Postverse
Start free →
PricingFAQBlogStart free →

Last updated: 22 July 2026

Privacy Policy

This Privacy Policy explains what personal data Postverse collects about you, how and why we use it, who we share it with, and the rights you have. It applies to the Postverse web app and website. By using Postverse, you confirm you have read and understood this policy.

Postverse is based in the United Kingdom (“we”, “us”, “our”, “Postverse”). We are the data controller responsible for your personal data.
Contact: team@postverse.io

1. The personal data we collect

We collect the following categories of personal data:

Account and profile

  • your email address, and a display name and profile picture (which may come from your Google account if you sign in with Google, or which you set yourself).

Authentication

  • Postverse uses passwordless sign-in — a magic link, a one-time email code, or Sign in with Google. We do not create or store passwords. If you use Google, we receive your Google email, name, and profile picture. Sign-in and sessions are handled by our authentication and database provider, Supabase.

Content you create

  • the demos (screen recordings) you upload; the prompts and inputs you provide, such as your product’s name, its description, and the scene or “moment” text you write; and the AI personas, still frames, reaction hooks, and finished videos generated for you.

Billing

  • your subscription plan, billing interval, payment status, credit balances, and a record of credit transactions, together with the customer and subscription identifiers assigned to you by our payment processor, Stripe. Your card details are collected and stored by Stripe, not by us — we never see or store your full card number.

Connected social accounts

  • when you connect a TikTok, Instagram, or YouTube account, we store the platform name, the account identifier and username, and whether the connection is active. We do not hold your social platform passwords or access tokens — these are held by our publishing partner, Post for Me, which runs the secure sign-in on your behalf. We also collect the view, like, and share counts of posts you publish, so we can show you their performance.

Usage and device data

  • information about how you use Postverse — the pages and actions you take, your approximate location and IP address, and your device and browser — collected through our analytics and error-monitoring provider, PostHog, to help us keep the service working and improve it. In our analytics we identify you by your account identifier and plan, not by your email.

2. How we use your data, and our legal bases

Under UK data protection law we must have a lawful basis for using your personal data. We rely on the following:

  • To provide the service — creating and processing your content, generating videos, and publishing to the accounts you connect. Basis: performance of our contract with you.
  • To handle payments, subscriptions, and credits — taking payment, managing your plan, and metering credit usage. Basis: performance of our contract with you.
  • To keep Postverse secure and improve it — preventing fraud and abuse, diagnosing errors, and understanding how features are used. Basis: our legitimate interests (including recognised legitimate interests) in running a safe, reliable service.
  • To meet legal obligations — for example, keeping tax and accounting records. Basis: compliance with a legal obligation.
  • Optional cookies and analytics — where required, non-essential cookies are used only with your consent, which you can withdraw at any time.

3. AI processing and data minimisation

Postverse uses third-party artificial-intelligence providers to generate personas, images, captions, and videos. We deliberately send them as little as possible: only your product’s name and description, the prompt text you write, and image URLs. We never send your email address, account identifier, or payment data to these AI providers. They process this input to produce your content and are bound by their own terms; they are listed as our processors in the next section.

4. Who we share your data with

We do not sell your personal data. We share it only with the service providers (processors) that help us run Postverse, each acting on our instructions:

  • Supabase — authentication, database, and file storage.
  • Stripe — payment processing and subscription billing.
  • fal.ai and Kling — AI image and video generation.
  • Anthropic — AI-assisted caption drafting.
  • Amazon Web Services — video processing (splicing, trimming, and cropping), in the US (us-east-1).
  • Post for Me — connecting your social accounts and publishing your posts.
  • Vercel — hosting the Postverse app.
  • Inngest — running background jobs (such as generation and scheduling).
  • PostHog — product analytics and error monitoring.

We may also disclose personal data if required by law, to protect our rights or the safety of others, or as part of a merger, acquisition, or sale of our business (in which case we will tell you).

5. International data transfers

Some of our providers are based outside the United Kingdom, mainly in the United States, and our data is stored in Europe. Where we transfer personal data outside the UK, we protect it using an approved transfer mechanism: the UK–US Data Bridge (the UK Extension to the EU–US Data Privacy Framework) where the receiving organisation is certified under it, or otherwise the Information Commissioner’s Office International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

6. Cookies and similar technologies

We use a small number of cookies and similar technologies:

  • Essential cookies — needed to sign you in and keep you signed in (set by Supabase), and to remember interface preferences such as whether the sidebar is open. These are always on because the service cannot work without them.
  • Analytics cookies and local storage — set by PostHog to understand how the app is used and to catch errors. Where required by law, these are used only with your consent, and you can withdraw consent at any time.

When you make a payment, Stripe may set its own cookies on its hosted checkout pages; those are governed by Stripe’s privacy policy.

7. How long we keep your data

We keep your personal data for as long as your account is open and you are using Postverse. If you close your account, we delete your content and account data within a reasonable period (normally within 30 days), except where we need to keep certain records longer — for example, billing and tax records, which we retain for as long as the law requires (generally around six years in the UK). Residual copies may persist in encrypted backups for a short time before they are cycled out.

8. How we protect your data

We take security seriously. Data is encrypted in transit and at rest. Access to your data is restricted by row-level security, so each user can only reach their own records. We do not store passwords, because we use passwordless sign-in. Your uploaded demos and finished videos are held in a private storage area and served only through short-lived, signed links.

9. Your rights

Under UK data protection law you have the right to access your personal data; to have it corrected or erased; to restrict or object to how we use it; to data portability; and, where we rely on consent, to withdraw that consent. You can exercise most of these directly in the app — including editing your profile and deleting your account — or by emailing us at team@postverse.io. We do not make decisions that produce legal or similarly significant effects about you using solely automated processing.

If you have a concern, please contact us first — you have the right to complain directly to us, and we will acknowledge your complaint within 30 days and respond without undue delay. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

10. Children

Postverse is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with their data, please contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. If we make a material change, we will give you reasonable notice by email or in the app and update the “last updated” date at the top of this page.

12. Contact

For any privacy question or to exercise your rights, email team@postverse.io. Your use of Postverse is also governed by our Terms of Service.