Privacy Policy

1. Introduction

This Privacy Policy describes how Foundry 88 Labs LLC, doing business as PostPilot (“PostPilot,” “Foundry 88 Labs,” “we,” “us,” or “our”), collects, uses, shares, and protects personal information when you use the PostPilot service (the “Service”).

This Policy is designed to comply with the EU General Data Protection Regulation (“GDPR”), the UK GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), and other applicable privacy laws. Where those laws give you specific rights, those rights are summarized in Sections 9 and 10.

By using the Service, you acknowledge that you have read and understand this Policy.

2. Who We Are (Data Controller)

For the purposes of GDPR / UK GDPR and similar laws, the data controller for personal information processed through the Service is:

Foundry 88 Labs LLC
Clark County, Washington, United States
Email: privacy@mypostpilot.app

3. Information We Collect

We collect the following categories of personal information:

3.1 Information you provide directly

• Account information: you sign in with LinkedIn, which shares your name, email address, and profile photo with us. PostPilot has no password of its own, and we never see your LinkedIn password.
• Profile details you add so AI output sounds like you: headline, industries, expertise areas, content pillars, target audience, writing tone and length preferences, sample posts that show your voice, your LinkedIn About text, and your resume (a PDF you upload, which we store and read the text from on our own servers, or text you paste).
• Content: post drafts and their saved versions, ideas, captions, hashtags, scheduled publication times, images you upload or generate, comments and approval decisions you or your teammates leave on posts in a shared workspace, and any other content you create or import into the Service.
• Payment information: if you subscribe to a paid plan, billing details are collected and processed by our payment processor (Stripe). We do not store your payment card number on our servers; we store only your Stripe customer and subscription identifiers and the plan you chose.
• Communications: messages you send to our support email address, and a copy of the emails we send you about your account or the Service.

3.2 Information collected automatically

• Device and connection: IP address, browser type and version, operating system, device type, and approximate geolocation derived from IP address, recorded by our hosting provider and, where they load, by the third-party tags described in Section 7. On each request our hosting provider also tells us the country your IP address belongs to; we use it only to decide whether those tags may load, and we do not store it.
• Usage data: pages and features you interact with, timestamps, action counts (e.g. number of brainstorms, posts created), a record of each AI request (which feature and model, token counts, cost, and whether it succeeded, but not its content), referrer URL, and error and diagnostic events.
• Cookies and similar technologies: see Section 7.

3.3 Information from third parties

• LinkedIn: when you connect your LinkedIn account, LinkedIn sends us an OAuth access token, an OAuth refresh token (when granted), your LinkedIn member identifier, and the profile information you authorize us to read (typically your name and email). Tokens are stored encrypted at rest. We use them only to publish the posts you ask us to publish (including their images), to read engagement statistics for posts you published through PostPilot when you grant that permission, and to check that the connection still works.
• Sign-in: our authentication provider receives the identifiers and basic profile fields LinkedIn returns when you sign in.

4. How We Use Your Information

We use personal information to:

• Provide and operate the Service, including drafting, scheduling, and publishing posts on your behalf;
• Process AI-assisted content generation through third-party AI providers (see Section 6);
• Authenticate you and protect your account;
• Process payments and manage subscriptions;
• Communicate with you about the Service, including transactional, security, and policy-update messages;
• Provide customer support and respond to your requests;
• Detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms of Service;
• Measure, analyze, and improve the Service;
• Measure and optimize our own marketing and advertising, including measuring conversions from, and building retargeting audiences for, our LinkedIn advertising via the LinkedIn Insight Tag, for visitors outside the EU, the EEA, the UK and Switzerland (see Section 7);
• Comply with legal obligations and enforce our agreements;
• Display advertising on Free and Personal plans, outside the EU, the EEA, the UK and Switzerland (see Section 7).

5. Legal Bases for Processing (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom, or another jurisdiction with similar laws, we process your personal information on one or more of the following legal bases:

• Contract (Art. 6(1)(b) GDPR): processing necessary to deliver the Service to you under our Terms of Service.
• Legitimate interests (Art. 6(1)(f) GDPR): improving and securing the Service, preventing fraud, understanding usage, and direct communications about features you already use. We have balanced these interests against your rights and freedoms.
• Consent (Art. 6(1)(a) GDPR): marketing emails where the law requires consent, and optional features you choose to turn on, such as connecting your LinkedIn account. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Legal obligation (Art. 6(1)(c) GDPR): tax, accounting, and other obligations to which we are subject.

We do not load advertising or retargeting tags, or set their cookies, for visitors in the EU, the EEA, the UK and Switzerland (see Section 7).

6. How We Share Your Information

We do not sell your personal information for monetary consideration. We share information only as described below.

