Privacy Policy
Effective October 25, 2026 — supersedes the policy dated September 24, 2026
Who is responsible: HAS, operating as PostForge, 4551 Zimmerman Ave, Niagara Falls, ON L2E 3M5, Canada ("PostForge," "we," "our," "us") is the controller (and, under PIPEDA, the organisation accountable) for the personal information described here. Privacy questions and requests: privacy@thepostforge.ai — Attention: Privacy Officer. Our subprocessors are listed at thepostforge.ai/subprocessors.
1. What this policy covers
This policy explains how we collect, use, disclose, transfer, and retain personal information when you use thepostforge.ai and the PostForge app (the "Service"), including when you connect a LinkedIn account and when we publish posts on your behalf. It applies to our website visitors, trial users, and subscribers. Where we say "you," we mean the individual whose information we process — usually the person who connected the account.
2. Information we collect
2.1 Information you give us
| Category | Examples |
|---|---|
| Account and identity | Name, email address, internal account ID, and the information LinkedIn returns when you authorize us (name, email, profile identifier and URL). We never receive your LinkedIn password. |
| Content and preferences | Topics you configure, schedule and timezone, prompts and instructions, drafts and edits, approvals, published posts, article URLs, and run history. |
| Writing voice | Writing samples you paste or approve for voice profiles, and the style attributes derived from them. |
| Expertise profile | A resume, bio or personal page you point us at, and the summary and lists derived from it, until you confirm or replace them. The file you upload is parsed and discarded, and the text it was read from is not kept. |
| Images | Images you upload for a post, and the visual prompts used to generate images. |
| Communications | Messages you send through our contact form or by email, and our replies. |
2.2 Information we get from LinkedIn
When you connect LinkedIn, LinkedIn authenticates you and gives us an OAuth access token
and (where issued) a refresh token, the permissions you granted, and the basic profile
fields shown on the authorization screen. We request openid, profile, email, and
w_member_social (publish posts as you) — we do not request access to your
connections, messages, or groups, and we do not scrape LinkedIn. See section 7 for what we
store and how to remove it.
2.3 Information collected automatically
| Category | Examples |
|---|---|
| Technical and security | IP address, browser type and version, device information, timestamps, and authentication events — used for session management, rate limiting, fraud and abuse prevention. |
| Usage | Pages visited, features used, actions taken in the app, and error and diagnostic events. |
| Analytics | Product analytics events, and — only if you accept analytics — cookies and browser storage set by our analytics provider. See section 9. |
| Payments | Plan, subscription and transaction identifiers, amount, currency, status, and renewal or cancellation state returned to us by PayPal. We never receive your full card number. |
2.4 Inferences
Relevance scores for discovered articles, and your topic and voice profiles.
3. How and why we use information, and our legal bases
For individuals in the EEA, UK, or Switzerland, the table below states the legal basis we rely on under the GDPR/UK GDPR. Everyone benefits from the commitments in it regardless of where they live.
| Purpose | Legal basis | Notes |
|---|---|---|
| Create and administer your account | Performance of a contract | Providing an email address is optional but required for account notifications and for us to answer a rights request. |
| Connect LinkedIn and publish the posts you approve | Performance of a contract | Authorizing us through LinkedIn is the platform permission we need to act; it is not itself the GDPR legal basis. |
| Discover, score, draft, schedule and store your content | Performance of a contract | Includes sending the inputs described in section 6 to our AI providers. |
| Process subscriptions and keep transaction records | Performance of a contract; legal obligation for tax and accounting records | PayPal processes the payment and returns limited subscription metadata to us. |
| Secure the Service, prevent abuse, diagnose failures | Legitimate interests | Interest: keeping the Service available and preventing misuse of our infrastructure and of LinkedIn's APIs. Data is limited to what security monitoring needs. |
| Product analytics (which features are used, where users get stuck) | Legitimate interests for our own pseudonymous, server-side event counts; consent for browser analytics and cookies | Server-side events identify an account by its internal ID, not by name or email. Nothing is collected in your browser until you accept (section 9). |
| Service and account email (verification, publishing results, billing) | Performance of a contract; legitimate interests | These are sent regardless of your marketing preference. |
| Tips, reminders and re-engagement email | Consent or legitimate interests depending on your jurisdiction | Every such email carries a one-click unsubscribe that works without signing in; you can also switch them off in Settings. |
| Product update email (occasional news about new features in the service you already use) | Legitimate interests (existing customers) | Informational only — not promotional. Every such email carries a one-click unsubscribe that works without signing in; you can also switch them off in Settings. |
| Answering privacy requests, disputes and legal compliance | Legal obligation; legitimate interests | We keep the minimum records needed to show we answered. |
We do not use your information to make solely automated decisions that produce legal or similarly significant effects. Drafts and image generations are automated, but nothing is published without your configured approval (automatic publishing is off by default and must be switched on by you), and you can review, edit, or discard any draft.
