Privacy Policy
How PostAi handles your data, in plain English.
Last updated: October 24, 2026 · Effective: October 24, 2026
The short version
- No sign-up: PostAi works with an anonymous identifier. We don’t ask for your name, email or phone number.
- If you connect Instagram, we receive an access token (stored encrypted), your basic profile and the comments on your posts, and we use them only to run the rules you create.
- We never see your Instagram password and we don’t sell your personal data.
- Generated images stay on your device.
- You can disconnect Instagram or delete your data at any time. See Data deletion.
This Privacy Policy explains how Luhemusa Solutions ("we", "us") processes personal data when you use the PostAi mobile app for iOS and Android (the "App") and this website. It should be read together with our Terms of Service.
1. Who is responsible for your data
The data controller is Luhemusa Solutions, Panama City, Panama. Contact: [email protected].
For the personal data of people who comment on your Instagram posts, you (the account owner) decide which rules apply and what the replies say; we process that data on your behalf and only to run your automations.
2. What data we process and why
Your anonymous account, plan and quotas
Data: a Firebase anonymous user ID (and earlier IDs if you recover your account on a new device), an internal user ID, your plan (Free, Starter or Pro), trial status and expiry date, your post balance and the history of changes to it (for example rewarded videos, renewals and posts created), daily usage counters and timestamps.
Why: to run the App without a sign-up, apply your plan and quotas, and prevent abuse of the free plan.
Legal basis: performance of our contract with you (the Terms of Service); our legitimate interest in preventing fraud.
AI content generation
Data: the text you type into a template, the template, format and language you choose, and the generated text and image. When you use "Generate with AI" in a rule, the description and keywords you enter.
Why: to create your images, captions and hashtags and to draft reply texts for your rules. Requests are sent to OpenAI (text and content moderation) and Google Gemini (images). Our servers do not keep the text you type or the generated images after returning the result; images are saved only on your device.
Legal basis: performance of our contract with you.
Instagram comment automation (only if you connect an account)
Data: your Instagram account ID, username, profile picture URL and account type; the access token issued by Meta (stored encrypted) and its expiry date; the rules you create (name, keywords, selected post ID, its thumbnail URL and a short snippet of its caption, reply variants, DM text and counters); and, for comments on your posts that Meta sends us, the comment ID, post ID, comment text, the commenter’s Instagram username and ID, the time it was received and the result (reply or DM sent, skipped or failed).
Why: to apply your rules, post public replies and send private replies on your behalf, avoid answering the same comment twice, respect Meta’s rate limits, show you the activity log and alert you when a connection needs attention.
Legal basis: performance of our contract with you. For people who comment on your posts: the legitimate interest (yours and ours) in answering comments addressed to your account; their data is used only for that purpose.
Rewarded videos and advertising (Free plan)
Data: the device advertising identifier (Google Advertising ID, or IDFA on iOS when you allow tracking), device and app information, IP address and approximate location derived from it, and ad interactions. For rewarded videos, a signed confirmation sent by Google AdMob to our servers with your PostAi user ID and a transaction ID.
Why: to show ads to Free users, measure them, and check that a rewarded video was completed before unlocking a post.
Legal basis: your consent where required by law (for example for personalized ads in the EEA, UK and Switzerland); otherwise our legitimate interest in funding the free plan.
Subscriptions
Data: your PostAi user ID, the products you buy, subscription and trial status, renewal and expiry dates, store transaction identifiers, country and currency. We never receive your payment card details.
Why: to validate purchases with Apple and Google (through RevenueCat), activate your plan and refill your monthly posts.
Legal basis: performance of our contract with you.
Security, moderation and abuse prevention
Data: app integrity attestations (Firebase App Check), IP address and request details in server logs, rate-limit counters, and the reply and DM texts you save, which are checked with OpenAI’s moderation service.
Why: to protect PostAi, our users and Instagram users from spam, fraud and prohibited content.
Legal basis: our legitimate interest in keeping the service secure.