6.1 Service providers (sub-processors)

We share information with vendors that help us operate the Service, under contractual obligations to use the information only for the purposes we direct. Categories include:

• Hosting and infrastructure: Vercel Inc. (application hosting and the AI Gateway described below), Supabase Inc. (database, authentication, file storage).
• AI providers: when you use an AI feature (drafting, rewriting, chat, brainstorming, hashtags, draft reviews, or image generation), we send the request through Vercel's AI Gateway to a model from one of these companies: Anthropic, Google, OpenAI, DeepSeek, Mistral AI, ByteDance, and Z.ai (Zhipu AI). We choose the model for each task and may change it, always within this list. The gateway sends the request either to that company or to a cloud platform that runs its model, such as Amazon Web Services, Google Cloud, or Microsoft Azure. A request carries what the task needs: the text you are working on (a draft, your chat messages, an idea, or an image description), the profile details you added to personalize results (Section 3.1), and, for brainstorming, the titles of your recent posts and ideas so suggestions do not repeat them. Every AI request requires zero data retention and no training: the gateway only uses a provider that has agreed not to keep the request after answering it and not to use it to train models, and if no such provider is available, the request fails instead of going anywhere else.
• Payments: Stripe, Inc. for payment processing and subscription management.
• Email: Resend, Inc., which delivers the emails we send you.
• Advertising: Google LLC (AdSense). For visitors outside the EU, the EEA, the UK and Switzerland, Google's ad script loads on our pages, and ads are shown only on the Free and Personal plans. Google may set cookies and collect information about your interactions with ads to serve and measure them. If your browser sends a Global Privacy Control signal, we ask Google to show only non-personalized ads. For visitors in the EU, the EEA, the UK and Switzerland, or when we cannot tell which country a visit comes from, we do not load it and show no ads. See Section 7.
• Marketing analytics and retargeting: LinkedIn Corporation (a Microsoft company), through the LinkedIn Insight Tag, which loads on every page of PostPilot, including pages you see while signed in, for visitors outside the EU, the EEA, the UK and Switzerland. The Insight Tag lets us measure the performance of our LinkedIn advertising, understand how visitors reach us, and build website-retargeting audiences. It may collect your IP address, the pages you visit on our site, device and browser characteristics, and timestamps, and, if you are signed in to LinkedIn, associate that activity with your LinkedIn account. Unlike the ads above, the Insight Tag runs on every plan, including plans that are otherwise ad-free. If your browser sends a Global Privacy Control signal, we do not load it. For visitors in the EU, the EEA, the UK and Switzerland, or when we cannot tell which country a visit comes from, we do not load it at all. See Section 7 for other ways to opt out.

6.2 Publishing

When you instruct the Service to publish a post, we send the content to LinkedIn using the OAuth token you provided. The post becomes governed by LinkedIn's own terms and privacy policy once published.

6.3 Legal and safety

We may disclose information if we reasonably believe disclosure is necessary to (a) comply with a law, regulation, legal process, or governmental request; (b) enforce our Terms or investigate suspected violations; (c) detect or prevent fraud, security, or technical issues; or (d) protect the rights, property, or safety of PostPilot, our users, or the public.

6.4 Business transfers

If Foundry 88 Labs LLC is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such transfer and any choices you may have.

6.5 With your consent

We may share information for any other purpose with your explicit consent.

7. Cookies and Tracking Technologies

We and our service providers use cookies, local storage, and similar technologies to operate and improve the Service. Categories include:

• Strictly necessary: sign-in session cookies and the short-lived security cookies that protect the LinkedIn connection flow. These are required for the Service to function and cannot be disabled.
• Functional: theme preference, the workspace you selected, layout choices, dismissed banners, and similar settings, stored as cookies or in your browser's local storage.
• Advertising (visitors outside the EU, the EEA, the UK and Switzerland): Google AdSense, whose script loads on our pages, and the cookies it and its partners set to serve, measure, and limit the frequency of the ads shown on the Free and Personal plans. If your browser sends a Global Privacy Control signal, we mark every ad request for restricted data processing, so Google shows only non-personalized ads. You can also opt out of personalized advertising at Google Ads Settings and via the industry tools at optout.aboutads.info.
• Marketing and retargeting (visitors outside the EU, the EEA, the UK and Switzerland): the LinkedIn Insight Tag sets first-party and third-party cookies to measure ad conversions and build website-retargeting audiences on LinkedIn. This applies on every plan, including ad-free ones. You can control or opt out of LinkedIn-based advertising in your LinkedIn account under Settings & Privacy → Advertising data, and via the industry opt-out tools at optout.aboutads.info and youronlinechoices.eu (EEA / UK). If your browser sends a Global Privacy Control (GPC) signal, we do not load the Insight Tag at all.

Visitors in the EU, the EEA, the UK and Switzerland: we do not load Google AdSense or the LinkedIn Insight Tag, and we show no ads, so only the strictly necessary and functional cookies and storage above are used. We tell where a visit comes from by the country our hosting provider derives from your IP address on each request; if it cannot tell, we do not load them either.

Most browsers allow you to block or delete cookies through their settings. Blocking strictly necessary cookies will break parts of the Service.

8. International Data Transfers

We are based in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States and other countries where our service providers operate, which may have different data protection laws than your country.

For transfers of personal data from the EEA, the UK, or Switzerland to the United States, we rely on safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) entered into with our sub-processors. You can request a copy of the relevant safeguards by contacting privacy@mypostpilot.app.

