Privacy Policy

Last updated: 5 October 2026

This Privacy Policy explains how Castane AI, a company registered in France ("we", "us"), collects and processes personal data when you use Postars (the "Service"). Castane AI is the data controller. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable French law.

1. Data we collect

• Account data: your email address and a securely hashed password.
• Content data: the posts, drafts, notes, images, tags, and schedules you create in the Service.
• LinkedIn integration: when you connect LinkedIn, we store the access tokens needed to publish on your behalf and basic profile identifiers returned by LinkedIn.
• Billing data: your subscription status and plan. Card payments are handled by Stripe; we do not store your full card number.
• Technical data: limited operational logs (e.g. request and error logs) used to run and secure the Service.

2. How we use your data and legal bases

• To provide the Service (create your account, store and publish your content, run scheduling) — legal basis: performance of a contract.
• To process payments and manage subscriptions — legal basis: performance of a contract.
• To generate AI drafts and diagrams when you request them — legal basis: performance of a contract / your request.
• To secure, maintain, and improve the Service — legal basis: our legitimate interests.
• To comply with legal obligations where applicable.

3. Service providers and sharing

We share personal data only with providers that help us operate the Service, acting as processors or independent controllers as applicable:

• Render — application hosting.
• MongoDB Atlas — database storage for your account and content metadata.
• Cloudflare — storage of your images and videos (EU jurisdiction).
• Stripe — payment processing and subscription management.
• LinkedIn and X — to publish and read data you authorise.
• AI providers (OpenAI and OpenRouter) — when you use AI features, the relevant post content, prompts, and any reference images you choose are sent to the provider to generate output.
• Resend — sending account emails (e.g. email verification).
• Compactly — compressing the images and videos you upload or generate before they are stored.
• Unsplash — photo search when you use the in-app image search (your search terms are sent to Unsplash).
• Apify — collecting the public posts of your own LinkedIn profile when you use Profile Analytics.

We do not sell your personal data.

4. International transfers

Some providers (for example OpenAI, OpenRouter, Stripe, Resend, and Unsplash) are based in the United States and may process data outside the European Economic Area. Where that happens, we rely on the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.

5. Data retention

We keep your personal data for as long as your account is active. When you delete your account (Settings → Account), your account, content, images, videos, and connected-platform tokens are deleted immediately and your subscription is cancelled. Operational logs are kept for up to 30 days. Encrypted database backups are kept for up to 12 months, so deleted data disappears from them by then; if a backup is ever restored, deleted accounts are erased again. Invoices and payment records are kept by Stripe for 10 years, as required by French accounting law.

6. Your rights under the GDPR

You have the right to:

• access the personal data we hold about you;
• rectify inaccurate data;
• erase your data ("right to be forgotten");
• restrict or object to certain processing;
• data portability (receive your data in a portable format);
• withdraw consent where processing is based on consent.

You can download a copy of your data and delete your account yourself in Settings → Account. To exercise any other right, contact contact@castane-ai.com. You also have the right to lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).

7. Cookies and local storage

Postars sets a single cookie, pb_session, when you sign in. It is strictly necessary to keep you signed in, is not readable by scripts (httpOnly), and expires after 7 days or when you log out. Your browser's local storage keeps interface preferences only (for example theme and layout). We use no analytics, advertising, or cross-site tracking cookies, and our pages load no third-party trackers or fonts, so no consent banner is required.

8. Security

We use industry-standard measures to protect your data, including encryption in transit (HTTPS), hashed passwords, and scoped access tokens. No method of transmission or storage is completely secure, but we work to protect your information.

9. Children

The Service is not intended for anyone under 16, and we do not knowingly collect data from children.

10. Changes to this policy

We may update this policy from time to time. We will update the "Last updated" date and, where changes are material, take reasonable steps to notify you.

11. Contact

For any privacy question or request, contact Castane AI at contact@castane-ai.com.

Terms of Service →