Privacy Policy

1. Who we are

PostDepo is operated by Intell Dynamic SRL (“we”, “us”). We are the controller of the personal data this policy describes, except for the content described in section 3, which we process on behalf of the business that brings it in.

Write to contact@intelldynamic.ro with any question about this policy or about your data, including to exercise any of the rights in section 8.

2. What we collect

Only what the service needs in order to work:

• Your account: your email address, your name if your sign-in provider shares it, how you sign in, your language and display preferences, and your plan.
• Connected accounts: when you connect Instagram or another network, the account's identifier and username and the access token the network issues. Tokens are stored encrypted.
• Your content: the posts, stories and reels of the accounts you connect — captions, photos, videos and their dates — and the pages, sites and products you create. If you upload an archive downloaded from a network, we read only its posts, reels, stories and its profile, to check that the archive belongs to the connected account; messages, followers and comments are never read, and the archive is deleted once it has been read.
• Your brand's profile: its name, website, type, industry, description, market, audience and the language of its pages. If AI writing is available to you, also its brief: what our AI research found about the brand on the public web, with the page each fact came from, the facts you add, and what you ask us never to say. Where the brand is a person — a professional or a public figure — both are personal data about them.
• AI writing: a record of each research and each AI draft — when it ran, how far it got, whether it succeeded and how much it used — and of the AI articles your plan includes, the ones you used and any extra ones we granted you.
• Billing: the identifiers our payment processor gives us for your customer record, subscription and payments, and our own record of the credits granted, spent and refunded. Card details go directly to the payment processor and never reach us.
• Consent: which version of each document you accepted or withdrew, when, and where — at sign-in, in your account settings or in the cookie banner — with a one-way hash of your IP address and a shortened description of your browser, so that we can show consent was given.
• Technical and usage data: pages viewed, the type of device, operating system and browser, error reports and server logs. Our usage records store IP addresses with their last part removed; our hosting provider's request logs keep full addresses for a limited time, for security.
• Google Search Console, if you connect it: the permission Google grants us and the search figures it reports for your sites. The permission is stored encrypted and is revoked at Google when you disconnect it or delete your account.

3. Your content, and the people in it

The posts you bring into PostDepo may show or name other people. For that content you decide what is collected, what stays private and what is published, and where: you are its controller, and we process it on your instructions and only to provide the service. Before publishing a post in which someone can be identified, make sure you are allowed to.

If AI writing is available to you, an AI model writes a draft page from the posts you choose: it looks at their pictures and at frames of their videos and describes them, transcribes what is said in a reel, and writes from these, the caption and your brand's confirmed brief. A draft is private and keeps those descriptions and transcripts, which you can edit; nothing is published until you approve it. We instruct the model never to identify anyone from their face: people in pictures are described, not named, unless the caption names them.

So that we can write accurately about your brand, our AI research reads what the public web says about it — its own website first — and shows you every fact with its source. Nothing it finds is used until you confirm the brief, and you can strike any fact, add your own and list what must never be said. If the brand is a person, we limit the research to their professional activity, and you must be that person or have their agreement.

People who read the pages you publish are counted, not identified: we record a site, a day, a page or a kind of reader (search engine, AI assistant or person) and a number — no IP address, no browser identifier and no cookie.

4. Why we use it, and on what legal basis

• To provide the service you signed up for — your account, copying and organising your content, researching your brand and writing drafts with AI where your plan includes it, building and publishing pages, billing — because it is necessary to perform our contract with you (Art. 6(1)(b) GDPR).
• To keep the service secure and working — limiting request rates, preventing fraud and abuse, monitoring errors and producing aggregated usage statistics — on the basis of our legitimate interest in running a safe and reliable service (Art. 6(1)(f) GDPR).
• To keep accounting and tax records of payments, because the law requires it (Art. 6(1)(c) GDPR).
• To measure how the site is used with Google Analytics, and to send product and marketing email — each only with your consent, which you can withdraw at any time from Cookie settings or your account settings (Art. 6(1)(a) GDPR). Receipts and messages about your account are not marketing and are always sent.

