Privacy Policy

1. Overview & Commitment

Postlyn (“we,” “us,” or “our”) operates a multi-tenant, AI-powered social media and business automation platform. We are committed to safeguarding the confidentiality, privacy, and integrity of the data you entrust to us across your workspaces.

2. Information We Collect

We collect only the information strictly necessary to provide seamless social media management and AI automation:

• Account Credentials: Full name, verified business email, encrypted password hash, and role permissions.
• Social Platform Tokens: OAuth 2.0 access and refresh tokens for authorized social networks (Instagram, Facebook, LinkedIn, Pinterest) granted via official provider authorization dialogs.
• Bring-Your-Own-Key (BYOK) AI Credentials: User-supplied base URLs and API keys used to interface with OpenAI-compatible inference endpoints.
• Brand Creative Assets: Media files uploaded to your private workspace library or generated via automated prompt workflows.

3. Data Isolation & Security Architecture

Our architecture enforces multi-tenant database isolation at the database query layer:

• Strict Tenant Scoping: Every query executed on tenant data is strictly bounded by workspaceId. Cross-tenant leakage is architecturally prohibited.
• Account-Level Isolation: Data belonging to Social Account A is never exposed, queried, or mingled with Social Account B.
• Encryption at Rest: All external API keys and platform OAuth tokens are encrypted using authenticated AES-256-GCM.
• HttpOnly Session Security: Authentication tokens are stored exclusively in HttpOnly, SameSite cookies with CSRF validation.

4. Social Network API Compliance

Postlyn interfaces directly with official social network developer APIs. We comply strictly with Meta Platform Terms, LinkedIn API Terms of Use, and Pinterest Developer Guidelines. We do not scrape, harvest, or resell social media follower data or private direct messages.

5. Universal AI Client & Processing

Postlyn provides a Universal AI Client communicating over the OpenAI-compatible wire protocol. Your prompt text, scheduled posts, and brand knowledge are passed exclusively to your configured AI inference provider and are never used to train public foundation models.

6. Data Retention & Your Rights

You retain complete ownership of your brand media and content. You may disconnect social channels, export your scheduled library, or request workspace deletion at any time by contacting our support team or through your Workspace Settings.