Privacy Policy

PrimusPost (“we,” “us,” or “our”) provides an AI content repurposing studio that turns your ideas into voice-matched social media posts and carousels. Your drafts and writing style are personal, and this policy explains how we handle them.

This Privacy Policy explains what personal data we collect, how we process and store it, our third-party sub-processors, and your legal rights under global data protection regulations including the General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA).

1. Information We Collect

We collect the following data to provide the service:

• Account & Identity Data: Your name and email address, collected and verified securely via our authentication provider, Clerk.
• User Content & Writing Samples: The drafts, notes, transcripts, web links, PDF files, and past writing samples you add to the Studio, including the samples used to build your voice profile.
• Business Profile: The optional details you add under “About you” in Settings: your posting goal, audience, offer, proof, topics, and facts about your business. If you ask us to read your website, we fetch up to five public pages from the address you give and send their visible text to Google Cloud Vertex AI to suggest answers. We keep only the suggestions you select and save; we do not store the fetched pages.
• Voice Profiles: The stylistic traits (such as tone, sentence length, vocabulary, and formatting habits) learned from your writing samples and from the edits you make to your drafts.
• Generated Output History: The posts, captions, threads, and carousel decks generated by the platform and stored in your Content Library.
• Billing Data: If you buy a paid plan, our Merchant of Record, Dodo Payments, processes your payment details. We receive your plan and subscription status, not your full card number.
• Usage & Technical Data: If you accept optional analytics, product usage events. We also keep server error logs (error message, stack trace, and route) to keep the service reliable, as described in Section 3.
• Product Update Subscriptions: If you subscribe to product updates before registering, your email address and optional writing samples are used only to tell you about product updates and paid plans. They are deleted when you create an account, when you ask us to, or automatically 365 days after you joined, whichever comes first.

2. No AI Model Training on Your Content

We generate content through a paid AI service, Google Cloud Vertex AI, under Google's commercial terms. Under those terms:

• Your content is not used to train, fine-tune, or improve Google's AI models, and we do not use it to train any AI model.
• Your writing samples and inputs are sent to the model only to generate the content you ask for. To answer similar requests faster and at lower cost, Google may keep a temporary copy of a request for up to 24 hours (prompt caching). That copy stays inside our Google Cloud project, is deleted automatically, and is never used for training.
• Like every Vertex AI customer, we are subject to Google's abuse monitoring: if a request is flagged by Google's safety classifiers, Google may keep that prompt for up to 90 days solely to investigate abuse. It is not used for training.

3. How We Use Information (Purpose Limitation)

We use your data for the following purposes:

• To build your voice profile and generate content when you ask for it.
• To suggest a business profile from your website, and to plan content from the profile you save.
• To keep your Content Library and let you edit, regenerate, and export drafts and PDF carousels.
• To authenticate your identity, manage account sessions, and prevent unauthorized access.
• To process subscription billing and credit quotas through our Merchant of Record.
• To detect and prevent platform abuse, fraud, and security threats.

We do not sell, rent, or monetize your personal data or writing samples to third parties or data brokers.

Where the GDPR or UK GDPR applies, each purpose above rests on one of the following legal bases (Article 6):

4. Third-Party Sub-Processors

To provide our cloud services we rely on the following sub-processors. Each is engaged under a data processing agreement, and this list is the complete set that may handle personal data on our behalf:

5. Security & Encryption

We use technical and organizational measures to protect your information, including:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted with TLS 1.2 or higher.
• Encryption at Rest: Database records, stored drafts, and voice profiles are encrypted at rest using industry-standard AES-256 encryption.
• Per-Account Access Controls: Every request for your drafts, posts, and voice profiles is checked against your signed-in account, so other users cannot access them.

