PostEaseWho is responsible for your data
Wha-in C&B Inc. (주식회사 화인씨엔비), 301, Hongik Building 2, 190 Donggyo-ro, Mapo-gu, Seoul, Republic of Korea, provides PostEase and is the controller of the personal data described here.
Questions and requests about your data go to jaesonohyx@gmail.com.
What we collect
PostEase collects the information needed to schedule and publish posts on your behalf, and nothing beyond that.
- Account email and password, handled by our authentication provider (Supabase Auth).
- Access tokens for each social channel you connect (YouTube, X, LinkedIn, Pinterest, Instagram, TikTok, Bluesky, and others as they become available), encrypted at rest and used only to publish the posts you schedule.
- The photos and videos you upload to attach to a post, stored in Cloudflare R2.
- Your recent posts on connected accounts and the numbers each platform reports for them (likes and comments, and where the platform allows it, views, saves, shares and reach), read to show how your posts did and to suggest what to post next.
- What you write about your brand in the app (a brand brief, facts and announcements), and the ideas you save, plan or dismiss.
- Billing information when you subscribe to a paid plan, collected and processed by Paddle.com, which sells our plans as Merchant of Record. We receive your name, email, country and what you bought, never your card details.
- Basic technical information (error reports, browser/device type) collected automatically when something goes wrong, to help us fix it.
How we use it
Connected-channel tokens are used to publish the posts you create and schedule, to read the reply/comment activity shown in your inbox where that platform supports it, and to read your own recent posts and their numbers for the Performance and Ideas pages. We do not use your connected accounts for anything you have not asked the app to do.
When you ask for post ideas, or turn on the agent to write posts for you, the parts of your account that the writing needs (your brand brief and facts, your recent posts and their numbers, and recent comments and messages people sent you) are sent to the AI model provider that writes them. They are sent only to produce what you asked for, and only when you ask or the agent you turned on runs.
Uploaded media is used to deliver your scheduled posts to the platforms you choose to publish to.
Each video you upload is also sent to a speech-to-text provider, which writes down what is said in it, so the post can show its transcript and the Performance page can compare how your videos are spoken. The provider receives a link to the video that expires after three hours, and is sent nothing else.
How long we keep it
Account and post data is kept for as long as your account exists. Uploaded media is kept so that a published post can be recycled later without re-uploading, and is not automatically deleted when an individual post is removed.
Deleting your account, or a workspace you own, deletes everything tied to it, including stored media for that workspace.
How to have your data deleted
You can delete your account, or any workspace you own, at any time from Settings inside the app.
Who processes your data, and where
Personal data reaches these providers over encrypted connections while the product runs for you. Several are outside the country you live in.
You can refuse any of this. Do not connect an account, do not ask for ideas or turn on the agent, or write to us at the address above. Refusing the AI provider means ideas, transcripts and the agent cannot run, while publishing and your numbers keep working.
- Supabase (Supabase Inc.), Australia (Sydney). Receives: Everything the app stores: your account, workspaces, posts, connected-account tokens (encrypted), and the numbers each platform reports. Kept: For as long as your account exists.
- Cloudflare (Cloudflare, Inc.), United States, serving requests from its network worldwide. Receives: Every request to the app, and the photos and videos you upload, which are stored in Cloudflare R2. Kept: Uploaded files until you delete them or the workspace; request logs for a few days.
- Qwen Cloud (Alibaba Cloud (Singapore) Pte. Ltd.), Singapore. Receives: What an AI request needs, only when you ask for ideas, turn on the agent, or upload a video: your brand brief and facts, recent posts and their numbers, recent comments and messages, and for transcripts a link to the video that expires after three hours. Kept: Up to 30 days. Not used to train models without separate consent.
- Twelve Labs (Twelve Labs, Inc.), United States. Receives: Only when the workspace owner allows video breakdowns: a link to each video that expires after three hours, and its first spoken words, so the model can describe its opening, visuals and editing. Kept: Our account is set so Twelve Labs does not train on your videos. Twelve Labs does not publish how long it keeps what it receives.
- Resend (Resend, Inc.), United States. Receives: Your email address and the emails we send you: sign-in links, notices about your posts and the weekly recap. Kept: As Resend keeps delivery records, then deleted.
- Sentry (Functional Software, Inc.), The United States or Germany, the region set for our account. Receives: Error reports when something goes wrong, with personal details removed before they are sent. Kept: 90 days.
- Paddle (Paddle.com Market Ltd), United Kingdom. Receives: What you buy and your payment details, as the Merchant of Record that sells our plans. Paddle is responsible for this data itself. Kept: As Paddle's own privacy policy says.
What we learn across accounts
From Instagram and TikTok accounts, PostEase learns which things a post does, such as captions on screen or a carousel of text, tend to go with more reach on that platform. These are kept only as numbers per platform, and only when at least 20 workspaces contribute. They help each account’s own predictions.
No account’s posts, numbers or files are shown to another account, and YouTube data is never used.
Your rights and how we protect it
You can ask to see, correct, export or delete your personal data, or object to how we use it, by writing to jaesonohyx@gmail.com. We answer within 30 days. You can also complain to the data protection authority where you live.
Connection tokens are encrypted at rest, every connection to the service is encrypted in transit, and each workspace can read only its own data.
Third-party platforms
Connecting a social platform to PostEase is also subject to that platform's own privacy policy. Disconnecting a channel inside PostEase revokes its token where the platform supports revocation, but does not delete anything on the platform's own side.