Privacy policy

This policy applies to postdom.com, the Postdom web app (including the website preview you can run before signing up), Postdom APIs and MCP tools, lifecycle emails, and the support or commercial conversations connected with those services. Blue Venture Studios Pty Ltd operates Postdom and is responsible for personal information when it decides why and how that information is used.

A workspace customer may also control personal information placed into Postdom by its members, agents, or connected accounts. In that situation, the customer is responsible for its own notices, permissions, and lawful instructions, and Postdom handles the information to provide the service.

Social networks, payment services, and other third-party products have their own privacy practices when they act independently. This policy does not replace theirs.

The information depends on how you use Postdom. We collect what is needed to create and secure a workspace, read your website and write posts from it, carry out authorized publishing, return evidence, bill the workspace, and operate the service.

We receive information directly when you sign up, create or join a workspace, configure policy, submit content, choose a plan, change notification settings, or contact us. Workspace owners, administrators, members, and authorized agents may also provide information for the workspace.

When you give Postdom a website, before or after signing up, Postdom reads public pages from it, including blog articles, and follows the site's robots.txt. When you add or accept a competitor, Postdom reads that business's public website and receives recent public posts from its social accounts through ScrapeCreators. Video posts use stock footage found by searching Pexels and Pixabay.

We receive connected-account identifiers, publish outcomes, and available measurements through Zernio and the social networks you direct Postdom to use. Stripe returns subscription and usage events. Service infrastructure produces security, availability, and diagnostic records. Cookieless Ahrefs Web Analytics receives limited public-site usage data; it is the only analytics on the public website and it sets no cookie.

When you follow a sign-up link on the public website, the link carries the first postdom.com page you visited, the page you signed up from, the referring website's domain, and any campaign tags in the address. Postdom keeps these with your new account and workspace, together with any outreach link or Made with Postdom page that led to the sign-up.

• We do not buy consumer data lists.
• We do not run third-party advertising on Postdom.
• We do not use customer content to train a general-purpose AI model.

We use information only for the purposes below or for a compatible purpose that is reasonably expected and permitted by law. Where a law requires a legal basis, the basis depends on the activity.

Postdom shares information only as needed to provide a feature you requested, operate the service, meet a legal obligation, or complete a business transaction. The exact information sent depends on the feature. Providers may also handle limited account or technical data under their own terms when they act independently.

We may also disclose information if required by law or valid legal process, to investigate harm or misuse, with professional advisers under confidentiality, or as part of a merger, financing, reorganization, or sale subject to appropriate protections.

Postdom and its providers may process information in Australia, the United States, the European Economic Area, and other places where the relevant provider or social network operates. Zernio states that its operation and data processing are in Europe; other providers use regional or global infrastructure.

Privacy protections can differ between countries. Where required, we use contractual, technical, and organizational safeguards for international handling. A provider may also be legally required to disclose information in the country where it operates.

We keep information while a workspace is active and for as long as it is reasonably needed to deliver the service, maintain publishing and billing evidence, protect security, resolve disputes, and meet tax, accounting, or other legal obligations. Retention therefore varies by record type and context.

Material derived from uploaded media — transcripts, frame text, embeddings, the low-resolution copy, measured media properties, and per-publish result summaries — is kept while the workspace exists, and for 12 months after cancellation with an export offered first; the low-resolution copy is kept for 30 days on Free. It can be deleted at any time from your workspace settings, or by asking us by email. Metric values a platform reports are kept only as long as that platform's developer terms allow, and are then reduced to Postdom's own summaries. Media uploaded and never published expires after 14 days.

Website readings, the Brand Brain, posts, videos, and the preferences learned from your review decisions are kept while the workspace exists and are deleted with the workspace, subject to the backup and legal exceptions below. Competitor posts are kept for up to 90 days after they are fetched, and a competitor's posts and blog titles are deleted when you remove that competitor or the workspace is deleted. A website preview that is not kept by signing up is deleted after 7 days, and the hashed IP address and cookie hash recorded for any preview are deleted after 7 days.

Revoking a workspace key or OAuth grant stops future access but may leave hashed identifiers and audit evidence. Disconnecting a social account stops Postdom from using that connection; Zernio and the social network apply their own deletion and retention processes to information they control. Backups and immutable security or financial records may take longer to expire or may need to be kept by law.

You can request workspace or personal-data deletion through Contact. We will verify authority, then delete or de-identify information that is no longer required, while explaining any information we must retain.

Depending on where you live, you may have rights to access, correct, delete, restrict, or receive personal information, object to certain processing, or withdraw consent. You may also complain to a privacy regulator. These rights can be limited where another person's rights, legal privilege, security, fraud prevention, or a legal retention duty applies.

Start with the Contact page and identify the workspace and request. We may verify your identity and workspace authority before acting. We will respond within the period required by applicable law and explain if we cannot complete all or part of a request.

Workspace administrators can update many operational settings directly. The public website asks for no analytics consent because its only analytics, Ahrefs Web Analytics, sets no cookie and stores nothing in your browser; you can object to that measurement by contacting us. Withdrawing consent does not affect processing already carried out lawfully.

• For access or correction, describe the information and the correction you believe is needed.
• For deletion or portability, identify the workspace and whether the request covers membership, content, connected accounts, or the entire workspace.
• For a privacy complaint, describe what happened and the outcome you want. We will investigate and respond; if you remain dissatisfied, you may contact the OAIC in Australia or the relevant authority where you live.
• For activation and onboarding email, use the unsubscribe link included in every message; it works without signing in and applies immediately.

The public site sets no analytics or advertising cookies and shows no cookie banner. Its only analytics, Ahrefs Web Analytics, is cookieless: it stores nothing in your browser and discards raw IP addresses. A consent cookie set by this site before 23 September 2026 is no longer read and expires on its own within a year. The sign-up source described above travels in the sign-up link itself; the public site uses no cookie or browser storage for it.

The authenticated app uses cookies that are necessary to maintain the Supabase sign-in session and remember the selected Postdom workspace. Disabling necessary cookies can prevent sign-in or workspace functions from working.

If you sign up from a Made with Postdom page, the app sets a cookie that remembers which page it was for 30 days.

The website preview before sign-up sets one necessary cookie that links the preview to the browser that started it. It lasts up to 14 days and cannot be read by the page's scripts. The preview page also loads Cloudflare Turnstile, which checks that the visitor is a person and not an automated program. Turnstile collects browser and device signals for that check and is covered by Cloudflare's own privacy policy.

Postdom uses layered access controls, workspace scoping, hashed agent credentials and OAuth tokens, provider signature checks, private media storage, rate limits, and audit records. No online service can guarantee absolute security.

Keep sign-in links, agent keys, OAuth grants, and connected devices secure. Revoke access you no longer recognize and contact us promptly if you suspect misuse. For current reporting instructions and verified boundaries, use the Security page.

We may update this policy when the service, providers, or law changes. The date at the top shows the current version. If a change materially affects how existing account information is handled, we will provide additional notice through the service or email when appropriate before the change takes effect.

Use the Contact page for privacy questions, access or correction requests, deletion requests, and complaints. Please do not send passwords, agent keys, OAuth tokens, full payment-card numbers, or unnecessary sensitive information.