Privacy policy

Posting Octopus is run by Reztor Pty Ltd ("we"). This policy explains what we collect, why, and what you can do about it. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

What we collect

• Your account: name, email address and sign-in details, handled by our sign-in provider, Clerk.
• Your workspace: its name, team members and their roles, time zone and alert email addresses.
• Connected social accounts: when you connect a social account (Facebook, Instagram, Threads, LinkedIn, X, Bluesky, Pinterest, Google Business, YouTube or TikTok), we receive the page, profile, board, location or channel name, picture, an id, and an access token (for Bluesky, an app password) that lets us post on your behalf. We store tokens encrypted. For Facebook we also keep the id of the person who connected the account, so we can delete their data if they ask.
• Your content: posts, images, schedules, and what happened when each was published.
• AI tools you connect: their names, a fingerprint of each key (never the key itself), and a log of what each tool did.
• Business profile: what you tell us about the business (what it does, its products, audience, tone of voice, links and example posts), which the AI writer and the AI tools you connect use to write posts.
• Social inbox: comments on your accounts' recent posts, private messages sent to your Facebook pages and Instagram accounts, and Google reviews of your locations, with the name and network id of the person who wrote each, and the replies you send. We keep them so your team can read and answer them in one place.
• Website import: if you connect Webflow, an encrypted API token and the titles and addresses of your published articles.
• Billing: handled by Stripe. We see your plan, billing status and the business name and address on invoices, never your full card number.

What we use it for

To run the service: publishing your posts when you schedule or approve them, showing you what each AI tool did, emailing you when a post fails, billing you, and supporting you. We do not sell personal information, and we do not use your content or your social accounts' data for advertising or to train AI models.

What we read from social networks

We only use the permissions needed to list the pages and accounts you manage, publish to them, post the first comments you write, read back the views and reactions your posts get, and show your inbox: the comments, private messages and reviews your business accounts receive, and the replies you send from Posting Octopus. We do not read your personal profile's messages, your followers' personal information or your personal feed.

Who we share it with

Service providers that run parts of the service for us: Vercel (hosting and image storage), our database host, Clerk (sign-in), Stripe (payments), Resend (alert emails) and Anthropic (the AI writer). When you ask the AI writer for a post, or it writes one from a new website article, we send Anthropic your business profile, what you asked for and the text of any web page or article it writes from. When you ask it to suggest an inbox reply, we send the comment, message or review and the conversation around it. Anthropic's commercial terms don't let it train its models on that. Your posts go to the social networks you choose. Some of these providers store data outside Australia, including in the United States. We may also disclose information when the law requires it.

How long we keep it

While your workspace exists. When an admin deletes the workspace, we delete its posts, connected accounts, AI tools and logs. Billing records are kept as long as tax law requires.

Your choices

• Disconnect a social account by removing the app in that network's settings, or ask us to delete it.
• Facebook users can request deletion as described on our data deletion page.
• You can ask to see or correct the personal information we hold about you, or complain about how we handled it, by emailing support@postingoctopus.com. If you're not satisfied with our answer you can contact the Office of the Australian Information Commissioner.

Security

Access tokens and API tokens are encrypted at rest. AI tool keys are stored only as fingerprints. All traffic uses HTTPS.

Changes

We'll post changes here and email workspace admins about significant ones.