Privacy Policy

Last updated 27 October 2026

This policy explains what personal data Posticle collects, why, who we share it with and the rights you have. We keep it short, and we only collect what we need to run Posticle.

Who We Are

Posticle (posticle.ai) is responsible for your personal data. Under data protection law, including the UK and EU GDPR, we are the "controller" of your personal data.

Questions or requests about your data: hello@posticle.ai.

What We Collect

• Your email address, when you join the early access list or create an account.
• Your brand kit: the details you enter while building it, such as your brand name, description, industry and topics, colours, fonts, social links, and any logo or font files you upload.
• Account details: your password (stored only in scrambled, "hashed" form, which we can't read), the date you accepted these terms, and whether your email is confirmed.
• Technical data: your IP address, browser type and similar information that websites receive automatically, used to keep Posticle secure and working.

We don't collect payment details during early access, and we don't knowingly collect any special category data (such as health or religious information).

Why We Use It

• To build and save your brand kit and create your account. This is necessary to provide the service you asked for (contract).
• To email you about early access: confirming your email, and telling you when your spot opens. You asked us to (consent), and you can opt out at any time.
• To keep Posticle secure: blocking bots and abuse, and fixing faults. This is in our legitimate interests and yours.
• To suggest content topics: if you use the topic suggestion feature, the brand description you type is sent to our AI provider to generate suggestions (contract).

We never sell your data, and we don't use advertising trackers.

Who We Share It With

We use a small number of trusted providers to run Posticle. They process data only on our instructions:

• Supabase: database, sign-in and file storage.
• Netlify: website hosting.
• Cloudflare Turnstile: invisible bot protection on the brand kit. Its use of your data is covered by the Cloudflare Turnstile Privacy Addendum.
• Cloudflare Web Analytics: counts visits to our website. It doesn't use cookies or track you as an individual.
• YouTube: plays the demo video on our home page, in privacy-enhanced mode. Google only receives data once you play it.
• OpenAI: AI topic suggestions, from your brand description only.
• Our email provider: sends account and early access emails.
• Google Fonts: loads the fonts on our pages, which means your browser shares your IP address with Google.

We may also share data if the law requires it, or to protect Posticle and its users from fraud or abuse.

International Transfers

Some of these providers store or process data in other countries, including the United States. When they do, we rely on the safeguards data protection law requires, such as adequacy decisions or standard contractual clauses.

How Long We Keep It

• Unfinished brand kits (no account created): deleted after 7 days of inactivity, or 30 days if you entered an email but never confirmed it. Logo or font files uploaded to an unfinished kit may be kept longer; ask us and we'll delete them.
• Early access list: kept until Posticle launches to you or you ask to be removed.
• Accounts and brand kits: kept while your account exists. When you ask us to delete your account, we delete your data within 30 days, except for anything the law requires us to keep.

Cookies and Local Storage

Posticle only uses storage that's strictly necessary to work: your browser's local storage keeps you signed in and saves your brand kit progress, and Cloudflare Turnstile may set a cookie to check you're not a bot. We don't use analytics or advertising cookies, so there's nothing to opt out of. If we ever add them, we'll ask first.

Your Rights

You have the right to:

• get a copy of your personal data;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to how we use it;
• receive your data in a portable format;
• withdraw your consent at any time, for example to early access emails.

To use any of these rights, email hello@posticle.ai. We'll reply within one month. If you're unhappy with how we've handled your data, you can complain to your local data protection authority, though we'd appreciate the chance to put things right first.

Security

Your data is sent over encrypted connections (HTTPS), passwords are hashed, and database access rules mean each account can only reach its own data. No system is perfectly secure, but we take reasonable steps to protect your information and will tell you promptly if a breach affects you.

Children

Posticle is a tool for businesses and creators, and it isn't intended for anyone under 18. We don't knowingly collect data from children.

Changes to This Policy

If we change this policy, we'll update the date at the top. If the changes are significant, we'll email you before they take effect.

Contact

Posticle. hello@posticle.ai