4. Who we share information with
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We disclose it only as follows.
- Processors acting on our instructions — listed with their locations at thepostforge.ai/subprocessors. In short: DigitalOcean (hosting and database), Resend (sending our email), OpenRouter and Cerebras (AI text models), SubQ (claim checks), Parallel (article search), PostHog (product analytics), and PayPal (payments). Each is bound by its data processing terms, and we use standard contractual clauses or an equivalent safeguard where a transfer need them.
- Independent controllers — LinkedIn, for its own platform, and PayPal, for payment services. They determine their own purposes for that processing and are governed by their own privacy notices. We cannot act on their behalf.
- Apps you connect yourself — if you authorize an assistant or other client through MCP access, with a pasted token or an OAuth connection, that app acts as you: it can read your topics, sources and drafts and create or approve posts, and what it asks for is returned to it. It acts on your authorization, not on our instructions, so it is not one of our processors. Revoke it at any time under Settings, MCP access.
- Legal and corporate — regulators, law enforcement, courts, or professional advisers where we are legally required or need to establish or defend a legal claim; and a buyer or successor in a genuine merger, acquisition, or sale of assets, under confidentiality.
5. International transfers
PostForge is operated from Canada. Our application, database and backups are hosted in Toronto, Ontario, Canada. The providers listed above process data in the United States (Resend, OpenRouter, Cerebras, SubQ, Parallel, PostHog, PayPal) and in Canada (DigitalOcean). When you connect LinkedIn and approve a post, the content you publish is sent to LinkedIn in your own name, wherever LinkedIn processes it.
Because your information may be processed outside your country, it may be accessible to foreign courts, law enforcement, or national-security authorities under the laws of those countries. For transfers out of the EEA/UK, we rely on the providers' standard contractual clauses (and the UK addendum or IDTA where applicable), plus each provider's own GDPR commitments. You can ask us for more detail about the safeguards for any named provider by emailing privacy@thepostforge.ai.
6. AI processing in detail
PostForge is an AI product, so here is exactly what leaves our systems and what we send to AI providers. We designed the pipeline not to send credentials or account identifiers to AI providers:
| Workflow | What is sent | Provider |
|---|---|---|
| Article discovery | Your topic keywords and search queries derived from them. No account identifiers. | Parallel (US) |
| Article relevance scoring | Your topic keywords, and the titles and snippets of publicly available articles. | OpenRouter (US), paid endpoints only |
| Drafting and re-drafting | The source article text, your topics and instructions, target word count, any signature you configure, your draft text when a post is refined, and — if you use a custom writing voice — the writing samples attached to that profile. | Cerebras or OpenRouter (US), with automatic fallback between models |
| Voice-profile analysis | The writing samples you pasted or approved, analysed to extract style attributes. | Cerebras or OpenRouter (US) |
| Expertise profile reading | The resume, bio or page text you provide, read once so the summary and lists can be extracted. A file you upload is parsed on our own servers and then discarded. | Cerebras or OpenRouter (US) |
| Claim checks | The draft text and the selected source article text. | SubQ (US), paid API endpoint |
| Image generation | The visual prompt derived from the post (composition, mood, theme). No account identifiers. | OpenRouter image models (US); generated images carry an AI-generated metadata marker |
What is never sent to AI providers: your LinkedIn access or refresh tokens, your LinkedIn connections, messages or groups, your email address, your IP address, and your password (which we never hold).
