Privacy Policy
Last updated: 28 July 2026
This Privacy Policy explains how Castane AI, a company registered in France ("we", "us"), collects and processes personal data when you use Postars (the "Service"). Castane AI is the data controller. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable French law.
1. Data we collect
- Account data: your email address and a securely hashed password.
- Content data: the posts, drafts, notes, images, tags, and schedules you create in the Service.
- LinkedIn integration: when you connect LinkedIn, we store the access tokens needed to publish on your behalf and basic profile identifiers returned by LinkedIn.
- Billing data: your subscription status and plan. Card payments are handled by Stripe; we do not store your full card number.
- Technical data: limited operational logs (e.g. request and error logs) used to run and secure the Service.
2. How we use your data and legal bases
- To provide the Service (create your account, store and publish your content, run scheduling) — legal basis: performance of a contract.
- To process payments and manage subscriptions — legal basis: performance of a contract.
- To generate AI drafts and diagrams when you request them — legal basis: performance of a contract / your request.
- To secure, maintain, and improve the Service — legal basis: our legitimate interests.
- To comply with legal obligations where applicable.
3. Service providers and sharing
We share personal data only with providers that help us operate the Service, acting as processors or independent controllers as applicable:
- Render — application hosting.
- MongoDB Atlas — database storage for your account and content.
- Stripe — payment processing and subscription management.
- LinkedIn — to publish and read data you authorise.
- AI providers (e.g. OpenAI) — when you use AI features, the relevant post content is sent to the provider to generate output.
We do not sell your personal data.
4. International transfers
Some providers (for example AI or infrastructure providers) may process data outside the European Economic Area. Where that happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
5. Data retention
We keep your personal data for as long as your account is active and as needed to provide the Service. If you delete your account or ask us to erase your data, we will delete or anonymise it, except where we must retain certain records (e.g. for accounting or legal obligations).
6. Your rights under the GDPR
You have the right to:
- access the personal data we hold about you;
- rectify inaccurate data;
- erase your data ("right to be forgotten");
- restrict or object to certain processing;
- data portability (receive your data in a portable format);
- withdraw consent where processing is based on consent.
To exercise any of these rights, contact contact@castane-ai.com. You also have the right to lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).
7. Cookies and local storage
Postars uses your browser's local storage to keep you signed in (an authentication token and a theme preference). These are strictly necessary for the app to function and are not used for advertising or cross-site tracking.
8. Security
We use industry-standard measures to protect your data, including encryption in transit (HTTPS), hashed passwords, and scoped access tokens. No method of transmission or storage is completely secure, but we work to protect your information.
9. Children
The Service is not intended for anyone under 16, and we do not knowingly collect data from children.
10. Changes to this policy
We may update this policy from time to time. We will update the "Last updated" date and, where changes are material, take reasonable steps to notify you.
11. Contact
For any privacy question or request, contact Castane AI at contact@castane-ai.com.