Privacy Policy

Who we are

Postfetti is run by Venus Cloud Ltd, a company registered in England and Wales (company number 07563716). Our registered office is 1 Richmond Road, Lytham St. Annes, Lancashire, FY8 1PE, United Kingdom.

Venus Cloud Ltd is the controller of the personal information described here. That means we decide how and why it's used, and we're responsible for protecting it.

What we collect

Your account

Your email address, your name if you give it, your sign-in details (passwords are only ever stored in scrambled, hashed form) and your settings, such as your time zone. If you sign in through another service, we receive the basic profile details that service shares, usually your name and email address.

Your projects

The photos you upload, the slideshows you build from them (slide order, text, styling and layout), captions and hashtags, drafts, scheduled posting times and a history of what you've published. Photos can contain hidden details (metadata), such as when and where they were taken. We don't use photo metadata for anything.

If your photos or text include other people, please make sure you have their permission to share them. We process that content only to provide Postfetti to you.

Your connected TikTok account

When you connect TikTok, TikTok shares your account's ID, display name, username and profile picture with us, along with the posting options available to you (such as who can see your posts). We also receive access tokens that let us post on your behalf, and the status of each post we publish. See Publishing to TikTok for details.

Images you import

When importing from Pinterest becomes available, we'll fetch only the images you choose and store them in your project with a link to where they came from. If importing needs you to connect a Pinterest account, we'll receive an access token and basic profile details, used only to import the images you pick.

Payments

Payments are handled by Stripe. Your full card details go straight to Stripe and never reach our servers. Stripe tells us what we need to manage your plan: your billing name, email, country and address, the card type, last four digits and expiry date, and your plan, payment and invoice history.

When you contact us

Your email address, your name if you give it, your message and anything you attach, so we can help. Messages sent through the contact form on postfetti.com are delivered to our support inbox by Cloudflare's email service. We don't keep a separate copy on the website.

To keep bots out of the contact form, it uses Cloudflare Turnstile. Turnstile checks technical signals from your browser and connection, such as your IP address and browser details, solely to tell people from bots, and only loads on the contact page. See Cloudflare's Turnstile privacy addendum.

The waitlist

Your email address, the date and time you joined and a note that you signed up on postfetti.com. We ask for nothing else.

Technical and usage information

Like any online service, we and our hosting provider receive technical information when you use Postfetti: your IP address, browser and device type, the pages and features you use, and error reports. We use it to deliver the service, keep it secure, fix problems and understand which features need work.

Analytics, if you agree

If you accept analytics cookies, we use Google Analytics for Firebase to understand how people use Postfetti: which pages and features are used, roughly where visitors are (city or country), and which browsers and devices they use. It recognises returning visitors with a random identifier stored in a cookie. If you're signed in, we may link analytics to a random account ID, but never to your name, email address, photos or post content. Google doesn't store IP addresses from UK or EU visitors: it uses them only to work out an approximate location, then discards them. If you don't accept, analytics doesn't run.

What we don't collect

We don't use advertising networks or social media tracking pixels, and we don't build advertising profiles. The website's fonts and images are served from our own domain, so loading a page doesn't send your details to font or image services.

How we use it

• To provide Postfetti: your account, storing and editing your projects, previewing slideshows, and publishing or scheduling them to TikTok when you ask.
• To take payments and manage your plan, invoices and refunds.
• To send service emails, such as sign-in and password emails, receipts, security alerts, and notices when a scheduled post is published or fails. You can't opt out of these while you have an account, because they're part of the service.
• To send news about Postfetti: to waitlist members who asked for it, and occasionally to customers about new features. Every one of these emails has an unsubscribe link.
• To support you when you contact us.
• To keep Postfetti secure and working: preventing fraud, spam and abuse, fixing bugs and improving features.
• To understand how Postfetti is used, with your consent, through Google Analytics for Firebase, so we can see what's working and what needs improving.
• To meet legal obligations, such as keeping tax records.

We won't sell your information, share it for anyone else's marketing, use it to promote other Venus Cloud Ltd products without asking you first, or use your photos, text or TikTok data to train AI models.

Our legal basis

UK data protection law (the UK GDPR and the Data Protection Act 2018), and the EU GDPR where it applies, require a legal basis for each use of your information:

• Contract: to provide the service you signed up for, including your account, projects, TikTok publishing, payments and service emails.
• Consent: for waitlist emails, analytics cookies and connecting your TikTok or Pinterest account. You can withdraw consent at any time.
• Legitimate interests: to keep Postfetti secure, prevent fraud and abuse, fix and improve the service, reply to messages, and tell customers about new features. These uses are expected and have little impact on your privacy, and you can object to them.
• Legal obligation: to keep financial records and respond to lawful requests.

