This policy explains what Postbing ("Postbing", "we", "us") collects when you use postbing.com, the Postbing plugin for WordPress and the Postbing app for Shopify, why we collect it, who we share it with and what you can do about it. For your account and billing data we are the data controller. For content and lead-form submissions we process on your behalf (for example, visitors who fill in a form on your store), you are the controller and we act on your instructions.
1. What we collect
- Account: name, email address, password (stored as a hash), plan and subscription status, team members you invite, and your settings.
- Sites and content: the website addresses you add, what our analysis finds on them, your brand voice and writing instructions, the articles, pages and images the service creates, publishing settings and publish logs.
- Connection credentials: the WordPress site key or the Shopify access token that lets us publish to your site. These are encrypted at rest and never shown in the interface.
- Shopify stores: the store's myshopify.com domain, store name and primary domain, the permissions you approved, the blog articles and pages we create or update, and the app subscription you chose. The app only requests permission to read and write online-store content; it does not access customers, orders, products or payments.
- Leads: when a visitor submits a Postbing lead form on your site we store the name, email, phone and message they entered, the page it came from and the browser type, so you can see it in your Leads inbox.
- Payments: card payments are handled by Stripe; card numbers never reach our servers and we keep only your Stripe customer reference, plan and status. Stores that installed the Shopify app are billed by Shopify; we keep the subscription name, status and reference.
- Technical: server logs (IP address, browser, timestamps, requested pages), AI usage counts, rate-limit counters and error reports.
- Communications: emails you send to support.
2. How we use it
- To run the service: analyze your site, plan content, write and illustrate articles, publish them, and show you leads.
- To bill you, send receipts and account emails (for example, email verification and password resets), and to answer support requests.
- To keep the service secure: detect abuse, verify that requests from WordPress, Shopify and Stripe are genuine, and enforce plan limits.
- To understand how the website is used, only with your consent to analytics cookies.
- To meet legal, tax and accounting obligations.
We do not sell personal data and we do not use your content to train AI models.
3. AI processing
To produce content we send the relevant inputs (site details, brand voice, instructions, keyword data and drafts) to AI model providers: Anthropic (Claude) for analysis, planning, keyword research and writing; OpenAI for images and, through Microsoft's Azure OpenAI Service, for the in-app assistant. These providers process the data to return a result and, under their API terms, do not use it to train their models. Search-result and keyword data used in research comes from Serper, ScrapingRobot and Google PageSpeed Insights.
4. The Postbing app for Shopify
The app is installed from the Shopify App Store. When you install it, Shopify gives us an access token limited to online-store content (read_content, write_content). We use it to create and update blog articles and pages and to read your store name and domain. The app runs inside your Shopify admin and makes no changes to your theme. If you use a Postbing lead form on your store, submissions are stored for you; they are your customers' data and you decide how to use it.
We honour Shopify's mandatory privacy webhooks: on a customer data request we send you the lead-form data we hold for that customer within 30 days; on a customer redaction we delete leads matching that customer; on a shop redaction, which Shopify sends 48 hours after you uninstall, we delete the store's leads, credentials and store record. Uninstalling the app also disconnects the store and wipes its access token immediately, and ends any plan billed through Shopify.
5. Who we share data with
We share personal data only with providers we need to run Postbing, each bound by a contract and its own privacy policy:
- Vercel: application hosting, serverless functions and image storage (United States).
- Neon: PostgreSQL database (United States, AWS us-east-1).
- Anthropic, OpenAI and Microsoft Azure: AI models (United States).
- Serper, ScrapingRobot and Google PageSpeed Insights: search-result, keyword and site-performance data (United States / EU).
- Stripe: card payments and invoices (United States).
- Shopify: app installation, billing for stores that installed the app, and the stores you publish to (Canada / United States).
- Resend: transactional email (United States).
- Google Analytics (only with consent) and Simple Analytics (cookieless): website analytics. Google Fonts serves the site's typefaces, which means Google receives your IP address when fonts load.
- The sites you connect (your WordPress site, your Shopify store or your webhook endpoint) receive the content you publish.
We may also disclose data when the law requires it, to protect our rights or users, or as part of a merger or acquisition (we would notify you before your data became subject to a different policy).
6. Cookies
We use essential cookies to keep you logged in and secure forms, and analytics cookies only if you accept them in the banner. Details are in the Cookie Policy.
7. How long we keep data
- Account, site and content data: for the life of your account and up to 90 days after it closes, so you can change your mind.
- Leads: until you delete them or your account closes. For Shopify stores, also on Shopify's redaction requests described above.
- Connection credentials: until you disconnect the site, deactivate the plugin or uninstall the app, when they are erased at once.
- Billing records: 7 years, for tax and accounting law.
- Server logs: 30 days. Email delivery logs: 90 days. Database backups: rolling 35 days.
8. Security
All traffic is encrypted in transit (TLS with HSTS). Site keys and access tokens are encrypted at rest; passwords are hashed. Webhooks and storefront requests from WordPress, Shopify and Stripe are verified with signatures before we act on them. We request the smallest set of permissions each platform allows. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and, where required, the relevant authority without undue delay.
9. Your rights
Depending on where you live (including the EEA, the UK and California) you can ask us to access, correct, export, restrict or delete your personal data, object to processing based on legitimate interest, withdraw consent (for example to analytics cookies) and complain to your data-protection authority. You can change account details in Settings. To export or delete your account, or to exercise any other right, email abhishek@baclinc.com from your account address; we answer within 30 days and never discriminate against you for exercising a right. We do not sell or "share" personal information as defined by the CCPA.
10. If you submitted a form on a site powered by Postbing
The owner of that website or store is the controller of your data and decides how it is used. Please contact them to access or delete it; we act on their instructions and on Shopify's redaction requests. We do not use lead-form data for our own purposes.
11. International transfers
Postbing is operated from the United States and our providers process data mainly there. Where data of people in the EEA, the UK or Switzerland is transferred, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) with our providers.
12. Children
Postbing is for businesses and is not directed at people under 18. We do not knowingly collect data from children; if you believe a child has given us data, email us and we will delete it.
13. Changes
We will post changes here and update the date at the top. For material changes we will email account holders before they take effect.
14. Contact
Postbing is the data controller for account and billing data. Privacy questions, rights requests and general support: abhishek@baclinc.com.