Privacy Policy

Last updated: 17 August 2026  ·  Effective date: 17 August 2026  ·  Version 1.4

1. Who we are

Postivia is a social media marketing tool for Etsy sellers, operated by Postivia ("Postivia", "we", "us", or "our"), registered in England and Wales. Our registered address is Postivia, The Pines, BS16 9QY, Bristol, UK

We are the data controller for personal data processed through the Postivia platform at postivia.ai.

For questions about this policy or our data practices, contact us at: privacy@postivia.ai

2. What data we collect and why

2.1 Account data

When you sign up for Postivia, we collect:

• Your name and email address
• Your sign-in credentials — handled entirely by Clerk, our authentication provider. Postivia never sees, stores or has access to your password.
• Your billing information, processed securely by Stripe (we never see or store full card numbers)

Legal basis (UK GDPR): Contract — necessary to provide the service you've signed up for.

2.2 Etsy shop data

When you connect your Etsy shop via Etsy's OAuth 2.0 authorisation, we access:

• Your Etsy shop name and public shop information
• Your product listings (title, description, price, images, tags)
• The listing statistics Etsy exposes: view and favourite counts

We ask Etsy only for the permissions we actually use (shops_r, listings_r, listings_w). Etsy's API does not give us your sales figures, order counts, buyer details or search rankings, and we do not request access to them.

We use this data solely to provide Postivia's features to you — specifically to generate social media content from your listings and to display shop analytics within your Postivia dashboard. We do not share Etsy data with third parties, combine it with other users' data, or use it for advertising.

Legal basis: Contract and Legitimate Interests (providing the service you have requested).

2.3 Pinterest account data

When you connect your Pinterest account, we access and use:

• Your Pinterest profile name and account identifier
• Your Pinterest boards (names and IDs, to allow you to choose where to publish)
• The ability to create Pins on your behalf, on boards you select, when you explicitly approve each Pin for publishing

We access Pinterest data in real time via the Pinterest API v5 each time it is needed. We do not store Pin content, board data, or any information about accounts other than your own.

One exception, so you know exactly what we keep: for Pins you published through Postivia, we record how they performed — impressions, saves and clicks — once a day, so your dashboard can tell you whether a Pin actually worked rather than only that it was sent. This covers your own Pins on your own connected account, is shown only to you, is never combined with another seller's data, and is deleted when you delete your account.

We only publish to Pinterest when you have explicitly reviewed and approved each piece of content. We do not publish automatically without your deliberate action per Pin.

Legal basis: Consent (you authorise Pinterest access via OAuth) and Contract.

2.4 Instagram, TikTok, Facebook, Threads and Bluesky account data

Instagram, TikTok, Facebook and Threads are connected through OAuth and published via PostPeer (see section 4). We access these accounts to publish content you have explicitly approved, and to read back how those posts performed so we can show you the results in your dashboard.

Bluesky works differently: it uses an app password rather than OAuth. If you connect Bluesky, we store that app password so scheduled posts can be sent at the time you chose. It is encrypted at rest, never shown back to you, and excluded from your data export for your own security. You can revoke it at any time from your Bluesky account settings, or disconnect in Postivia Settings.

Legal basis: Consent (you authorise each connection) and Contract.

2.5 Content you create in Postivia

When you use Postivia to generate or edit social media captions, we store:

• The AI-generated captions we produce for you
• Any edits you make to those captions before publishing
• Your scheduled posts queue
• A record of posts that have been published (platform, listing, timestamp, status)
• How those posts performed — a daily reading of the likes, comments, saves, views and clicks each platform reports back, so your dashboard can show you what worked
• Which content tabs you open in a campaign, so we can tell which formats are genuinely useful and stop generating ones nobody reads

Your edits are what teach Postivia to write like you. We compare the caption we drafted against the version you published, and use those corrections — along with the writing rules we distil from them, which you confirm or reject yourself in Settings — to shape everything generated for your shop afterwards.

This is personal to your shop: it is never pooled with other sellers' data, never used to train models for anyone else, and never shared with third parties. We keep it for as long as your account is open, because a correction you made last season is exactly what stops next season's posts drifting back to a generic voice. You can read your voice profile and learned rules at any time in Settings, download the underlying edit history from your account data, and erase all of it by deleting your account.

Legal basis: Contract and Legitimate Interests.

2.6 Material cost and profit data

If you use our profit calculator, you may enter material costs, labour time, and packaging costs. This data is stored in your account and used only to calculate profit figures displayed to you. It is never shared.

2.7 Your own customers' email addresses

If you use Postivia's capture pages, people who sign up through your page give us their email address so it can appear on your subscriber list. For that data you are the controller and we are your processor: we store it, show it to you, and let you export it, but we never email those people ourselves, never market to them, and never use their addresses for anything but your list. Deleting your account deletes the list.

You are responsible for having a lawful basis to contact the people who sign up, and for honouring their requests if they ask you to remove them.

Legal basis: Contract (with you); you determine the basis for your own subscribers.

2.8 Usage data and cookies

We collect standard technical data when you use Postivia, including:

• IP address and approximate location (country/region level)
• Browser type and version
• Pages visited and features used within Postivia
• Error logs and performance data

Cookies that are strictly necessary for the service to function — authentication sessions, security, and the record of your cookie choices — are set automatically. They do not require consent under UK PECR.

