Privacy Policy

1. Introduction

Welcome to Posta ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered social media management platform.

Digital Wave Tech (Pty) Ltd is a South African company, and we comply with the Protection of Personal Information Act (POPIA), Act 4 of 2013. As the responsible party under POPIA, we ensure that all personal information is processed lawfully and in a reasonable manner that does not infringe on your privacy.

By using Posta, you consent to the collection and use of your information in accordance with this policy. If you do not agree with our policies and practices, please do not use our services.

2. Information We Collect

We collect information that you provide directly to us, information collected automatically, and information from third-party sources.

2.1 Information You Provide

• Account Registration: Name, email address, password (encrypted), and optional profile picture when you create an account.
• Profile Information: Business name, industry, preferred language (from our 11 South African language options), and timezone preferences.
• Payment Information: When you subscribe to Pro or Business plans, payment details are processed securely through our payment provider, Polar.sh. We do not store your full credit card details.
• Content: Social media posts, images, captions, and any content you create or upload using our AI content generation tools.
• Communications: Messages you send to our support team and feedback you provide.

2.2 Information Collected Automatically

• Device Information: IP address, browser type, operating system, and device identifiers.
• Usage Data: Pages visited, features used, time spent on the platform, and interaction patterns.
• Log Data: Server logs recording your activity on our platform for security and troubleshooting purposes.

2.3 Information from Third Parties

• OAuth Connections: When you connect your social media accounts (Instagram, Twitter/X, LinkedIn, Facebook), we receive access tokens and basic profile information from these platforms.
• Google OAuth: If you sign in with Google, we receive your name, email, and profile picture.
• AI Services: We use Google Gemini Pro for content generation. Prompts and generated content may be processed by Google's AI systems.

3. How We Use Your Information

We use your personal information for the following purposes:

• Service Delivery: To provide, maintain, and improve our social media management platform, including AI content generation, scheduling, and automated posting.
• Account Management: To create and manage your account, process subscriptions, and handle credit purchases.
• Communication: To send service updates, security alerts, and respond to your inquiries.
• Personalization: To customize your experience based on your preferences, language settings, and usage patterns.
• Analytics: To understand how users interact with our platform and improve our services.
• Security: To detect, prevent, and address fraud, abuse, and security issues.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.

4. Data Storage and Security

We implement robust security measures to protect your personal information:

4.1 Encryption

• Data at Rest: Sensitive data, including OAuth tokens for your connected social media accounts, is encrypted using AES-256-GCM encryption.
• Data in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.3.
• Passwords: User passwords are hashed using industry-standard bcrypt algorithms and are never stored in plain text.

4.2 Infrastructure Security

• Database: Our PostgreSQL database is hosted on Neon, a secure cloud database provider with SOC 2 compliance.
• Application Hosting: Our application is hosted on Vercel, which maintains enterprise-grade security controls.
• Access Control: Strict access controls ensure only authorized personnel can access production systems.

4.3 Security Practices

• Regular security audits and vulnerability assessments
• Secure session management with HttpOnly cookies and CSRF protection
• Input validation and sanitization to prevent injection attacks
• Automated monitoring for suspicious activity

5. Third-Party Services

We work with trusted third-party service providers to deliver our platform. These providers have access to your information only to perform specific tasks on our behalf:

5.1 Payment Processing

Polar.sh: Handles all payment processing for subscriptions and credit purchases. Polar.sh is PCI DSS compliant and does not share your payment details with us. View their privacy policy at polar.sh/privacy.

5.2 AI Content Generation

Google Gemini Pro: Powers our AI content generation features. When you generate content, your prompts are sent to Google's AI services. Google's privacy practices apply to this data. View Google's privacy policy at policies.google.com/privacy.

5.3 Social Media Platforms

When you connect your accounts, the following platforms receive data:

• Meta (Facebook/Instagram): Post content, images, and scheduling data for accounts you connect.
• Twitter/X: Tweet content and media for posting.
• LinkedIn: Post content for your professional profile or company pages.

Each platform's privacy policy governs how they handle your data once it leaves our platform.

5.4 Infrastructure Providers

• Vercel: Application hosting and serverless functions
• Neon: PostgreSQL database hosting
• Vercel Blob: Image and media file storage

6. Your Rights Under POPIA

Under the Protection of Personal Information Act (POPIA), you have the following rights regarding your personal information:

6.1 Right to Access

You have the right to request access to the personal information we hold about you. You can request a copy of your data by contacting us at leroy@digitalwavetech.dev.

6.2 Right to Correction

You have the right to request that we correct any inaccurate or incomplete personal information. You can update most information directly in your account settings or contact us for assistance.

6.3 Right to Deletion

You have the right to request deletion of your personal information. Upon receiving a valid request, we will delete your data within 30 days, except where we are legally required to retain it. To request deletion, email leroy@digitalwavetech.dev.

6.4 Right to Object

You have the right to object to the processing of your personal information for direct marketing purposes or where processing is based on our legitimate interests. You can opt out of marketing communications at any time.

6.5 Right to Data Portability

You have the right to receive your personal information in a structured, commonly used, machine-readable format. Contact us to request an export of your data.

6.6 Right to Lodge a Complaint

If you believe your privacy rights have been violated, you have the right to lodge a complaint with the Information Regulator of South Africa:

7. Cookies and Tracking

We use cookies and similar tracking technologies to enhance your experience on our platform.

7.1 Types of Cookies We Use

• Essential Cookies: Required for the platform to function, including authentication and session management. These cannot be disabled.
• Functional Cookies: Remember your preferences, such as language selection and display settings.
• Analytics Cookies: Help us understand how users interact with our platform to improve our services.

7.2 Managing Cookies

You can control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of our platform. Most browsers allow you to:

• View what cookies are stored on your device
• Delete all or specific cookies
• Block third-party cookies
• Block all cookies from specific sites

8. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy:

• Account Data: Retained while your account is active and for 90 days after account deletion to allow for recovery.
• Generated Content: Stored until you delete it or close your account.
• Transaction Records: Retained for 7 years as required by South African tax law.
• OAuth Tokens: Retained while the connection is active and deleted immediately upon disconnection.
• Usage Logs: Retained for 12 months for security and analytics purposes.

9. International Transfers

Your information may be transferred to and processed in countries outside South Africa:

• Vercel: Our application hosting provider operates globally with data centers in multiple regions.
• Google (Gemini AI): AI processing may occur in Google's global data centers.
• Social Media Platforms: Data posted to your connected accounts is subject to each platform's data practices.

Where data is transferred internationally, we ensure appropriate safeguards are in place, including standard contractual clauses approved by relevant authorities. These third parties maintain security practices compliant with international standards.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. When we make changes:

• We will update the "Last updated" date at the top of this policy.
• For significant changes, we will notify you via email or a prominent notice on our platform.
• Your continued use of our services after changes become effective constitutes acceptance of the revised policy.

We encourage you to review this policy periodically to stay informed about how we protect your information.

11. Contact Information

If you have any questions about this Privacy Policy, your personal information, or wish to exercise your rights under POPIA, please contact us:

We aim to respond to all privacy-related inquiries within 7 business days.