and our providers use encrypted HTTPS connections.
No system is perfectly secure. If you think someone has got into your account, tell us straight away.
Your rights
Under the PDPA you can:
- Access your personal data, and ask how it has been used or disclosed in the past year.
- Correct mistakes in it.
- Withdraw consent for us to collect, use or disclose it. We'll explain what that means for your account, since some features can't work without the data they need.
- Ask us to delete it. See the data deletion page.
To make a request, email hello@postmosis.com from the email you sign in with. We may need to confirm it's you first. We aim to reply within 30 days.
Children
Postmosis is for working professionals and isn't meant for anyone under 18.
Data breaches
If a data breach is likely to cause significant harm, or affects 500 or more people, we will notify the Personal Data Protection Commission within 3 calendar days of confirming that. Where required, we will also tell the people affected as soon as we practicably can.
Changes to this policy
When we change this policy we update the date at the top. Before a change that affects how your data is used, we'll tell you in the app or by email.
Contact
D'Marketing Agency Pte. Ltd. (UEN 202024837C), 1 Tampines North Drive 1, #08-37 T-Space, Singapore 528559. Email hello@postmosis.com.
You can also contact the Personal Data Protection Commission at www.pdpc.gov.sg. Our terms of service cover how you may use Postmosis.