Analytics, crash reports and remote configuration
Data: app instance ID, usage events (for example screens and features used), device model, operating system, app version, crash traces and approximate location.
Why: to understand how the App is used, fix errors and adjust settings without publishing a new version.
Legal basis: our legitimate interest in improving the App; your consent where required by law.
Push notifications
Data: your device push token (Firebase Cloud Messaging).
Why: to alert you about your automations, for example when an Instagram connection expires and needs to be reconnected. You can turn notifications off in your device settings.
Legal basis: performance of our contract with you.
Support and content reports
Data: your email address and message when you contact us; the reported content, the reason and your PostAi user ID when you report a generated result.
Why: to answer your requests and review reported content.
Legal basis: our legitimate interest in providing support and keeping content safe.
3. Instagram data and the Meta Platform
PostAi connects to Instagram through Meta’s official "Instagram API with Instagram Login". You log in on Instagram’s own screen and choose to grant these permissions:
- instagram_business_basic: read your profile (account ID, username, profile picture) and your posts, so you can pick a post for a rule.
- instagram_business_manage_comments: receive the comments on your posts and reply to them.
- instagram_business_manage_messages: send one private reply (DM) to the person who commented, as Meta allows.
How we treat this data:
- We never receive or store your Instagram password.
- Access tokens are encrypted at rest with AES-256-GCM, never shown in the App or written to logs, refreshed automatically before they expire and deleted when you disconnect.
- Comments are processed only to apply your rules and show you the activity log. They are not sent to AI providers, not used for advertising or profiling, and not used to train AI models.
- Activity log entries (comment text and the commenter’s username and ID) are deleted after 30 days.
- We do not sell, license or share Instagram data with data brokers or advertisers, and we use it only as described here, in line with the Meta Platform Terms and Developer Policies.
You can revoke access at any time:
- In the App: Automate tab › your account › Disconnect. This deletes the account’s token, rules and activity log.
- In Instagram: Settings › Website permissions (or Apps and websites) › PostAi › Remove. Meta notifies us, and we stop processing comments and delete the token immediately.
- If you send a data deletion request through Meta, we delete the connected account’s data immediately and give you a confirmation code that you can check on our Data deletion page.
4. Anonymous identity and account recovery
When you first open the App, Firebase creates an anonymous identifier. There is no password and no email to remember. If you reinstall the App or move to a new phone, you can recover your plan and automations with Profile › Recover my account: you connect the same Instagram account and we link it to your new anonymous identifier. If you never connected Instagram, we cannot identify your old account, but you can still restore an active subscription with "Restore purchases" using the same App Store or Google Play account.
5. Where your data is stored and who helps us
Our API and our PostgreSQL database run on our own infrastructure hosted on Oracle Cloud. We rely on the following providers (subprocessors), each bound by its own terms and privacy policy:
| Provider | What for | Location |
|---|---|---|
| Oracle Corporation (Oracle Cloud Infrastructure) | Hosting of our API servers and PostgreSQL database, on infrastructure we manage ourselves with Dokploy | Data center region selected by the Owner |
| Meta Platforms, Inc. / Meta Platforms Ireland Ltd. | Instagram API: connection of your account, comments, public replies and private replies | United States / Ireland |
| OpenAI, L.L.C. | Text generation (captions, hashtags, reply drafts) and content moderation | United States |
| Google LLC (Gemini API) | Image generation | United States |
| Google LLC (AdMob) | Ads in the Free plan and verification of rewarded videos | United States |
| RevenueCat, Inc. | Subscription management and purchase validation | United States |
| Google LLC (Firebase) | Anonymous authentication, App Check, Analytics, Crashlytics, Remote Config and Cloud Messaging | United States |
| Cloudflare, Inc. | CDN, DNS and protection of this website and our API | Global network |
Payments are processed by Apple (App Store) and Google (Google Play) as independent controllers under their own privacy policies.
6. International transfers
We and our providers process data in the United States and other countries that may not offer the same level of protection as your own. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or the provider’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.
