Privacy Policy

This Privacy Policy explains how PostLoop ("we", "us", "our") collects, uses, shares, and protects your information when you use PostLoop (the "Service"). PostLoop is the controller of your personal data for the purposes described here.

This policy is incorporated into our Terms & Conditions. Defined terms have the same meaning as in the Terms.

We collect the following categories of information:

• Account & authentication data. Email address, name, and Clerk user ID, managed by our authentication provider Clerk. We do not store your password.
• Workspace content. Posts, captions, scheduled times, loop configurations, uploaded media (images, videos, audio), watermark settings, and competitor snapshots you create or upload.
• Usage & logs. Activity feed entries, video job logs, error logs, scheduler events, and similar operational data needed to run and debug the Service.
• Payment metadata. Midtrans order ID, amount, currency, and transaction status. We never receive or store your full card number or other raw payment instrument details; those are handled solely by Midtrans.
• Device & technical data. IP address, browser type, locale, and the cookies or local storage entries set by Clerk and our theme provider (next-themes).

We process your data for the following purposes:

• Providing the Service — authenticating you, provisioning your workspace, scheduling and publishing posts, rendering videos, and generating captions.
• Billing — processing top-ups, charging generations to your wallet, and maintaining a transaction ledger.
• Operations & reliability — debugging, monitoring, and improving the stability of the Service.
• Security & abuse prevention — detecting fraud, abuse, and violations of our Terms.
• Legal compliance — meeting obligations under applicable Indonesian law.

We share the minimum data each provider needs to deliver the Service. Our current providers include:

• Clerk — authentication and identity.
• Midtrans — payment processing (order metadata only; no raw card details).
• S3-compatible storage provider — storing your uploaded media and rendered videos.
• OpenAI / Google Gemini — AI caption and video script generation.
• Zernio — publishing and analytics integration with third-party social platforms, when configured.
• Pi / OpenAI Codex — video rendering jobs.
• Hosting provider — running the application container and database.

We do not sell your personal data. We may disclose data to authorities when required by law.

Some of the providers listed above process data outside Indonesia. By using the Service, you consent to these transfers. We select providers that offer reasonable safeguards for international data transfers, but we cannot guarantee the same level of protection as Indonesian law in every jurisdiction.

We retain your data for the following periods:

• Wallet & transactions — at least one (1) year from each top-up date, consistent with our Terms. Transaction ledger rows may be retained longer for accounting and dispute resolution.
• Workspace content & media — until you remove it from the Service, or until we delete it in the ordinary course of operating the Service.
• Usage & logs — approximately 90 days, after which they are automatically purged or aggregated.
• Account data— retained for the life of the account. Because accounts and workspaces cannot be self-deleted under our Terms, we apply data minimization on request instead of full deletion (see "Your rights" below).

We use reasonable technical and organizational measures to protect your data, including TLS in transit, isolated workspaces, row-level locking for wallet operations, and secret management for service credentials. However, no system is perfectly secure, and we cannot guarantee the absolute security of your data.

We use minimal cookies and local storage entries:

• Clerk — authentication session cookies required to keep you signed in.
• next-themes — a local storage entry remembering your light/dark theme preference.

We do not use advertising or cross-site tracking cookies. You can clear cookies and local storage through your browser, though doing so will sign you out and reset your theme.

Subject to applicable law, you may have the right to:

• Access the personal data we hold about you;
• Correct inaccurate personal data;
• Object to or restrict certain processing; and
• Request deletion of your personal data, subject to legal and operational constraints.

Because accounts and workspaces cannot be self-deleted under our Terms, full deletion of your account is not generally available. Instead, on request, we will apply data minimization — removing or anonymizing workspace content, media, and logs where possible while retaining the minimum account and ledger records required to operate the Service and comply with law.

To exercise any of these rights, contact us at [email protected]. We will respond within a reasonable time.

The Service is not directed to children under 18, and we do not knowingly collect personal data from children. If you believe we have collected data from a child, contact us and we will take steps to delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective" date at the top of this page. Material changes will be communicated through the Service or by other reasonable means. Your continued use of the Service after a change takes effect constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or your data, you can contact us at [email protected].