We do not sell personal data, and we do not use it for advertising.

5. Who processes it for us

We rely on the following providers. Each processes data only to deliver its part of the service — under a contract with us or, for an account you connect yourself, under that provider's own terms:

• Google Cloud and Firebase (Google) — hosting, database, file storage and sign-in, and Search Console if you connect it; for AI writing, Vertex AI, which turns a draft's text into numbers so that we can tell whether two of your pages are too alike, and Speech-to-Text, which transcribes what is said in reels. Our data is stored, and these two services run, in the European Union. Google Analytics (Google), only if you allow analytics cookies — see our Cookie Policy.
• Anthropic — the AI models that research a brand on the public web, look at its pictures, and write and check its drafts, in the United States. Anthropic receives only what that work needs — the brand's profile and confirmed brief, the captions, pictures, video frames and transcripts of the posts being written up, and the titles of the brand's recent pages — and never your account details, your connected accounts' access tokens or your payment details. Its web research runs searches through a search engine Anthropic engages. Anthropic deletes what it receives within 30 days, unless it must keep it longer by law or to investigate a breach of its usage policy, and does not use it to train its models.
• Meta Platforms (Facebook, Instagram) — the source of the content of the accounts you connect, within the permissions you grant there.
• Stripe — payments, subscriptions and invoices.
• Resend — email delivery.

Some of these providers are established outside the European Economic Area or may access data from there. Such transfers rely on an adequacy decision of the European Commission, including the EU–US Data Privacy Framework, or on the Commission's standard contractual clauses.

6. How long we keep it

• Your account and your content: for as long as you have an account. Content stays private until you publish it, and published pages stay online until you unpublish them or delete your account.
• Uploaded archives: deleted as soon as they have been read, refused, cancelled or abandoned.
• AI writing: your brand's brief, for as long as you have an account — you can research again or change it at any time; AI drafts, like any other page; the result of each AI job, kept in our storage for 7 days — even if the account is deleted in the meantime — so that an interrupted job can be finished without running it again, then deleted; and the record of AI usage and AI articles, for as long as you have an account.
• Usage and error records: for a limited period — 30 days by default, and never more than 400 days.
• Payment and credit records: for as long as accounting and tax law requires, including after an account is deleted.

When you delete your account we erase it — including your sign-in identity, your connected accounts and your content. A few records are kept on purpose: the payment and credit records, a log of any administrator access to your account, and one-way hashes that stop a free trial being claimed twice or an unsubscribed address being written to again. Your data export lists each of them and why it is kept.

7. Cookies and similar technologies

What we keep in your browser, and why, is set out in our Cookie Policy, linked at the bottom of every page.

We use no advertising cookies. The only cookies that need your consent are Google Analytics', which are set only if you allow them in the cookie banner and can be turned off at any time from Cookie settings.

8. Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

• Download your data from your account settings: a copy of everything we hold about you, in a machine-readable file.
• Delete your account from your account settings, at any time.
• Removing PostDepo in your Instagram or Facebook settings also asks us to delete what we copied from that account; you receive a confirmation code and a page where you can check the request.
• For anything else, write to contact@intelldynamic.ro. We reply within one month, as the law requires.

You may also lodge a complaint with the Romanian data protection authority — the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro) — or with the authority of the EU country where you live or work.

9. How we protect it

Everything travels encrypted, sensitive values such as access tokens are encrypted where they are stored, and your private content can only be opened through short-lived signed links, issued after we check that you may see it. Within our team, access to personal data is limited to what support and operations need, and every support access is logged.

10. Children

PostDepo is a service for businesses and adults. You must be at least 18 to create an account, and we do not knowingly collect data about children.

11. Changes to this policy

When we change this policy in a way that matters, we publish the new version here with a new version number and date, and ask you to accept it again — in your account settings, or when you next sign in.