7. How long we keep data
| Data | Retention |
|---|---|
| Anonymous account, plan, post balance and its history | While you use PostAi. Deleted when you ask us to delete your data, except minimal records we must keep to prevent fraud or comply with the law. |
| Instagram connection (account ID, username, profile picture URL, encrypted access token) | Until you disconnect the account in the App or request deletion. If you remove PostAi from Instagram, the token is deleted immediately. Accounts paused because of your plan keep their token for up to 30 days and are then disconnected. |
| Automation rules | Until you delete them, disconnect the account in the App or request deletion. |
| Activity log (comment text, commenter username and ID, result) | 30 days, then deleted automatically. |
| Rate-limit counters | 2 days. |
| Server logs | A limited period, for security and troubleshooting. |
| Generated images and history | Only on your device, until you delete them or uninstall the App. |
| Text sent to AI providers | Not stored on our servers. OpenAI and Google process it under their API data retention terms. |
| Support emails | As long as needed to handle your request. |
| Data held by Apple, Google, RevenueCat and Meta | According to their own privacy policies. |
8. Your rights
Depending on where you live, you have the following rights over your personal data:
- Access: know whether we process your data and get a copy.
- Rectification: ask us to correct inaccurate data.
- Erasure: ask us to delete your data.
- Restriction: ask us to limit how we use your data.
- Portability: receive your data in a structured, machine-readable format.
- Objection: object to processing based on our legitimate interests, and to direct marketing at any time.
- Withdraw consent at any time, without affecting processing that took place before.
- Complain to your data protection authority.
California residents have the right to know, delete and correct their personal information and to opt out of its "sale" or "sharing". We do not sell personal information. Personalized ads shown through Google AdMob may be considered "sharing" for cross-context behavioral advertising; you can opt out by deleting or resetting your advertising ID (Android) or not allowing tracking (iOS) in your device settings, or by subscribing to a plan without ads. We will not discriminate against you for exercising your rights.
To exercise your rights, use Profile › Delete my data in the App or email [email protected]. Because PostAi has no traditional login, we may ask you to confirm that you own the Instagram account or the device concerned. We answer within one month (GDPR) or 45 days (CCPA).
9. Children
PostAi is not directed to children under 13, or under 16 in the European Economic Area and the United Kingdom (or the minimum age of digital consent in your country). Instagram also requires its users to be at least 13. We do not knowingly collect personal data from children. If you believe a child has used the App, contact us and we will delete the data.
10. Ads and personalization
Only the Free plan shows ads; Starter and Pro subscribers don’t see ads. Ads are served by Google AdMob, which may use your advertising identifier to personalize them depending on your choices and the law where you live. Where required (for example in the EEA, UK and Switzerland), we ask for your consent before showing personalized ads, and on iOS we ask for permission before using the IDFA. You can change these choices in the App or in your device settings.
11. Security
- Encrypted connections (HTTPS/TLS) between the App, our servers and our providers.
- Instagram access tokens encrypted at rest with AES-256-GCM, with encryption keys kept outside the database.
- Verification of the signatures and secrets on incoming webhooks from Meta, Google and RevenueCat.
- Firebase App Check to block requests that don’t come from the genuine App.
- Access to production systems limited to the Owner on a need-to-know basis.
No system is completely secure, but we work to protect your data and will notify you and the authorities of a personal data breach where the law requires it.
12. Deleting your data
You can delete your data in the App (Profile › Delete my data), by removing PostAi from your Instagram settings, or by emailing us. Step-by-step instructions are on our Data deletion page.
13. This website
This website is a static site. It does not use cookies, analytics or advertising trackers. Our hosting and CDN provider (Cloudflare) processes your IP address and basic request data to deliver the pages and protect them from attacks.
14. Changes to this policy
We may update this policy when the App changes or the law requires it. We will publish the new version on this page with a new date and, for important changes, let you know in the App.
15. Contact
Luhemusa Solutions, Panama City, Panama. Email: [email protected].