Draft for legal review. Highlighted details are still to be added.
Privacy Policy
Last updated October 27, 2026
This policy explains what personal data Postbutter handles, why, and the choices you have. It covers our website, the Postbutter app and the emails we send.
1. Who we are, and our two roles
Postbutter is a product of Aicha Ventures LLC (“Aicha Ventures”, “we”, “us”), a Wyoming limited liability company, USA, [REGISTERED ADDRESS]. Contact us at [email protected].
- For your account (your sign-in, billing and how you use Postbutter) we are the controller.
- For your audience’s data (the people who comment on your Reels or message you, and what they send) you, the creator, are the controller and we are your processor. We handle it only to run Postbutter for you, as set out in our Data Processing Addendum. If you are someone who messaged a creator, contact that creator first; we will help them answer you.
2. What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Account | Name, email, a hashed password or your Google sign-in ID, profile picture, team members and roles | You, or Google if you sign in with it |
| Instagram account | Username, profile picture, follower count, your Reels, captions and their insights (views, reach, likes, comments, saves, shares, follower growth) | Instagram, after you connect and approve access |
| Your audience | Usernames, profile pictures and follower status of people who comment or DM you, the text of their comments and messages, and anything they share in a conversation (such as an email address) | Instagram, through your connected account |
| What you create | Automations, flows, tags, notes, campaigns, scheduled Reels, AI reply settings | You |
| Billing | Plan, invoices, payment status. Card details are handled by our payment provider; we never see or store full card numbers. | You and our payment provider |
| Usage and security | Sign-in sessions, a record of important actions (for example “automation turned on”), how many DMs and AI replies were sent, error logs | Your use of Postbutter |
| Website visits | A daily, one-way visit code and the page and button used. No cookies, no IP address stored. | Your browser |
What we don’t collect: your Instagram password, your follower list, or who viewed your Reels. Instagram doesn’t give these to apps. We don’t buy data about you or your audience.
3. How we use it, and our legal bases
| Purpose | Legal basis (EU/UK) |
|---|---|
| Run Postbutter: show analytics, send the DMs and replies your automations promise, publish what you schedule, keep your inbox in sync | Contract with you |
| AI replies, only if you turn them on: the recent messages of a conversation and what you wrote in Settings are sent to our AI provider to write a reply | Contract with you |
| Billing, invoices, taxes and accounting | Contract; legal obligation |
| Service emails: confirmations, receipts, trial and renewal notices, security alerts | Contract; legitimate interests |
| Security, preventing abuse and keeping within Instagram’s rules | Legitimate interests; legal obligation |
| Counting website visits and sign-ups, and improving Postbutter from usage totals | Legitimate interests |
We don’t sell personal data, share it for cross-context behavioural advertising, or use it for advertising profiles. We don’t use your data or your audience’s messages to train AI models, and our AI provider is not allowed to either. We don’t make decisions with legal or similarly significant effects by automated means alone.
4. Instagram data
We access Instagram only through its official platform and only with the permissions you approve. We use Instagram data only to provide Postbutter’s features to you, in line with Meta’s Platform Terms. You can revoke access at any time by disconnecting in Postbutter’s Settings, or in Instagram under Settings → Website permissions / Apps and websites.
5. Who we share it with
- Service providers that run parts of Postbutter for us: Instagram platform connectivity, hosting and databases, payments, email delivery and, if you use AI replies, an AI model provider. They act only on our instructions under contracts that protect your data. See Subprocessors.
- Instagram, when Postbutter sends a message, reply or post you asked it to.
- Your team: people you invite to your workspace can see its data.
- Authorities or others when the law requires it, to protect rights and safety, or as part of a merger or sale of our business (with notice to you).
6. International transfers
Our providers may process data outside your country, including in the United States. When data leaves the EU, EEA, UK or Switzerland we rely on an adequacy decision (such as the EU–US Data Privacy Framework, where the provider is certified) or the European Commission’s Standard Contractual Clauses and the UK Addendum, with extra safeguards where needed.
7. How long we keep it
- Your account and workspace: while your account is open. When you delete your account we delete its workspace data at once, and it disappears from backups within 30 days.
- A disconnected Instagram account: its Reels, conversations and audience data are deleted 30 days after you disconnect, unless you reconnect it first.
- Invoices and payment records: as long as tax and accounting law requires (often up to 10 years), kept by our payment provider and in our records.
- Website visit counts: 90 days.
- Security logs: up to 12 months.
8. Your rights
Depending on where you live (including under the GDPR, UK GDPR and US state laws such as the CCPA/CPRA), you can ask to access, correct, delete or receive a copy of your personal data, object to or restrict some uses, and withdraw consent where we rely on it. You can also complain to your data protection authority.
- Download your data: Settings → Your data → Export.
- Delete your account: Settings → Your data → Delete account. See Data deletion.
- Anything else: email [email protected]. We answer within 30 days (45 days where US state law allows) and may need to confirm it’s you. You can use an authorised agent. We won’t treat you differently for using your rights.
California residents: in the last 12 months we collected the categories in section 2 for the purposes in section 3, disclosed them only to the service providers in section 5, and did not sell or share them. We honour Global Privacy Control signals.
9. Cookies
We use only cookies that Postbutter needs to work, such as keeping you signed in. No advertising or tracking cookies. See the Cookie Policy.
10. Security
Data is encrypted in transit, passwords are hashed, keys are kept only on our servers, and access is limited to people who need it. No system is perfectly secure; if a breach affects you we will tell you and the authorities as the law requires. More on our Security page.
11. Children
Postbutter is not for anyone under 18. We don’t knowingly collect data from children; if you think we have, contact us and we will delete it.
12. Changes
We will post changes here and update the date above. For important changes we will tell you by email or in the app before they take effect.
13. Contact
Aicha Ventures LLC, [REGISTERED ADDRESS]. Email [email protected].