Training. We do not use your content to train our own models. Where a provider offers controls for prompt logging or training, we keep them off — OpenRouter's prompt logging and input/output use are both disabled on our account. Cerebras states that API requests are never used to train models. SubQ (Subquadratic) states that API content is not used to train or improve its foundational models. Every model in our pipeline runs through a paid API endpoint: we do not use free-tier model endpoints, which are commonly offered in exchange for the provider capturing prompts.
Provider retention. Our AI providers may keep request metadata (timestamps, token counts, latency) for their own reporting; prompts and completions are not retained by us at the provider unless the fallback above applies. SubQ retains API content for no more than 60 days, unless zero data retention is enabled on our account. Drafts, images and run history that we store are kept per section 8. You can avoid entering confidential or third-party personal information into topics, prompts, or pasted samples — anything you put there is processed by the providers above.
7. LinkedIn data and your control over it
We store the OAuth tokens LinkedIn issues, your profile identifier and URL, and the posts we publish for you, so the Service can keep working between visits. You stay in control:
- Disconnect in PostForge (Settings → Emails and data → Disconnect LinkedIn): we call LinkedIn's revocation endpoint and then delete the stored tokens, so nothing can be published until you reconnect.
- Revoke at LinkedIn at any time in your LinkedIn settings, which stops any future use of the token.
- Delete your account (Settings → Emails and data → Delete my account): we revoke the grant and delete your account data immediately in our active systems.
-
Delete your LinkedIn account: LinkedIn notifies us through our member
data-deletion endpoint (
/auth/linkedin/data-deletion) and we erase the associated data and return a confirmation code.
Published posts are a special case: once a post is live on LinkedIn, deleting it is a LinkedIn action, not ours. Removing a post from our records does not remove it from LinkedIn — use LinkedIn's own delete option for that.
8. How long we keep information
| Data | Retention |
|---|---|
| Account, topics, voice profiles, configuration | While your account is active, then deleted on account deletion. |
| LinkedIn OAuth tokens and profile fields | While connected; deleted (and revoked) on disconnect or account deletion. |
| MCP access tokens and connector grants | While the token is valid and not revoked; revoking stops it immediately. A token a connected app obtains expires within an hour and is replaced while the app stays connected; the connection lapses after 90 days unused. |
| Published posts and the runs that produced them | While your account is active. |
| Runs, drafts and discovery results that produced no published post | 24 months. |
| Discovered-article cache | 30 days. |
| Email delivery records | 12 months. |
| Contact-form and support requests | 24 months after your last message. |
| Cost and usage records | Aggregated totals kept for cost reporting; de-identified (no longer linked to your account) after 24 months. |
| Payment and tax records | Kept as long as tax and accounting law requires. PayPal keeps its own records under its own policy. |
| Backups | Weekly backups of the server, retained for four weeks. Deleted data is removed from active systems immediately and is re-deleted if a backup is ever restored. A database dump is also taken before any schema change and kept until five newer ones exist. |
We may keep records longer where we must by law, or for the minimum needed to resolve a dispute or a security incident — and we delete them as soon as that reason ends.
9. Cookies, browser storage and analytics
We set one essential cookie and, if you accept analytics, our analytics provider sets cookies. Nothing non-essential is set before you accept, and you can change your choice at any time in Settings → Emails and data.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
session | Cookie (essential) | Keeps you signed in and protects requests from CSRF; also carries the short-lived LinkedIn OAuth state during sign-in. | Session / rolling |
pf_analytics_consent | localStorage (essential) | Remembers your analytics choice so we do not ask again. | Until you change it |
guided_tour_completed, guided_tour_banner_dismissed | localStorage (essential) | Remembers that you finished or dismissed the product tour. | Until you clear browser storage |
ph_* | Cookie / localStorage (non-essential) | PostHog analytics: distinct ID, session state, and capture settings. | Up to 12 months (PostHog default) |
| PayPal cookies | Third-party (during checkout) | Set by PayPal on its own pages when you approve or manage a subscription; governed by PayPal's privacy notice. | Per PayPal's policy |
Analytics is opt-in and reversible. We do not use advertising cookies, we do not track you across other sites, and we do not copy the text you select or copy in the app.