Publishing to TikTok

• You stay in control. Postfetti only posts to your TikTok account when you press publish or set up a scheduled post. Before anything is posted, you see the slideshow and choose its settings, such as who can see it.
• What we send to TikTok: the photos in your slideshow, the caption and the post settings you choose. TikTok fetches the photos from a private, hard-to-guess link on our domain that we only keep available for as long as TikTok needs it.
• What we keep: your TikTok account's ID, name and profile picture, so you can see which account you're posting to, plus the access tokens and a record of each post's status. We use TikTok data only to publish and schedule your posts and show you their status, and never for advertising.
• After publishing, your post is on TikTok and TikTok's privacy policy applies to it. Deleting a project in Postfetti doesn't delete a post that's already on TikTok. Delete it in TikTok.
• Disconnecting: you can disconnect TikTok in Postfetti at any time, or remove Postfetti's access in your TikTok app settings. When you do, we delete your access tokens and cancel any scheduled posts.

Postfetti uses TikTok's official APIs but is an independent product, and isn't affiliated with or endorsed by TikTok.

Who we share it with

We share personal information only with:

• Cloudflare, which hosts Postfetti, stores your account data and photos, delivers contact form messages to our inbox, and protects the service from attacks and bots (including Turnstile on the contact form). It acts on our instructions as our processor. See Cloudflare's privacy policy.
• Stripe, which processes payments. It acts as our processor, and as an independent controller for purposes such as fraud prevention and its own legal obligations. See Stripe's privacy policy.
• Google, which provides Google Analytics for Firebase, if you accept analytics cookies. It acts as our processor. We've switched off the settings that would let Google use this data for advertising or link it to your Google account. See Google's privacy policy and how Google uses information from sites that use its services.
• TikTok, when you connect your account and publish, as described above.
• Pinterest, if you connect a Pinterest account to import images.
• Service providers that help us send email, provide customer support and monitor errors. They act on our instructions, under contracts that require them to protect your information.
• Professional advisers, courts or authorities, but only when we're legally required to or need to protect our rights or users' safety.
• A buyer or successor if Postfetti or Venus Cloud Ltd is sold or restructured. They would have to treat your information in line with this policy.

Where it's stored

Venus Cloud Ltd is based in the UK, and Postfetti is used around the world. Your account data, projects and photos are stored by Cloudflare, mainly in the United States. Cloudflare handles requests through its global network, so technical information may be processed in a data centre near you. Stripe processes payment information, and Google processes analytics data, in the United States and other countries. Once you publish, TikTok handles your post under its own policy.

Where your information is transferred outside the UK, it's protected by safeguards recognised under UK data protection law, such as UK adequacy regulations, the International Data Transfer Addendum to the EU standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework.

How long we keep it

• Your account and projects: for as long as your account is open. When you delete a photo or project, it's removed from your account straight away and from our systems within 30 days.
• When you close your account: we delete your account, projects, photos and TikTok tokens within 30 days. Backups are overwritten within a further 60 days.
• TikTok and Pinterest access tokens: until you disconnect, close your account, or the platform tells us access has been removed.
• Payment records: six years from the end of the financial year they relate to, as UK tax law requires. Stripe keeps its own records under its policy.
• Support messages: up to 12 months after the conversation ends, unless we need them longer to deal with a legal issue.
• Technical and security logs: usually no more than 30 days, unless we need them to investigate a security problem.
• Analytics data: deleted automatically by Google Analytics after 14 months.
• Waitlist emails: until you unsubscribe or ask us to delete them, and no longer than 12 months after Postfetti launches. If we decide not to launch, we'll delete the waitlist within 30 days of that decision.

Keeping it safe

All connections to Postfetti are encrypted. Access tokens for TikTok and Pinterest are encrypted when stored, card details are handled only by Stripe, and access to personal information inside our company is limited to people who need it to run the service. No system is perfectly secure, so if we ever discover a breach that puts your information at risk, we'll tell you and the regulator as the law requires.

Cookies

• Strictly necessary cookies keep you signed in and protect forms from abuse. Cloudflare may set a security cookie to tell people and automated bots apart.
• Payment cookies: when you pay, Stripe uses cookies and device information to process the payment and prevent fraud.
• Analytics cookies (optional): set by Google Analytics for Firebase only if you accept them. Their names start with _ga. They hold a random identifier so we can count visits and returning visitors, and last up to two years unless you clear them.

We don't use advertising or cross-site tracking cookies. On your first visit we ask whether you're happy with analytics cookies. Saying no doesn't affect anything else on the site. You can change your choice at any time with the Cookie settings link at the bottom of every page.

Your rights

You have the right to:

• get a copy of the personal information we hold about you
• have it corrected if it's wrong
• have it deleted
• restrict or object to how we use it
• receive the information you gave us in a portable format
• withdraw your consent at any time, without affecting anything we did before you withdrew it

You can edit your details, delete projects, disconnect TikTok and close your account from within Postfetti. For anything else, use our contact page and give the email address on your account. We may ask you to confirm it's you. It's free, and we'll reply within one month.

If you're unhappy with how we've handled your information, please tell us first so we can try to put it right. You can also complain to the UK Information Commissioner's Office at ico.org.uk, or to the data protection authority where you live.

Children

Postfetti isn't for children under 13, and you must also be old enough to use TikTok where you live. We don't knowingly collect children's information. If you think a child has given us their details, use our contact page and we'll delete them.

Changes to this policy

We'll update this page when our practices change and change the date at the top. If a change significantly affects how we use your information, we'll tell you by email or in the app before it takes effect.

Contact us

Use our contact page.