Privacy Policy

POST SMARTR LLC, a New Jersey limited liability company, operates the website at postsmartr.com and provides the PostSmartr service. In this policy, “we,” “us,” and “our” mean POST SMARTR LLC. Our business mailing address is 971 US HWY 202 N STE A, BRANCHBURG NJ 08876, United States. Contact us at Support@postsmartr.com for support or privacy requests; use “Privacy request” in the subject for privacy matters.

This policy explains our handling of personal information about website visitors, customers, authorized users, and people whose information is processed through connected social accounts. It covers our website, dashboard, publishing and analytics tools, content preparation features, and supported comment and messaging automations. It does not replace the separate privacy policies of social platforms or payment providers.

We decide how to use customer registration, billing, security, and website information and generally act as its controller. When we handle an audience member’s comments, messages, or other information solely to carry out a customer’s instructions, we act as that customer’s processor or service provider. Our applicable Data Processing Addendum governs that processing; contact Support@postsmartr.com for a copy. If your request concerns a business that uses PostSmartr, contact that business; we will assist it with requests as required.

Account information. When you sign up, you give us your first and last name, email address and a password. We store a one-way password hash rather than a readable copy of your password. Adding a phone number is optional. If you sign up or log in with Google, Google shares your name, email address and profile picture with us. In Settings you can also add a profile photo, your country (used for taxes and invoices), and, if you choose, your date of birth and gender. When you set up auto-posting, we save the content categories you pick, your time zone and your posting schedule. If you contact support, we keep those messages. Your assigned account manager can see the account details needed to help you. Your optional phone number is used for account security and support and may also be included with registration information in the measurement events described in Section 6. We do not send marketing text messages. Optional date of birth and gender complete your profile; Section 6 explains how registration and returned account-profile information is processed through our tag-management system.

Content and instructions. We process uploaded media, captions, hashtags, logos, product links, content-generation inputs, schedules, automation settings, approvals, and publishing results. Content may contain personal information about other people. Do not submit information you are not entitled to use.

Connected-account information. With your authorization, platforms provide account and page identifiers, profile details, access and refresh tokens, authorized media and metadata, posting status, permitted analytics, and comments or messages needed for enabled features. Permissions and available data differ by platform and account type. We do not request or store your social-platform passwords. Tokens allow authorized actions to continue while you are offline until access expires or is revoked.

Payment information. Stripe processes card payments. We receive transaction identifiers, payment status, selected plan, purchase amount, billing contact details, and limited payment-method information. Full card numbers and security codes are collected by Stripe rather than stored in our application. Stripe’s Privacy Policy explains how Stripe handles your information.” Keep the existing link on “Stripe’s Privacy Policy.” The Google and NOWPayments references would benefit from the same simplification. If cryptocurrency checkout is available, NOWPayments processes the payment. We exchange order references, asset/network and amount information, wallet or transaction identifiers, and payment status needed to complete and reconcile it. NOWPayments may separately collect device and identity-verification information as described in its Privacy Policy at NOWPayments Privacy Policy and under its own legal obligations. Public blockchain records cannot be erased by PostSmartr.

Device, usage and attribution information. We collect IP addresses, browser and device details, approximate location derived from IP, time stamps, referring pages, feature activity, authentication events, error reports and security logs. Advertising attribution also includes complete arrival-page addresses and query parameters, campaign and click identifiers, browser-cookie identifiers and browser or ad-blocking information, as described in Section 6. We obtain information directly from you, your authorized users, your connected platforms, our payment providers and use of the service.

Required and optional information. Your name, email address and a password (or Google sign-in) are required to create an account. Your phone number, profile photo, date of birth and gender are optional. Your country is used for taxes and invoices. Connecting a social account and choosing content categories are optional, but auto-posting needs them. Opting out of marketing emails does not affect buying or using PostSmartr.

Instagram and Facebook. Depending on permissions, we process professional-account and Page identifiers, media, captions, comments, account insights, and relevant message information. This supports publishing, reporting, and authorized engagement features. Instagram keyword automations process the triggering comment, commenter identifier, reply text, requested message, and delivery status. A public comment does not authorize unrelated marketing or unrestricted access to a person’s inbox.

TikTok. We process authorized creator information, publishing permissions, selected media and metadata, privacy and interaction choices, upload status, and any reporting information provided under approved permissions. We use this information for the features you select.

YouTube and Google. PostSmartr uses YouTube API Services. Authorized information may include channel identifiers, video metadata, upload instructions, publishing status, and channel or video statistics required for publishing and reporting. Google’s Privacy Policy is available at Google Privacy Policy and you may revoke access at Google account permissions or request deletion using Section 8.