10. Security
We protect information with: TLS in transit; a database that is not publicly reachable; access limited to the operator; signed, HttpOnly session cookies; per-tenant isolation in every query; rate limiting on authentication and contact endpoints; and vendor review before a provider is adopted. No method of transmission or storage is completely secure, and we cannot guarantee absolute security — but if a breach affects you, we will notify you and the relevant authority when the law requires it.
11. Your rights and how to use them
Depending on where you live, you may have the rights below. We offer access, correction, deletion, and portability to everyone, whatever your jurisdiction.
- Access and portability — download a machine-readable copy of your account, content, schedule and settings from Settings → Emails and data → Download my data.
- Correction — edit your email, topics, schedule and preferences in the app at any time.
- Deletion — delete your account and its data yourself from Settings → Emails and data → Delete my account; deletion is immediate in our active systems and revokes the LinkedIn grant.
- Restriction, objection and withdrawal of consent — turn analytics off in Settings, switch off tips and reminders, disconnect LinkedIn, or email us and we will restrict or stop the processing you object to.
- Complaints — you can complain to your local supervisory authority: the Office of the Privacy Commissioner of Canada (priv.gc.ca), the UK Information Commissioner's Office (ico.org.uk), or your EEA supervisory authority. We would rather you came to us first.
How to make a request. Email privacy@thepostforge.ai or use our contact form (choose "Privacy / Data Request"). We may ask for information to confirm it is really you — no more than we need, and we will not ask for government ID unless a specific law requires it. An authorized agent may submit a request on your behalf with your written permission. We answer within the statutory window: 30 days under PIPEDA, one month under the GDPR/UK GDPR (extendable by two months for complex requests, and we will tell you if that happens), and 45 days under the CCPA/CPRA (extendable to 90 with notice). If we refuse a request we will explain why, tell you how to appeal the decision, and note that you may escalate to your supervisory authority or the relevant attorney general. We will not discriminate against you for exercising these rights.
Different actions, different places. Deleting a published post is done on LinkedIn. Cancelling a subscription is done here in the app (Settings → Subscription & billing) or in PayPal. Unsubscribing from tips and reminders, or from product-update email, is done with the link in the relevant email or in Settings → Emails and data. Deleting your PostForge account is done there too.
12. California, Virginia and similar US state rights
In the past 12 months we have collected the categories in section 2 (identifiers and account data, commercial and transaction data, internet activity and usage data, and inferences) from you and from LinkedIn and PayPal, for the purposes in section 3, and disclosed them to the processors and controllers in section 4. We have not sold personal information and have not shared it for cross-context behavioural advertising, and we do not knowingly sell or share the personal information of consumers under 16. We do not use or disclose sensitive personal information to infer characteristics about you. California residents may request to know, delete, or correct personal information, and may use an authorized agent; Virginia residents may appeal a refusal as described in section 11.
13. Children
The Service is not directed to anyone under 16, and we do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.
14. Changes to this policy
We may update this policy to reflect changes to the Service, our providers, or the law. We will publish the revised policy with a new effective date and give prominent notice of material changes — by email to the address on your account and by notice in the app — before the change takes effect. Where the law requires your consent for a new purpose, we will ask for it rather than assume it. Continued use after a change that does not affect your rights means you accept the updated policy.
15. Contact
HAS, operating as PostForge
4551 Zimmerman Ave, Niagara Falls, ON L2E 3M5, Canada
Attention: Privacy Officer
privacy@thepostforge.ai —
or use our contact form.