Privacy Policy

1. Overview

Social Posting Engine ("we," "us," or "our"), based in New Zealand, operates socialpostingengine.com and the Social Posting Engine service. This Privacy Policy explains what information we collect, how we use it, and the choices you have regarding your data. We handle personal information in accordance with the New Zealand Privacy Act 2020.

By using our Service, you agree to the collection and use of information in accordance with this policy. We are committed to protecting your privacy and handling your data with care and transparency.

2. Information We Collect

We collect the following categories of information:

Account information: Your name, email address, and password when you register for an account.
Billing information: Payment details processed securely through our payment provider (Stripe). We do not store your full card number or CVV on our servers.
Content you create: Posts, captions, media, and scheduling information you enter into the Service.
Social platform credentials: OAuth tokens or encrypted API keys for the social media accounts you connect. See Section 6 for how we handle these.
Usage data: Information about how you interact with the Service, including pages visited, features used, and actions taken within the dashboard.
Device and log data: IP address, browser type, operating system, referring URLs, and timestamps collected automatically when you access the Service.

3. How We Use Your Information

We use the information we collect to:

Provide, operate, and improve the Service.
Process payments and manage your subscription.
Publish posts to connected social media platforms on your behalf and at your direction.
Send transactional emails such as receipts, password resets, and service notifications.
Respond to your support requests and communicate with you about your account.
Monitor and analyse usage patterns to improve performance and user experience.
Detect and prevent fraud, abuse, and security incidents.
Comply with legal obligations.

We do not sell your personal data to third parties. We do not use your content to train AI models.

We share your information only in the following circumstances:

Service providers: Trusted third-party vendors who assist us in operating the Service, such as our cloud hosting provider, payment processor (Stripe), and email delivery service. These providers are contractually required to protect your data and use it only to provide services to us.
Social media platforms: When you schedule or publish a post, we transmit that content to the relevant platform's API on your behalf.
Legal requirements: If required to do so by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Social Posting Engine, our users, or the public.
Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your data is subject to a different privacy policy.

Some of our service providers (including Stripe, Supabase, and Railway) are located outside New Zealand, so your personal information may be stored or processed overseas, including in the United States. Where we disclose personal information to an overseas provider, we take reasonable steps to ensure it is protected by safeguards comparable to those under the New Zealand Privacy Act 2020, as required by Information Privacy Principle 12.

5. Data Storage and Security

Your data is stored on secure cloud infrastructure. We implement industry-standard security measures including encryption in transit (TLS) and encryption at rest for sensitive data.

While we take reasonable steps to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security. If a privacy breach occurs that we believe is likely to cause you serious harm, we will notify you and the Office of the Privacy Commissioner as required by the Privacy Act 2020.

6. Social Account Credentials

Connecting a social media account to the Service may involve storing OAuth access tokens or API credentials. We treat these with the highest level of care:

All credentials are encrypted at rest using AES-256-GCM authenticated encryption before being stored.
Credentials are never stored in plaintext and are never visible to our staff in unencrypted form.
We use OAuth wherever platforms support it, which means we never receive or store your social media password.
Access tokens are used exclusively to perform actions you explicitly authorise within the Service.
You can revoke our access to any connected account at any time from within the Service or directly through the relevant platform's settings.

7. Cookies and Tracking

We use cookies and similar tracking technologies to maintain your session, remember your preferences, and understand how you use the Service. Cookies we use include:

Essential cookies: Required for the Service to function, such as session authentication tokens.
Analytics cookies: Help us understand how users interact with the Service so we can improve it. Analytics data is aggregated and not tied to individual identity.

We also count page views on this website and in the dashboard with Umami, which runs on a server we rent and manage ourselves rather than on an analytics company's. It records the page you opened, the site that sent you here, your browser, device and screen size, your language, and roughly where you are, down to the city. It sets no cookie and stores nothing in your browser. Your IP address is used to work out that location and to tell one visit from another, and it is not saved. Page addresses are recorded without anything after a question mark or a hash.

You can control cookie behaviour through your browser settings. Disabling essential cookies may affect the functionality of the Service.

8. Data Retention

We retain your account information and content for as long as your account is active or as needed to provide the Service. If you close your account, we will delete or anonymise your personal data within 90 days, except where we are required to retain it for legal or compliance reasons.

Aggregated, anonymised usage data that cannot be tied to any individual may be retained indefinitely for analytical purposes.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you.
Correction: Request that we correct inaccurate or incomplete data.
Deletion: Request that we delete your personal data, subject to our legal obligations.
Portability: Request that we provide your data in a structured, machine-readable format.
Objection: Object to certain types of processing, including direct marketing.
Withdrawal of consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at privacy@socialpostingengine.com. We will respond within 30 days.

10. Third-Party Services

The Service integrates with third-party platforms and services. When you connect to or interact with these platforms, their own privacy policies govern the handling of your data. We encourage you to review the privacy policies of any third-party services you use in connection with Social Posting Engine.

Our key third-party service providers include:

Stripe - Payment processing
Supabase - Database and authentication infrastructure
Railway - Cloud hosting and deployment

11. Children's Privacy

The Service is intended for adults aged 18 and over and is not directed at children. We do not knowingly collect personal information from anyone under 16. If we become aware that a child under 16 has provided us with personal information, we will take steps to delete it promptly. If you believe a child has provided us with personal data, please contact us at privacy@socialpostingengine.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will notify you by email or by displaying a prominent notice within the Service. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

13. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us at:

privacy@socialpostingengine.com

Social Posting Engine is the agency responsible for handling your personal information under the Privacy Act 2020. If you are not satisfied with our response to a privacy concern, you may complain to the Office of the Privacy Commissioner (privacy.org.nz).