Privacy Policy

Who is responsible for your data

PostNexa is a product of ALTINKEY, not a separate company. ALTINKEY INNOVATION AI SOLUTIONS L.L.C is the data controller for the personal data processed through the Service and the party you contract with (“we”, “us”). Address: Damac Executive Bay Tower B, Business Bay, Dubai, UAE · Regional office: Mall of Istanbul A block, Başakşehir, Istanbul, Türkiye. Phone: +971 50 745 5120. E-mail: support@postnexa.io.

Data we collect

• Account data: your WhatsApp number (used for one-time login codes), the optional name and e-mail you add, your interface language, and your device's time zone, which your browser gives us so that the times in our e-mails match your clock. An e-mail address you have verified can also receive your one-time login codes.
• Project data: the brand information you enter (name, services, audience, colors, logo), your product catalogue, and the posts, images and videos created in the Service.
• Connected social accounts: when you connect a platform we store the account/page identifier, its display name, and the access tokens the platform issues. Tokens are stored encrypted (AES-GCM) and are used exclusively to read the basic profile of the connected account, the pages or organizations you manage on it (so you can choose where to publish) and the posting options the platform allows for it; to publish the posts you ask us to publish; and to read the performance figures of those posts (next item). We never read your feeds, messages, contacts or followers.
• Post performance figures: where the Service shows how your posts perform, it reads from the platform the figures the platform reports for each post published through the Service — such as views, reach, reactions, comments, shares, saves and link clicks — and stores them with that post, for you and the members of your project to see. These are counts only: we do not read the text of comments or who viewed, reacted or shared, and we never read the figures of your other posts or of other accounts.
• Billing data: the billing details you enter for your invoices (name, address, country and, for a business, its tax number), the records of your token purchases and usage, and the invoices we issue to you. To apply your country's tax, we also record with each payment the country code of your WhatsApp number, the country of the IP address you pay from and the country of the card you pay with. Payments are processed by our payment provider. We never receive or store your card number or its security code. We keep only the card type, its last four digits and its country, as our payment provider reports them. If you enter a business tax number of a European Union country, we check it with the European Commission's VIES service, which receives the number and the name you entered for that purpose, and we keep its answer with your billing details.
• Waiting list: if you join the waiting list before sign-up opens, the WhatsApp number, the e-mail address or both that you enter, and your interface language. We use them only to tell you when access opens, and we delete them on request.
• Technical logs: standard request logs (IP address, time, endpoint) kept for security and troubleshooting.

What we do NOT do

• We do not sell or rent any personal data.
• We do not post anything without an explicit action (a publish click or a schedule you created).
• We do not use data obtained from the social platforms for advertising or profiling, and we do not pass it to anyone other than the providers that host and run the Service for us.

Cookies and local storage

We use only the cookies the Service needs in order to work. We do not use advertising or analytics cookies, and no third party sets cookies through the Service.

• access_token and refresh_token — keep you signed in. They are set when you sign in, cannot be read by scripts in the page, and expire after 30 minutes and 7 days respectively; they are renewed while you use the Service.
• lang — remembers the interface language (one year).
• theme — remembers the appearance you chose: light, dark or the same as your device (one year).
• cookies_ok — remembers that you have seen the cookie notice (one year).
• Your browser’s local storage holds two small values, auth_sync_signal and system_super_admin, used to keep every open tab in step when you sign in or out. They hold a time stamp and a display flag — never your tokens or personal details.

These cookies are either necessary for signing in or store a preference you chose. You can delete or block them in your browser at any time; without the sign-in cookies you cannot stay signed in.

Where data lives

Data is stored on Google Cloud (Cloud SQL, Cloud Storage, Cloud Run) in the European Union (Netherlands, europe-west4). AI generation runs on Google Vertex AI. Some models are served from Google’s global or United States endpoints — video generation runs in the United States — so the content of a generation request may be processed outside the European Union. Only what the task needs is sent to the model: the brand brief, the post subject, the details of the product a post is about, and the public pages of a website you ask us to read — never your social-account tokens.

Google may keep a temporary copy of a generation request: in memory for up to 24 hours to speed up similar requests and, when a feature searches the web for you, the search queries for up to 3 days for debugging. Google does not use this data to train its models and erases it automatically.

One-time login codes are delivered through the WhatsApp Business Platform (Meta), which receives your WhatsApp number for that purpose. If you choose to sign in by e-mail, the code is sent to your verified e-mail address instead.

Retention & deletion

Data is kept while your account is active. Disconnecting a social account deletes its tokens immediately, and nothing more is read from that account after that. Deleting your account or a project removes the associated data. See Data deletion for the exact steps, including deletion requests coming from the platforms themselves.

What remains after an account is deleted. Your name, e-mail, photo and WhatsApp number are erased. We keep (a) the accounting records of token purchases and usage, which no longer identify you, and (b) a one-way fingerprint of the WhatsApp number — it cannot be turned back into the number and cannot be used to contact anyone. The fingerprint serves three purposes only: a number that deleted its account does not receive the welcome allowance a second time; a debt left unpaid returns to the same number if it signs up again; and, on your request, we can find and restore unused paid tokens of the deleted account to the new one.

Invoices are kept. This does not apply to the invoices we issued to you and to the evidence of your country recorded with them: the name, address and tax number printed on each invoice, and the country codes recorded with each payment. Tax law requires us to keep them after your account is deleted, for up to 10 years. They are kept apart and used only for accounting, tax and legal obligations.

Your rights & contact

You may request a copy or the correction/erasure of your data at any time: support@postnexa.io.

Changes to this policy and language

We may update this policy; the date at the top shows the current version. This policy is written in English. Translations into other languages are produced by machine translation and are provided for convenience only; the English version prevails in case of any conflict.