X. We process authorized account identifiers, posts and media, publishing status, and available engagement information for the publishing and reporting features you enable. We do not access private messages merely because an X account is connected.

LinkedIn. We process authorized account identifiers, selected content, publishing results, and performance information available to the specific member-profile or Company Page features you enable. We do not obtain access to private messages or connections merely because an account is connected.

Pinterest. We process authorized account information, boards, Pins, media, destination links, publishing results, and permitted reporting data to manage the boards and content you select.

We use information to establish and secure accounts; provide content preparation, scheduling, publishing, analytics, and requested messaging; apply plan limits; collect payments; provide support and account management; diagnose failures; prevent fraud and abuse; comply with legal obligations; and maintain evidence of consent and transactions. We use service activity to improve reliability and usability subject to platform restrictions.

We send operational messages about your account, purchases, security, and service changes. We send marketing messages only where permitted and provide an unsubscribe method. Opting out of marketing does not stop necessary service messages.

AI-assisted features use OpenAI GPT, Anthropic Claude, and Google Gemini through paid commercial APIs to produce requested captions, hashtags, or other content. A request sends the selected provider the relevant prompt, instructions, and any text or media you submit for that feature. We limit inputs to what is needed and do not send social-platform passwords, access tokens, payment credentials, or private audience messages to these AI services. Connected-platform API data is excluded from AI inputs unless that specific use, onward disclosure, and retention have been verified as permitted by the platform and applicable law and disclosed to you before use.

We do not use private customer content or connected-platform data to train general-purpose AI models, and do not opt customer inputs or outputs into provider training or voluntary data-sharing programs. Paid API providers may retain inputs and outputs and permit limited authorized human review for safety, abuse prevention, legal compliance, or support under their applicable terms. Disabling optional storage does not eliminate all provider retention. Provider-specific information appears at OpenAI API data controls for OpenAI, Anthropic API data retention information for Anthropic, and Gemini API Terms for Google. Contact Support@postsmartr.com for additional information about our service providers. Do not include sensitive personal information in content-generation inputs.

PostSmartr’s use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy at Google API Services User Data Policy and its applicable Limited Use requirements. Google user data covered by those requirements is not used for advertising or unrelated model training. Access by staff and transfers to providers are limited to purposes and exceptions permitted by that policy; a general account-management relationship does not authorize unrestricted human access.

Service providers and partners. We use Amazon Web Services for hosting and infrastructure, Stripe for card payments, the AI providers identified in Section 4 for requested generation, and Meta and TikTok advertising tools as described in Section 6. NOWPayments processes cryptocurrency payments where offered. Providers receive information necessary for their work under appropriate contractual restrictions. Some, including Stripe for certain activities, also act as independent controllers. AWS hosting does not mean all processing occurs only at AWS. Contact Support@postsmartr.com for information about our providers and the applicable Data Processing Addendum.

Connected platforms and intended recipients. We transmit the media, text, instructions, and account information necessary for authorized actions. Public posts may become available to anyone. Private replies go to the selected recipient. A platform’s retention and use of information are governed by its own terms and privacy policy.

Authorized personnel. Our staff, contractors, and your authorized collaborators may access information needed to provide support and deliver requested services, subject to role restrictions, confidentiality, and applicable platform limitations.

Legal and business events. We may disclose information when legally required, to address fraud or security threats, or to establish or defend legal claims. In a proposed merger, acquisition, or asset transfer, disclosures remain subject to appropriate protections and any additional platform-specific consent requirements. We do not treat a business transfer as an exception to Google’s restrictions.

Essential cookies and similar technologies keep you signed in, protect the site, run checkout and remember your preferences.

