Privacy Policy
Last updated 8 October 2026
North Comet Pvt Ltd, Sector 18, Noida, India, operates Postshape and is the controller of the personal data processed through it. Contact us about privacy at support@postshape.com.
What we collect
- Account: your email address and sign-in records. Passwords are handled by Firebase Authentication; we never see them.
- Brands and content: brand names, websites, descriptions, logos, photos you upload, references you choose, and the captions, images and schedules Postshape creates.
- Connected accounts: your Instagram account ID, username and access token, and any AI provider keys you add. Tokens and keys are stored encrypted.
- Billing: Dodo Payments collects your payment details. We receive your Dodo Payments customer and subscription IDs, plan, status and billing dates. We never see card numbers.
- Usage and technical data: monthly draft and image counts, server logs (IP address, browser, requested pages), and cookie-free page statistics from Vercel Web Analytics.
Why we use it
- To provide Postshape, including generating and publishing posts: necessary to perform our contract with you.
- To bill you and apply plan limits: contract, and our legal duty to keep financial records.
- To secure the service, prevent fraud and fix problems: our legitimate interest in a safe, working product.
- To email you about your account, billing and changes to our terms: contract and legitimate interest. We do not send marketing email without your consent.
Who receives it
- Google Firebase: sign-in and database.
- Vercel: hosting, file storage and page statistics.
- Cloudflare: image storage and delivery.
- Anthropic and OpenAI: text and image generation. Each request includes only the brand details, photos and instructions it needs.
- Meta: the Instagram accounts you connect and publish to.
- Dodo Payments: Merchant of Record for payments, tax and refunds.
- Professional advisers, and authorities where the law requires it.
We do not sell personal data.
International transfers
These providers may process data outside India, including in the United States. Where data protection law requires it, transfers rely on safeguards such as Standard Contractual Clauses or adequacy decisions.
How long we keep it
We keep your data while your account is open, except files Postshape made that nothing uses any more: generated backgrounds no post uses are deleted after 30 days, and the copies sent to Instagram after 7 days. If your subscription ends and you do not start a new one, your images are deleted 90 days later. When you ask us to close your account, we delete your brands, content and connections within 30 days. Billing records are kept for as long as tax law requires.
Your rights
You can ask to access, correct, delete or export your data, restrict or object to how we use it, and withdraw consent. Email support@postshape.com; we reply within one month. You can also complain to your data protection authority, such as the Data Protection Board of India or, in the UK or EEA, your local supervisory authority.
Cookies
We use two essential cookies: one keeps you signed in and one remembers your active brand. The Dodo Payments checkout may set its own cookies for payment and fraud prevention.
Security
Data is encrypted in transit. Connected-account tokens and API keys are encrypted at rest, and access to production data is limited to the people who run Postshape.
Children
Postshape is not for anyone under 18.
Changes
We will post updates on this page with a new date and email account holders about material changes.