Everything else is off until you opt in on our cookie banner, and stays off if you decline:

• Analytics — Vercel Web Analytics, which counts page views and visitors without building a cross-site profile, and Microsoft Clarity, which records anonymised session replays and heatmaps (clicks, scrolling, mouse movement) with any text you type masked before it leaves your browser.
• Affiliate tracking — FirstPromoter, which records the partner who referred you so they can be credited if you subscribe. This is a third-party tracking cookie, and it is the only one we set for a commercial purpose.
• Support chat — our in-app chat widget and its conversation history.

We do not use advertising cookies, and we do not sell or share cookie data with advertising networks. You can change or withdraw your choices at any time from the "Cookie preferences" link in the footer of any page, or in Settings. Full detail of every cookie is in our Cookie Policy.

Legal basis: Consent (UK PECR reg. 6) for analytics, affiliate tracking and support chat. Legitimate Interests for strictly necessary cookies and server-side operational logs.

3. How we use your data

We never use your data for advertising purposes. We never sell your data to third parties.

4. Who we share data with

We share data only with the following categories of third-party service providers who help us run Postivia:

• Clerk — authentication. Clerk holds your sign-in credentials and issues your session; Postivia never handles your password.
• Stripe — payment processing (UK/EU data residency available)
• Supabase — database hosting (EU data centres)
• Vercel — application hosting (EU data centres)
• Anthropic — AI caption generation via the Claude API. Caption generation requests include your listing data. Anthropic does not use API data to train its models.
• PostPeer — social media publishing middleware. We pass approved post content and your OAuth tokens to PostPeer to complete publishing actions on your behalf.
• Vercel Web Analytics — aggregated page-view analytics, only if you consent to analytics cookies
• Microsoft Clarity — anonymised session recordings and heatmaps, only if you consent to analytics cookies
• FirstPromoter — affiliate referral attribution, only if you consent to affiliate tracking
• Resend — transactional email delivery

When you publish, we also send the content you approved to the platform you chose — Etsy, Pinterest, Instagram, TikTok, Facebook, Threads or Bluesky — which then handles it under its own privacy policy.

All third-party processors are bound by data processing agreements. We do not transfer your personal data outside the UK or EEA without appropriate safeguards (Standard Contractual Clauses or adequacy decisions).

We may disclose data if required to do so by law, court order, or to protect the rights and safety of Postivia or its users.

5. How long we keep your data

6. Your rights under UK GDPR

As a UK resident, you have the following rights regarding your personal data:

• Right of access and portability — Download everything we hold about you as a structured JSON file, instantly, from Settings → Your data and privacy → Export. No request or waiting period. Access tokens for your connected accounts are excluded from the file for your own security; email us if you need anything the export doesn't cover.
• Right to rectification — You can ask us to correct inaccurate data.
• Right to erasure — Delete your account and all associated data yourself from Settings → Your data and privacy → Delete. This takes effect immediately and cancels any active subscription. Billing records must be kept for 7 years under UK tax law (Art. 17(3)(b)); everything else is erased.
• Right to restriction — You can ask us to limit how we use your data in certain circumstances.
• Right to object — You can object to processing based on legitimate interests.
• Right to withdraw consent — Withdrawing is as easy as consenting. For cookies, use the "Cookie preferences" link in the footer of any page. For a connected social account, disconnect it in Settings.

To exercise any of these rights, email privacy@postivia.ai. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

7. Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• All data in transit encrypted via TLS 1.2 or higher
• All data at rest encrypted at the storage layer by our database host
• Every stored account credential — your Etsy and Pinterest access tokens, and your Bluesky app password — additionally encrypted by us before it is written, so they are unreadable even to someone with database access
• Your sign-in password is never held by Postivia at all; Clerk manages it
• Access to production data restricted to essential personnel only
• Regular security reviews and dependency updates

No system is completely secure. If you believe your account has been compromised, contact us immediately at security@postivia.ai.

8. Children

Postivia is intended for adults and business owners. We do not knowingly collect personal data from anyone under the age of 18. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

9. Changes to this policy

We may update this Privacy Policy from time to time. The version number and "Last updated" date at the top of this page always tell you which version is in force.

If a change would reduce your rights, broaden how we use your data, or introduce a purpose we have not described here, we will email you at least 14 days before it takes effect — so you have time to read it and decide what you want to do, including leaving and taking your data with you.

Changes that do none of those things take effect when they are published: corrections that make this policy describe our actual practice more accurately, plain-English clarifications, and changes that give you more control. We would rather fix an inaccuracy today than leave it standing for two weeks. Every change, however small, bumps the version number above.

Continued use of Postivia after a change takes effect constitutes acceptance of the updated policy.

10. Pinterest-specific disclosures

Postivia uses the Pinterest API v5. Our use of Pinterest's API is subject to Pinterest's Developer Guidelines and API Terms of Service.

Specifically:

• We only access your Pinterest account with your explicit authorisation via Pinterest's OAuth 2.0 flow.
• We only use your Pinterest account data to provide Postivia's service to you.
• We do not store Pinterest API data, other than the performance metrics of Pins you published through Postivia, which we keep so we can show you how your own Pins did over time. We do not store Pin content, board data, or any information about accounts other than yours.
• We do not combine your Pinterest account information with other users' account information.
• We do not share or sell Pinterest API data with third parties.
• Each Pin published to Pinterest requires your deliberate review and approval within Postivia before it is submitted to Pinterest.
• You may revoke Postivia's access to your Pinterest account at any time from your Pinterest account settings at pinterest.com/settings/security.