Privacy notice

1. Who we are

post-itt (a working name) is a free set of social media tools for brands in Trinidad and Tobago: people who are a brand, and businesses old and new. It is run by [legal name of the operator, to be added]. In this notice, "we" means post-itt and "you" means anyone who uses it.

2. What we collect

Your account

• Your name and email address.
• Your password, stored scrambled (hashed) so nobody, including us, can read it.
• Your sign-in security settings, such as two-factor sign-in and passkeys.
• Your choices in Settings, such as theme, Home cards and calendar options.

Your brand

• The brand's name, type, region, size and time zone.
• Notes you write about your brand's voice.
• Who is on the brand's team and their role (owner, editor or viewer).
• Invitations to join the team: the email address invited, the role offered and who sent it. The invitation email goes to that address; unused invitations run out after 7 days.

Social accounts you connect

• The account's name, handle and ID on Facebook, Instagram, TikTok or YouTube.
• The access keys the platform gives us so we can work for you. They are encrypted, never shown to anyone, and never sent to the assistant.
• What the platform lets us read: your posts and their numbers, such as views, likes, comments, shares and followers. We only keep numbers a platform actually gives us. When it gives none, we show "not available" instead of guessing.

What you make here

• Drafts, captions, photos and videos you upload, and when posts should go out.
• Goals, campaigns, content plans and notes.
• People you save to mention in posts (their name and handle).

The assistant

• Questions you ask, the assistant's answers, and the ideas it suggests.
• A record of which of your brand's summaries it looked at for each answer.

Keeping you signed in and safe

• While you are signed in, a session record with your IP address and the type of browser you use.
• Error logs, which never include your access keys.

Usage insights, only if your brand's owner turns them on

• Which parts of post-itt your brand uses and when (for example "Goals opened" or "Post scheduled"), with the person's role but not who they are.
• Never what anyone typed, never captions, numbers or access keys.

3. What we never do

• We do not sell your information.
• We do not use outside tracking or advertising scripts.
• We do not show ads based on you as a person. Ads, when they come, are matched only on your brand's type and region, and only if your brand allows it.
• We never post anything you did not approve or schedule.
• We do not let one brand see another brand's information.

4. How we use it

• To run post-itt: show your results, publish what you approve, and keep your plans.
• To answer your questions in the assistant.
• To keep accounts secure and fix problems.
• With usage insights switched on: to learn which tools brands use, so we improve the right ones. We may also suggest a shortcut, for example a Home card for something you open often. We never change anything for you.
• With comparisons switched on: to show brands like yours how they compare, using combined totals only, never one brand on its own.

5. Who we share it with

Only the services we need to run post-itt, and only what they need:

• The social platforms you connect (Meta for Facebook and Instagram, TikTok, Google for YouTube): to read your posts and numbers and to publish what you approve. Their own privacy policies apply to what you share with them.
• Anthropic, which provides the assistant (Claude): your question and short summaries of your brand's own information (such as its name, type, region, brand voice, results, goals, campaigns and recent captions). Never access keys, and never another brand's information.
• DigitalOcean, our hosting provider, where our server, database and uploaded files are kept (in New York, in the United States).
• Laravel Nightwatch, our error monitoring: technical details when something goes wrong or runs slowly, such as which page, how long it took and the error. Never what you typed, your name, email address or IP address.
• Brevo, our email provider: your email address and the message, to send sign-in, security and team invitation emails.
• Anyone the law requires us to share with, such as a court order.

Some of these services keep information outside Trinidad and Tobago, for example in the United States. We choose services that protect it.

6. How long we keep it

• Full copies of what platforms send us: 90 days.
• Usage events: 90 days. After that only combined daily totals remain, with no brand attached.
• Your account, brand, posts, numbers and plans: while you use post-itt.
• Assistant conversations: with your brand for now. We will set a time limit before launch.
• When you disconnect a social account, its past posts and numbers stay so your history is kept. Choose "Disconnect and delete my data" to remove them.
• When you delete your account in Settings, your sign-in and your place on brand teams are removed. A brand's posts and plans belong to the brand and stay for its other team members. If you are the only owner of a brand that has other people on its team, make one of them an owner in Settings → Team first. To have a whole brand deleted, contact us.

7. Your choices and rights

• You can see and change your details in Settings, and delete your account.
• Brand owners can switch usage insights, ad matching and comparisons on or off in Settings → Privacy at any time. Turning usage insights off stops it straight away and deletes your brand's usage events.
• You can disconnect any social account in Accounts.
• You can ask us for a copy of your information, to correct it, or to delete it.

We aim to follow Trinidad and Tobago's Data Protection Act, 2011.

8. Keeping it safe

Connections to post-itt are encrypted, access keys are encrypted when stored, passwords are hashed, and each person only sees the brands they belong to, with what their role allows. No system is perfectly safe; if something goes wrong that affects you, we will tell you.

9. Children

post-itt is for people who run brands. It is not meant for children, and we do not knowingly collect children's information.

10. The closed beta

During the closed beta, post-itt runs as a simulation for invited testers:

• You get your own test brand with made-up accounts and numbers. Nothing is ever posted, and no real social account can be connected.
• We keep your feedback: quick notes (with the page you were on), your answers to the end form, your name and logo ideas, and any logo sketch you upload. Only our team reads them.
• Your email is shown to our team with your form answers only if you tick that we may contact you.
• Questions you ask the assistant are sent to Anthropic with your test brand's made-up summaries, as described above.
• Test brands are deleted after the beta. Your feedback is kept to improve post-itt.

11. Changes and contact

When this notice changes, we will update the date above and tell you in the app. Questions or requests: [contact email to be added], or through Help in the app.