Privacy Policy

1. Introduction

PostloomAI ("the Service") is developed and operated by SMB Robotics. We provide a social media management and publishing platform that helps creators, businesses, and agencies manage multi-channel publishing, smart scheduling, and analytics.

This Privacy Policy applies to all visitors, registered users, and connected accounts across our web application and official APIs.

2. Data We Collect

We may collect, use, store, and transfer different kinds of personal data about you, grouped as follows:

• Identity Data — First name, last name, username, and profile photo provided during account creation.
• Contact Data — Email address, billing contact details, and customer support communications.
• OAuth & Social Media Data — Encrypted access tokens, account IDs, page handles, and channel metadata for connected platforms (Facebook, Instagram, LinkedIn, TikTok, YouTube, Pinterest) authorized via official OAuth 2.0 flows.
• Content & Brand Data — Post copy, media uploads, brand voice guidelines, and article drafts created inside your workspaces.
• Technical & Usage Data — IP address, browser type, operating system, and feature interaction metrics collected to secure and improve the platform.

3. How We Use Your Data

We only use your personal data when the law allows us to. Most commonly, we process your data:

• To provide and maintain the PostloomAI service (generating campaigns, scheduling posts, and analyzing performance).
• To publish content to your connected social channels strictly based on your explicit authorization and scheduled workflows.
• To manage payments, credit allocations, and subscription entitlements through our Merchant of Record.
• To detect fraud, prevent abuse, and safeguard platform security.

4. Meta & Social Platform API Compliance

When you connect your Facebook Pages or Instagram Professional accounts, we request official permissions such as pages_manage_posts, pages_read_engagement, and instagram_content_publish. This access is used strictly to automate your social media content workflow.

We never sell, rent, or trade your social media data. We do not use your private content for third-party targeted advertising. You can disconnect accounts and revoke permissions at any time directly through your PostloomAI Integrations settings or within your Meta Business Manager.

5. Google User Data, Workspace (Gmail) & YouTube API Services Compliance

PostloomAI accesses Google user data exclusively when you choose to connect your Google account (such as YouTube or Gmail) via official Google OAuth 2.0 authorization. We request the minimum necessary permissions: for YouTube (youtube.readonly, youtube.upload, youtube.force-ssl to manage and publish scheduled video content) and for Gmail (gmail.send and gmail.modify to draft, send, search, and organize email campaigns and inquiries upon your explicit request).

With Whom We Share, Transfer, or Disclose Google User Data: PostloomAI does NOT sell, rent, lease, or trade Google user data to any third parties. We do NOT share Google user data with external advertisers, data brokers, or marketing networks. Google user data is transferred or disclosed ONLY: (1) directly to official Google API endpoints to execute your requested actions (such as sending an email or publishing a video); (2) to our secure, encrypted database solely to maintain your active OAuth authentication tokens; and (3) if strictly required by applicable legal process or government regulations.

Strict Prohibition on AI / ML Model Training (Google Workspace Limited Use Compliance): PostloomAI strictly complies with the Google Workspace API User Data and Developer Policy and Google API Services User Data Policy. Google Workspace user data (including raw, aggregated, or derived data from Gmail) is NEVER used, transferred, or sold to create, train, retrain, or improve generalized or foundational artificial intelligence (AI) or machine learning (ML) models.

AI Processing Safeguards: Any automated text generation or assistance (such as drafting an email reply or summarizing an inquiry) is processed solely through enterprise, commercial-tier APIs (such as Google Cloud Vertex AI / Gemini Enterprise API) that explicitly guarantee Zero Data Retention for model training. Prompts and Workspace data are processed ephemerally in-memory for the single session to fulfill the user's explicit command and are never stored or retained for model training.

Limited Use Compliance: PostloomAI's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements (https://developers.google.com/terms/api-services-user-data-policy) and the Google Workspace API User Data and Developer Policy (https://developers.google.com/workspace/workspace-api-user-data-developer-policy).

Revocation & Data Deletion: You can revoke PostloomAI's access to your Google account at any time via Google Security Settings (https://myaccount.google.com/permissions) or by disconnecting your Google account in your PostloomAI Integrations dashboard. Disconnecting immediately and permanently deletes all stored Google OAuth tokens from our servers.

6. Pinterest API Services & Developer Compliance

When you choose to connect your Pinterest account to PostloomAI, we utilize the official Pinterest API (v5) via standard OAuth 2.0 authorization in full compliance with the Pinterest Developer Terms of Service and Community Guidelines.

Requested Scopes & Permitted Use: We request only the minimum scopes necessary to provide social media publishing and reporting services: user_accounts:read (to identify your account and profile), boards:read and boards:write (to retrieve your boards and allow you to select or organize boards for publishing), and pins:read and pins:write (to publish your user-composed Pins and retrieve performance analytics such as impressions, saves, and outbound clicks for your own published content).

No Unauthorized Mass-Publishing or Scraping: All Pin creations and scheduling actions are user-directed. PostloomAI does not perform unauthorized bulk scraping, mass-pinning, or automated bot syndication. Each Pin is authored, reviewed, and scheduled at the explicit direction of the authenticated user.

Data Protection & Confidentiality: Pinterest user data, authentication tokens, and metrics are never sold, rented, leased, or disclosed to third-party data brokers or advertising networks. Pinterest content and user data are never used to train, retrain, or fine-tune machine learning or artificial intelligence models.

Revocation & Account Disconnection: You retain complete control over your connected Pinterest account. You can disconnect your Pinterest integration at any time from your PostloomAI Integrations settings, or revoke access directly from your Pinterest Account Settings under 'Security & Logins' / 'Apps'. Revocation immediately and permanently removes all stored Pinterest OAuth access and refresh tokens from our systems.

7. Data Security & Storage

We implement enterprise-grade security controls to protect your personal data from unauthorized access, accidental loss, alteration, or disclosure. All OAuth access tokens and sensitive credentials are encrypted at rest using AES-256-GCM and transmitted over secure TLS 1.3 channels.

8. Your Privacy Rights

Under applicable privacy regulations (including GDPR and CCPA), you have the right to access, rectify, export, or permanently delete your personal information. You can request full data export or account erasure at any time by contacting our support team at contact@postloomai.pro.