The short version
Autopostmate writes social posts for your business from records you put on file. To do that it sends those records, your brief, and the drafts it produces to a language model, a fact-checker, and a web search service. It keeps every run so you can see what was tried. It does not sell your data, does not run advertising, and does not use your content to train models. You can export your content from the app, and you can ask us to delete your account and everything under it.
Who we are
Autopostmate is operated by Kaizen Global, Offices G-80, Greens, Diamond Mall & Residency, Gulberg Greens Block B, Gulberg, Islamabad 44000, Pakistan. For anything in this policy, write to [email protected] or call +92 312 4422229. We are the controller of the personal data described here.
What we collect
Almost everything Autopostmate holds, you typed in or uploaded so that the line has something to write from. Here it is by kind.
Your account
- Email address and a password. Sign-in is handled by Supabase, and we never see or store the password itself.
- Your name, if you give one, and whether onboarding is complete.
Your business and its knowledge base
- Business name, industry, location and description.
- Brand identity: tagline, colours, logo, the words you never say, the default look for slides.
- Brand voice examples, products, proof points, key dates, and the images you upload as assets.
These records are the point of the product. Every caption is written from them, and the fact-checker reads claims against them. If you put a customer's name or a phone number in a proof point, it will be treated as any other record and may be sent to the services listed under Models and services, so keep the knowledge base to facts about the business.
Briefs, runs and everything they produce
- Each generation request: post type, platform, vibe, topic, an article link if you started from the news feed, and which uploaded image you chose.
- Both caption variants, the guardrail findings, the fact-check verdicts and questions, and any caption edits you make.
- Rendered slides, the layer positions you set, and the look you picked.
- Your review decisions: which variant you chose, approvals, rejections and the reason you gave, and the attempt count.
- The record you make when you mark a run as posted.
- Drafts you flag for our staff, with the reason. A flag freezes a copy of the draft as it was at that moment.
Planning
- Planned posts, campaigns and monthly goals on the calendar.
- Planner chats: your messages, the assistant's replies, and the proposals you applied or dismissed.
- Planner memories: short notes the planner saves about your preferences, which you can edit or delete at any time.
News feed
- The feed sources you follow, the categories you file them under, and any description you give when asking the feed curator to find sources.
- Headlines and snippets fetched from those sources. These are the publishers' content, not yours, and are kept only as a cache.
Connected accounts
- If you connect LinkedIn: the access token LinkedIn issues us, its expiry, your LinkedIn member id, and the name and email LinkedIn returns for the connected profile. The token is encrypted at rest and is used only to publish posts you explicitly send.
Usage and technical data
- Counts of generations against your monthly allowance, and any allowance override our staff set for you.
- Server logs and error reports: timestamps, request ids, your account id, the route that was called, your IP address and browser type, and enough of the error to fix it.
- Pipeline traces: a record of each run through the line, including the prompts and outputs, so we can find out why a run failed or drifted.
What we do with it
- Run the line. Write captions from your records, check them, render slides, and hold them for your review.
- Ground and check. Hand your knowledge base to the writer and the fact-checker, so what comes back is about your business and is measured against what you said is true.
- Publish when you say so. Send an approved post to a connected account, only when you press the button.
- Keep your history. Show every run, including rejected and failed ones, because the trail is how you see what was tried.
- Count the allowance. Enforce the flat monthly number of runs.
- Answer flags. Let our staff read a draft you flagged, and only that draft, and record what they did about it.
- Keep it working. Find and fix errors and failed runs, and measure how long stages take.
We do not sell personal data. We do not show advertising. We do not use your records, briefs or drafts to train any model, ours or anyone else's.
Where the law asks for a legal basis: running the service and everything in the list above is performance of our contract with you; error reports, traces and security logging are our legitimate interest in keeping the service working and safe; connecting LinkedIn is your consent, which you withdraw by disconnecting.