Advertising and measurement. We use Meta (Facebook and Instagram) and TikTok advertising tools to measure and improve our ads, including Meta Conversions API and TikTok Events API. Our website loads a tag manager from load.server.postsmartr.com and processes attribution information through browser and server-side systems. This information includes IP addresses; browser, device, operating-system, user-agent and ad-blocking details; referring and visited pages; the complete initial page address, including query parameters and any fragment; advertising-click, referral and browser identifiers such as fbclid, _fbc, _fbp, ttclid and _ttp, and other attribution parameters such as togid and passive; and all query parameters in an arrival link, including campaign tags and other attribution parameters. The allUrlParams first-party cookie expires after up to one hour. Separate copies of the initial page address and _fbc identifier are stored in browser local storage without an automatic expiry in the current configuration; those copies remain until the relevant storage is cleared. Registration measurement events also make information available to our browser tag-management event layer, including your name, email address, optional phone number, account identifier, information included in the account record returned by our service, and associated attribution and browser details. Events may describe viewing plans, signing up, starting checkout and purchasing, including plan, value and currency. Information shared with Meta and TikTok varies by event and integration and is used for event matching, advertising measurement, optimization and relevant advertising. The presence of information in our browser event layer does not mean every field is sent to each platform. Contact information and other matching identifiers must be normalized and hashed where the receiving platform requires it before transmission; technical information such as IP addresses, user agents and click identifiers is handled in the format required by that integration and is not all hashed. Hashing does not make information anonymous: hashed identifiers remain personal information and may be matched to platform accounts. Meta and TikTok may combine information they receive with information they already hold and use it for advertising and measurement under their own privacy policies at Meta Privacy Policy and TikTok US Privacy Policy. Advertising integrations remain subject to restrictions on sensitive information and prohibited data. Social-platform credentials, private messages, content supplied for publishing and payment-card details are not advertising-matching fields and must not be included in advertising events. Complete URL and query-parameter collection can also collect information that someone places in those addresses; do not place passwords, access tokens, payment credentials or sensitive or private service information in campaign or referral links.

Your choices. You may submit a request concerning covered sale, sharing or targeted advertising to Support@postsmartr.com with “Advertising privacy choice” in the subject. Section 8 explains how we handle privacy requests. You can also adjust advertising preferences in Meta’s Accounts Center and TikTok’s Settings and privacy → Ads, or use DAA advertising choices for interest-based advertising choices offered by participating companies. These external choices do not necessarily stop PostSmartr from sending measurement events. You can remove the attribution copies stored in a particular browser by clearing that browser’s PostSmartr site data, including cookies and local storage. Blocking or deleting browser cookies does not by itself stop server-side disclosures or delete information already shared. Our website does not currently respond to Do Not Track or Global Privacy Control signals.

Some U.S. state privacy laws treat these advertising disclosures as a “sale” or “sharing” of personal information or as “targeted advertising,” even when we receive no money in exchange. The availability and scope of opt-out rights depend on your residence and the law’s coverage. Where applicable law provides an opt-out right, it applies to the covered processing controlled by PostSmartr, including covered browser and server-side disclosures. Section 8 explains how to submit requests.

We keep information only as long as needed for the purposes described here, subject to shorter platform deadlines and legal obligations. Account records remain while the account is open and are removed from active systems within 30 calendar days after closure or a valid deletion request, except for the limited financial, legal and security records described below. Uploaded or generated content remains while you choose to keep it in your account; we remove it from active systems within 30 days after you delete it or close the account. These periods do not extend a shorter platform deadline. Browser attribution storage and clearing are described separately in Section 6; the one-hour cookie expiry does not apply to the separate local-storage copies.

Audience comments and messages used for automations are retained for up to 30 calendar days from receipt, unless deleted earlier or a platform requires a shorter period. Routine security and operational logs are retained for 90 calendar days from creation and exclude content, credentials, and tokens where unnecessary. Support correspondence is retained for up to 24 months after the ticket closes. Transaction, invoice, refund, and tax records are retained for seven years after the transaction, subject to applicable recordkeeping requirements. These financial records do not include unrelated social-platform content.

Ordinary backups expire within 30 calendar days of creation; after an ordinary deletion request, relevant active data is removed within 30 days and remaining ordinary backup copies within 60 days of the request. Platform data subject to a shorter deadline is handled separately so that copies, caches, and backups meet that deadline. AI providers’ safety and legal retention is distinct from our own account storage; Section 4 provides information about their practices. Where a specific legal obligation or claim requires longer retention of limited non-platform records, we restrict those records to that purpose and remove them when that need ends.

Connected-account tokens are disabled when access is revoked or no longer needed. Analytics history is limited by your plan, available authorization, and platform retention rules. A six- or twelve-month reporting window does not authorize keeping every underlying API record for that entire period. For YouTube, stored user data is deleted as soon as possible and within seven calendar days of a deletion request or account deletion. Revocation through PostSmartr triggers immediate token revocation and deletion of the corresponding authorized data within seven calendar days. Revocation through Google's security settings triggers deletion of the corresponding API data as soon as possible and within 30 calendar days. We check authorization and refresh or delete stored data as required by YouTube's rules; a shorter applicable deadline controls.

