Privacy Policy

PickPostAI ("we", "our", or "us") operates the PickPostAI platform, accessible at pickpostai.com. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information.

By using PickPostAI, you agree to the collection and use of information in accordance with this policy.

1.Information We Collect

1.1 Account Information

When you create an account we collect:

• Name and email address
• Password (stored as a one-way bcrypt hash — never in plain text)
• Organisation name (if you create a team)

1.2 Store Credentials

To connect your eCommerce store we collect API credentials (e.g. WooCommerce consumer key/secret, Shopify access tokens, BigCommerce API keys). These are encrypted at rest with AES-256-GCM and are used solely to sync your product catalogue.

1.3 Social Media Credentials

To publish content we collect OAuth access tokens for Facebook Pages and Instagram Business accounts you authorise via Meta's OAuth flow. Tokens are stored encrypted and used only to post content on your behalf.

1.4 Usage Data

We automatically collect:

• Pages visited and features used within the dashboard
• IP address, browser type, and operating system
• Timestamps of logins and key actions (audit log)
• Error logs for debugging purposes

1.5 Payment Information

Billing is handled by Paddle. We never see or store your credit card details. Paddle provides us only with subscription status, plan type, and transaction IDs.

1.6 Live Chat

Our website uses Tawk.to for live customer support. If you initiate a chat, Tawk.to may collect your name, email, and the content of your conversation. See Tawk.to's Privacy Policy for details.

2.How We Use Your Information

• Provide and operate the PickPostAI service
• Sync your product catalogue and generate AI content
• Publish posts to your connected social media accounts
• Send transactional emails (account confirmation, password reset, billing receipts)
• Respond to support requests
• Detect and prevent fraud or abuse
• Improve our platform based on anonymised usage patterns

We do not sell, rent, or share your personal data with third parties for marketing purposes.

3.AI Content Generation

PickPostAI uses OpenAI's API (and optionally Anthropic's API) to generate captions. When generating content, product information (title, description, price, images) is sent to the AI provider. We do not send personal account details or store credentials to AI providers.

Please review OpenAI's Privacy Policy for how they handle data sent to their API.

4.Data Retention

• Account data is retained for as long as your account is active.
• After account deletion, personal data is removed within 30 days.
• Billing records may be retained for up to 7 years to comply with financial regulations.
• Anonymised usage analytics may be retained indefinitely.

5.Data Security

We implement the following security measures:

• All data in transit is encrypted via TLS 1.2+.
• Sensitive credentials (store API keys, OAuth tokens) are encrypted at rest with AES-256-GCM.
• Passwords are hashed with bcrypt (never stored in plain text).
• Production infrastructure is hosted on AWS with access limited to authorised personnel.
• Role-based access control prevents users from accessing other organisations' data.

No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at privacy@pickpostai.com.

6.Cookies

PickPostAI uses the following cookies:

• Session cookie — keeps you logged in (expires on browser close or after 30 days if "remember me" is selected).
• CSRF token — protects against cross-site request forgery attacks.
• Tawk.to cookies — used by our live chat widget to maintain chat sessions.

We do not use advertising or tracking cookies. You can disable cookies in your browser settings, but this will prevent you from logging in.

7.Third-Party Services

We use the following sub-processors:

8.Your Rights

Depending on your location, you may have the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — request deletion of your account and associated personal data.
• Portability — receive your data in a machine-readable format.
• Objection — object to certain types of processing.
• Withdraw consent — disconnect social accounts or revoke store credentials at any time from Settings.

To exercise any of these rights, email privacy@pickpostai.com. We will respond within 30 days.

9.Children's Privacy

PickPostAI is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

10.Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, for material changes, notify you by email or an in-app banner. Continued use of PickPostAI after changes take effect constitutes acceptance of the revised policy.

11.Contact Us

If you have questions about this Privacy Policy or how we handle your data, contact us at: