Privacy Policy

Data you give us directly:

• Account data: name, email address, password (stored encrypted, never as plain text), profile photo, and phone number if you add one.
• If you sign in with Google: your name, email address, and profile photo from your Google account.
• Business data: business name, logo, category, description, website, business phone number, brand colors, target audience, tone of voice, hashtags, products and product photos, avatars, knowledge documents, and the news sources (RSS) you follow.
• Content: the ideas or prompts you write, the images and captions created, post schedules, and posting history.
• Team members: the email addresses of people you invite to your business.
• Communication: messages you send to our support team through the website, email, or WhatsApp.

Data from services you connect:

• Social media accounts (Facebook Pages, Instagram professional accounts, LinkedIn): account or page name and ID, account profile photo, and the access token the platform issues so Postmatic can post with your permission.
• Payments: order number, product, token amount, total, payment method, Virtual Account number or payment code, and payment status. We do not store your card details. They are processed directly by Midtrans.
• Business website: if you use auto-fill from a website, we read the public pages of the website you enter and store a summary of the information.

Data recorded automatically:

• Technical and security data: IP address, device and browser type, access times, sign-in sessions, and a record of important account activity.
• Bot checks: our sign-in and sign-up pages use Cloudflare Turnstile to confirm that a real person is signing up.
• Referral program: referral codes you use or share, and how they are used.

• To run Postmatic's features, such as creating content that fits your business, saving schedules, and posting to the accounts you connect.
• To process payments, add tokens, and send invoices.
• To send important emails, such as account verification, password resets, team invitations, security alerts, and payment confirmations.
• To keep the service secure, for example by blocking suspicious sign-ins, spam, and abuse.
• To help you when you contact our support team.
• To improve and develop the service.
• To send Postmatic news or promotions. You can ask us to stop at any time.

We process data based on your consent, to perform our service agreement with you, to meet legal obligations, and for legitimate interests such as keeping the service secure.

We do not sell or rent your personal data. Data is only shared with partners that help us run the service, and only as much as they need:

• AI providers (OpenAI, Google Gemini, and other AI model providers we use): receive your prompts and the relevant business and product data to create images and text.
• Payment partner (Midtrans): receives your name, email, order details, and amount to process payments.
• Social media platforms you connect (Meta for Facebook and Instagram, and LinkedIn): receive the content you publish.
• Google: if you choose to sign in with your Google account.
• Storage and infrastructure: cloud services that store files and images, servers, and email services that deliver our messages.
• Customer support: the email and WhatsApp services we use to reply to you.
• Security: Cloudflare, for bot checks.
• Authorities: when required by law or an official order.

Some of our partners are located outside Indonesia, so your data may be processed abroad. We only work with partners that apply adequate data protection.

• All connections to Postmatic use HTTPS (encrypted).
• Passwords are stored using one-way encryption, so even we cannot see them.
• Access to data is limited to the team members who need it.
• When you disconnect a social media account, we delete its access token immediately.

Even so, no system is 100% secure. If a data breach affects you, we will notify you and the authorities as required by the PDP Law.

• Account and business data are kept while your account is active.
• After you ask us to delete your account, your data is deleted or anonymized as described on the Data Deletion page.
• Transaction records and invoices are kept for as long as tax and accounting rules require.
• Security records are kept for a limited time to prevent and investigate abuse.

Under the PDP Law, you have the right to:

• know about and get a copy of your personal data;
• correct data that is wrong or incomplete, and you can change most of it yourself in the app;
• ask us to delete your data;
• withdraw consent you have given;
• ask us to restrict or stop processing your data for certain purposes;
• object to how we process your data.

To use these rights, email team@postmatic.id from the email address registered with Postmatic. We may need to verify your identity first.

Postmatic has no minimum age. Under the PDP Law, signing up and processing the data of minors requires a parent's or guardian's consent. If we learn that a child's data was registered without that consent, we may ask the parent or guardian to confirm, or delete the data.

We use cookies and browser storage to keep you signed in and to remember your settings. See our Cookie Policy for details.

We may update this policy when our service or the rules change. The date of the last update is always shown at the top of this page. For important changes, we will let you know by email or in the app.