Privacy Policy

Post Alone is operated by NUFILMA S.R.L., Romania. If you have any question about your data, contact privacy@postalone.ai.

• ·Account data: your name, email address and a securely hashed password.
• ·Business profile: the answers you give during onboarding — your niche, clients, pricing, tone, constraints and social handles.
• ·Generated content: strategies, content ideas, scripts, captions and covers created for you.
• ·Photos and video: any reference photo you upload and any video you record in the teleprompter.
• ·Performance data: the post metrics you choose to enter.
• ·Billing data: handled entirely by Stripe. We never see or store your card details.

We process your data to provide the service you asked for (performance of a contract), to keep the service secure and within fair-use limits (legitimate interest), and to bill you (contract and legal obligation). We do not sell your data, and we do not use it for advertising.

To generate your content, we send your business profile and the relevant post details to Anthropic (Claude). To generate cover images, we send your reference photo and an image prompt to OpenAI. These providers act as our processors under contractual terms and, per their published policies for business API use, do not train their models on this data.

Your reference photo is an image of a person. If you upload a photo of anyone other than yourself, you confirm you have their permission.

Data is stored in the EU and United States on infrastructure operated by Vercel and Neon. Transfers outside the EEA rely on Standard Contractual Clauses.

We keep your data while your account is active. If you delete your account, we delete your profile, content, photos and recordings within 30 days, except where we must keep invoices for tax purposes (7 years, as required by Romanian law).

Under GDPR you can access, correct, export, restrict or delete your data, and object to processing. You can export everything or delete your account at any time from My profile. You may also complain to your local data protection authority (in Romania, ANSPDCP).

We use one essential cookie to keep you signed in. We do not use advertising or tracking cookies, so there is nothing to consent to beyond what the service needs to function.

Passwords are hashed with bcrypt. Traffic is encrypted in transit. Access to production data is limited. No system is perfectly secure — if a breach affects you, we will notify you and the relevant authority within 72 hours.