9. Your Rights (GDPR / UK GDPR)

If you are in the EEA, the UK, or another jurisdiction with similar protections, you have the following rights subject to applicable conditions and exceptions:

• Right of access: obtain confirmation that we process your personal data and a copy of that data.
• Right to rectification: correct inaccurate data and complete incomplete data.
• Right to erasure (“right to be forgotten”): request deletion of your personal data in certain circumstances.
• Right to restriction of processing: ask us to limit how we use your data.
• Right to data portability: receive your data in a structured, commonly used, machine-readable format.
• Right to object: object to processing based on our legitimate interests, including profiling.
• Right to withdraw consent: where processing is based on consent, withdraw it at any time.
• Right to lodge a complaint: with your local supervisory authority.

To exercise any of these rights, email privacy@mypostpilot.app. We will respond within the timeframes required by applicable law (generally one month under GDPR).

10. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have the following rights under the CCPA/CPRA:

• Right to know: request that we disclose the categories and specific pieces of personal information we have collected about you, the sources, the purposes for collection, and the categories of third parties with whom we share it.
• Right to delete: request deletion of personal information we collected from you, subject to legal exceptions.
• Right to correct: request correction of inaccurate personal information.
• Right to opt out of sale or sharing: we do not sell personal information for monetary consideration. We may “share” identifiers and internet activity for cross-context behavioral advertising as defined under CPRA: with Google (through AdSense) and with LinkedIn (through the Insight Tag, on every page for visitors outside the EU, the EEA, the UK and Switzerland). To opt out, turn on the Global Privacy Control (GPC) signal in your browser (we then do not load the Insight Tag and ask Google for non-personalized ads only), email us at privacy@mypostpilot.app, or use the LinkedIn and industry opt-out controls described in Section 7.
• Right to limit use of sensitive personal information: we do not use sensitive personal information for purposes outside what is reasonably necessary to provide the Service.
• Right to non-discrimination: we will not discriminate against you for exercising any of these rights.

Categories of personal information collected in the past 12 months (as defined by Cal. Civ. Code § 1798.140):

• Identifiers (name, email, account ID, IP address, LinkedIn member ID).
• Customer records (billing details processed by Stripe).
• Commercial information (subscription tier, transaction history).
• Internet or other electronic network activity (usage logs, referrer, device info).
• Geolocation data (approximate, derived from IP address).
• Inferences drawn from the above (e.g. content categories you engage with).
• Professional information (your headline, industries, expertise areas, LinkedIn About text, and resume, if you provide them).

Sources: directly from you, automatically as you use the Service, and from third parties (LinkedIn, our authentication provider, and our payment processor). Business purposes: as described in Section 4. Categories of third parties with whom we share: as described in Section 6.

To exercise your CCPA/CPRA rights, email privacy@mypostpilot.app. You may designate an authorized agent to make a request on your behalf, subject to verification of the agent's authority. We will verify your identity before responding.

11. Data Retention

We retain personal information for as long as necessary to provide the Service and for the additional periods required to satisfy legal, tax, accounting, and dispute-resolution obligations. Specifically:

• Account data: while your account is active. When you close your account, we immediately disconnect LinkedIn and return any scheduled posts to drafts, and your data enters a 30-day grace period during which you can ask us to restore the account. After that it is permanently deleted from our primary systems. We keep a short record of the deletion (the account's email address and name, any reason you gave, and the dates) and our copies of the emails we sent you for 30 days after the permanent deletion (copies of older emails may be removed sooner). Then we remove the email address, name, reason and email contents, keeping only an anonymous record that the deletion happened and that emails were sent. Payment records are kept as described below. Backups are purged on a rolling schedule.
• LinkedIn tokens: deleted when you disconnect LinkedIn or close your account.
• Payment records: retained for the period required by tax and accounting law (typically seven years in the United States).
• Error logs: deleted automatically after 90 days. If we are investigating a security incident, we may keep the relevant entries longer. Our hosting and database providers keep their own request logs for a limited time under their own policies.

12. Children's Privacy

The Service is not intended for users under the age of 16, and we do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact us at privacy@mypostpilot.app and we will delete it.

13. Security

We use administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, alteration, and destruction. These include encryption in transit (TLS), encryption at rest for sensitive fields (including LinkedIn tokens), role-based access control, regular dependency updates, and audit logging. No system is perfectly secure; if you become aware of a security issue, please report it to security@mypostpilot.app.

14. Third-Party Links

The Service may contain links to third-party websites and services (for example, LinkedIn, Stripe, our AI providers). This Policy does not apply to those third parties, and we are not responsible for their privacy practices. Please review the privacy policies of any third party before sharing information with them.

15. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. If the changes are material, we will provide additional notice (for example, by email or in-app notification) before the changes take effect. Your continued use of the Service after the update constitutes acceptance of the updated Policy.

16. Contact

For questions about this Policy or to exercise any of the rights described above:

Foundry 88 Labs LLC
Attn: Privacy
Clark County, Washington, United States
Email: privacy@mypostpilot.app