6. Data Retention & Account Deletion

We keep your personal data while your account is active, and delete it when you delete your account, except for the limited records described below:

• Self-Serve Deletion: You can delete any individual post or voice profile at any time directly within the Studio or Content Library.
• Complete Account Deletion: To delete your account, email privacy@primuspost.com from the address on your account. Deleting your account permanently purges your user profile and triggers a cascading deletion of all associated voice profiles, post history, and draft carousels from our databases when the deletion is processed. It also dispatches an automated request to erase your associated profile from our external analytics provider (PostHog).
• Writing-Sample Expiry: The raw writing samples behind a voice profile are cleared automatically once the profile has not been updated for 180 days and you have not generated anything in that time. The learned voice traits stay, so your profile keeps working.
• Legal & Billing Records: Records that we or our payment provider must keep for tax, accounting, or legal reasons are kept for the period the law requires, even after account deletion.
• Feedback Expiry: Feedback you send from inside the app is deleted automatically 730 days after you send it, or sooner if you delete your account.
• Strategist Sessions: The newest 50 sessions per user are kept, and any session older than 90 days is deleted automatically.

7. Your Rights (GDPR & CCPA/CPRA)

Depending on your location, you have statutory privacy rights under applicable data protection laws:

• Right of Access & Portability: You have the right to request a copy of the personal data we hold about you in a structured, machine-readable format. You can download it yourself at any time from Settings (“Export my data”), as a JSON file.
• Right to Rectification: You can correct or update inaccurate account information via your Settings.
• Right to Erasure (“Right to be Forgotten”): You can request the complete erasure of your personal data by emailing our privacy team to delete your account.
• Right to Restrict Processing: You can request that we restrict the processing of your data under certain circumstances.
• Right to Object: You can object at any time to processing we carry out on the basis of our legitimate interests, and we will stop unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where we rely on consent (optional product analytics is the only such processing), you can withdraw it at any time through the cookie notice. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.
• No Sale or Sharing: We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not process it for cross-context behavioural advertising. There is therefore nothing for you to opt out of.
• Non-Discrimination: Under the CCPA, we will not discriminate against you (e.g., deny service or alter pricing) for exercising your statutory privacy rights.
• Right to Complain to a Supervisory Authority: If you are in the EEA or the UK, you may lodge a complaint with your local data protection supervisory authority (in the UK, the Information Commissioner’s Office, ico.org.uk) without contacting us first. We would appreciate the chance to address your concern directly, but you are not required to give us one.

To exercise any of these rights, contact us at privacy@primuspost.com. We respond to all verified requests within thirty (30) days.

8. Cookies & Local Storage

Cookies required for authentication and security are always set. Optional product analytics is off until you accept it in our cookie notice, and rejecting it keeps it off. We do not use advertising cookies, retargeting pixels, or cross-site behavioural tracking. For the full cookie table and how to change your choice, see our Cookie Policy.

9. International Data Transfers

PrimusPost stores your data and runs its servers in India (Mumbai). Some sub-processors listed in Section 4 process data in the United States, and AI requests may be processed in any Google Cloud region. When personal data is transferred outside the European Economic Area (EEA) or the UK, we ensure adequate protections are in place by utilizing Standard Contractual Clauses (SCCs) approved by the European Commission, alongside technical encryption safeguards. For transfers to the United States we rely on the European Commission’s Standard Contractual Clauses together with the UK International Data Transfer Addendum where the UK GDPR applies.

Where we are required to designate a representative in the European Union or the United Kingdom under Article 27 of the GDPR or UK GDPR, that representative’s name and contact details will be published in this section. Until then, all data protection enquiries from any jurisdiction should be sent to privacy@primuspost.com, which is monitored for this purpose.

10. Contact

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out to our privacy team:

Data controller: PrimusPost
Data protection enquiries: privacy@primuspost.com
Contractual notices and support: support@primuspost.com

We respond to verified data protection requests within thirty (30) days. If a request is complex or you have made several, we may extend that period by up to two further months and will tell you why within the first thirty days.

For open source licensing and source code availability for components powering our publishing infrastructure, see our Open Source Attribution page.