Models and the services that touch your data
Autopostmate is built on a small number of services. Each sees only what it needs for its job. None of them is permitted to use what it sees for anything except doing that job for us.
| Service | Job | What it sees |
|---|---|---|
| Supabase | Sign-in, the database, and file storage | Everything listed under What we collect. Your uploads and rendered slides sit in private buckets served through short-lived links. |
| OpenRouter | Routes prompts to the language model that writes, fact-checks, plans and curates. The model in use is DeepSeek V4 Flash. | Your brief, the knowledge base records relevant to it, drafts, planner messages, and search results. Not your email, password or tokens. |
| Anthropic | Fallback model when the primary route is unavailable | The same as OpenRouter, only for runs that fall back. |
| Tavily | Web search for research and fact-checking | Search queries built from your topic and the claims being checked. Not the knowledge base itself. |
| LangSmith | Pipeline tracing | A trace of each run: the prompts sent, the outputs returned, timings and errors, keyed by request id. |
| Sentry | Error reporting for the app and the server | Error details, request ids, your account id, browser and IP address. |
| Publishing, when you connect an account | The caption and images of a post you send. LinkedIn also tells us your member id, name and email when you connect. | |
| Google Fonts | Typefaces on this site and the app | Your browser fetches font files from Google, which sees your IP address as with any web request. |
Web search results are handled as data, never as instructions. A page the fact-checker reads cannot tell the pipeline what to do with your records.
Each provider keeps what it processes for its own operational period under its own terms. None of them is permitted to use your content to train models on our behalf.
Other customers and our staff
Every record belongs to one business. The database enforces that boundary itself: a signed-in user can read and write only the rows of a business they are a member of, and that rule is applied by the database on every query, not just by the app. Nothing you put on file is visible to another customer, and no caption for one business is written from another's records.
Our staff can see two things: the usage and allowance of each business, and drafts you have flagged for review, frozen as they were when you flagged them. Staff can resolve or dismiss a flag and adjust an allowance. They cannot edit your copy or your slides; there is no control for it and no route that would do it. Every staff action is written to a log.
How long we keep it
- Your account, business and knowledge base
- For as long as the account exists. Deleted when you ask us to close the account.
- Runs, drafts, slides and review history
- Kept with the account, including rejected and failed runs. Removed with the account.
- Flagged drafts
- The frozen snapshot is kept with the flag until the account is deleted.
- LinkedIn connection
- Until you disconnect it in the app or the token expires. Disconnecting deletes the token at once.
- Fetched headlines
- A cache, refreshed on each pull and dropped when the source is unfollowed.
- Error reports and pipeline traces
- For a limited period at the providers, then deleted.
- Database backups
- Rolling backups kept for a short period. A deleted account falls out of backups on that schedule.
Your rights and how to use them
Most of what you might ask for you can do yourself, in the app, without asking.
- See and correct. Every record is on a form under Knowledge base, Calendar or Planner. Edit it there.
- Export. Any finished run can be downloaded as a ZIP of caption and slides. For a full export of everything under your account, write to us.
- Delete a record. Delete it on its form. Runs stay in history on purpose; to remove them, delete the account.
- Disconnect LinkedIn. Knowledge base, Connected accounts, Disconnect. The token is deleted at once.
- Delete the account. Write to us from the account's email address. We confirm, then delete the account, the business and everything under it, and tell you when it is done.
Depending on where you live you may have further rights, such as restricting or objecting to processing, data portability, or complaining to a data protection authority. Write to us first and we will answer.
Security
- Sign-in and sessions are handled by Supabase. Passwords are never stored by us.
- The database enforces ownership on every table, so a bug in the app cannot expose one business to another.
- Uploads and rendered slides live in private storage and are served through links that expire.
- Live progress streams use a short-lived token scoped to one run, never your session.
- Connected-account tokens are encrypted at rest.
- All traffic is over TLS.
No system is beyond breach. If one affects your data we will tell you without undue delay and tell the regulator where the law requires it.
Where data is processed
We are based in Pakistan. Some of the services listed under Models and services are operated from other countries, including the United States, so your data may be processed outside the country you live in. Each provider handles it under its own terms and the commitments in this policy.
Cookies and browser storage
This site sets no cookies and runs no analytics. It remembers which sample shop you picked in your browser's local storage, and nothing else.
The app keeps your session in browser storage so you stay signed in, and keeps in-progress drafts of forms locally so a refresh does not lose them. Those drafts never leave your device and are cleared when you save or discard. There are no advertising or tracking cookies.
Children
Autopostmate is for businesses and is not offered to anyone under 18. If you believe a child has created an account, write to us and we will delete it.
Changes to this policy
When we change something that matters, such as a new service touching your data or a new use for it, we will email the account address before it takes effect and change the date at the top of this page. Small wording fixes just change the date.
Contact
[email protected]
+92 312 4422229
Kaizen Global
Offices G-80, Greens, Diamond Mall & Residency
Gulberg Greens Block B, Gulberg
Islamabad 44000, Pakistan