We may retain limited non-platform billing, legal, or security records where necessary and lawful. These exceptions do not override a stricter platform deletion requirement. Restricted backup copies are not used for ordinary business purposes; restoration must reapply deletion instructions and meet the applicable deletion deadline.

We use encryption in transit and at rest, role-based access controls, multi-factor authentication for privileged staff, protected access tokens, and one-way password hashing where passwords are used. Staff cannot retrieve your password. We maintain deletion procedures, security monitoring, and incident-response processes. No service can guarantee absolute security. We will provide legally required notices if a security incident affects personal information.

Depending on applicable law, you may request access, correction, deletion, or a portable copy; withdraw consent; object to or restrict processing; limit covered uses or disclosures of sensitive personal information; and opt out of covered sale, sharing, targeted advertising, or qualifying profiling. We do not use this service to make decisions producing legal or similarly significant effects about individuals. We will not unlawfully discriminate against you for exercising privacy rights.

Send requests to Support@postsmartr.com using your account email when possible. Identify the account or connected platform and the request, but do not send passwords, tokens, or full payment details. We use proportionate identity verification for requests such as access, correction, or deletion where appropriate. Requests to opt out of sale, sharing, or targeted advertising do not require creation of an account or identity verification where prohibited by law; we ask only for information needed to apply the choice to the relevant data. See Section 6 for advertising choices. We accept authorized agents where required. We respond within applicable legal deadlines and explain any lawful refusal, extension, or retained information. To appeal a decision where an appeal right applies, reply to our response with “Privacy appeal”; you may also complain to the relevant regulator.

You can stop a connection through the platform’s app or security settings, or through the connected-account controls in your PostSmartr dashboard. You may separately request deletion of the data held by PostSmartr or closure of your PostSmartr account. Revocation triggers deletion where platform rules require it; other records follow the retention schedule in Section 7. Contact Support@postsmartr.com for questions about the applicable deletion procedure. Deleting information from PostSmartr does not automatically remove posts already published to a social platform or copies retained by other people.

Deleting your account in Settings. “Delete account” (Settings → Danger zone) closes your PostSmartr account and starts deletion of associated data according to the periods and exceptions in Section 7. Your billing history is removed from your account view, but we retain certain transaction, invoice, refund and tax records for seven years as described in Section 7. Retained records are restricted to the purposes described there, including accounting, legal compliance and resolving claims. Stripe and other payment providers retain information under their own policies and legal obligations. Deleting your PostSmartr account does not delete their independent records or your social-platform accounts.

Our primary application hosting and ordinary backups use Amazon Web Services. Our application infrastructure and AI, payment, support and other providers may process information in the United States and other countries. Processing locations depend on the service and information involved; AWS hosting does not mean all processing occurs at AWS or only in the United States. Where EEA, UK or Swiss data-transfer rules apply, we use the applicable lawful transfer mechanism and supplementary safeguards. Contact Support@postsmartr.com for information about provider locations and those safeguards. We do not claim that POST SMARTR LLC has a privacy certification merely because a provider has one.

Where the GDPR or similar law applies, contractual necessity supports customer account and service delivery; legitimate interests support proportionate security, fraud prevention, support, and improvement where not overridden by individual rights; consent supports optional advertising tracking and other activities requiring it; and legal obligations support required recordkeeping. Information processed solely on customer instructions is governed by that customer’s lawful basis and our Data Processing Addendum.

For covered US state privacy laws, Sections 2–6 identify the categories, sources, purposes and recipients of personal information; Section 7 addresses retention; and Section 8 explains requests, agents, appeals and opt-outs. We do not solicit sensitive information for unrelated use or knowingly sell or share personal information of children under 16. Advertising attribution and registration-event processing are described in Section 6.

Where the New Jersey Data Privacy Law applies, we respond to covered requests within 45 days, with a further 45 days when legally permitted and explained during the initial period. We decide appeals within 45 days and, if denying an appeal, provide a way to contact the New Jersey Division of Consumer Affairs. These periods do not extend a shorter platform deletion deadline.

PostSmartr accounts are intended for adults aged 18 or older, or the higher age needed to contract where they live. We do not direct the service to children or knowingly register children. Audience content may incidentally concern minors; customers must have a lawful basis for processing it, and we do not use it to profile children. Contact Support@postsmartr.com if you believe a child’s information has been collected improperly.

We publish the effective date of changes and provide appropriate notice of material changes. Where law or platform rules require consent to a new use, we obtain it before that use begins. The policy describes our practices; it does not turn optional processing into consent merely because you visit the website.