Legal

Privacy Policy

Last updated: August 24, 2026

Postcard is a social-content collaboration platform operated by Social Postcard LLC (“Postcard”, “we”, “us”) and available at getpostcard.ai. This policy explains what information we collect when you use Postcard, why we collect it, who we share it with, and the choices you have. If anything here is unclear, email us at support@getpostcard.ai.

Information we collect

Account information. When you sign up, our authentication provider (Clerk) collects your name, email address, and sign-in credentials. We keep a linked app profile (name, email, role, workspace membership).
Workspace content. The content you and your team create in your workspace: postcards (briefs, scripts, captions, comments), uploaded media (images and video), whiteboard notes, approval decisions, and activity history. Content is scoped to your organization’s workspace.
Connected social accounts. If you connect social media accounts for publishing, our publishing partner (Ayrshare) stores the connection and account identifiers needed to post on your behalf and retrieve post analytics.
Billing information. Payments are processed by Stripe. Your card details go directly to Stripe and never touch our servers; we keep only your subscription status, plan, and Stripe customer reference.
Pre-signup inquiries. If you contact us through the forms on our website (contact, enterprise, or partner inquiries), we collect the name, email, company, phone number, and message you provide.
Support requests. When you file a support ticket, we keep the ticket contents and your contact details so we can respond.
Usage and device data. We collect product analytics (pages visited, features used) via PostHog and error/diagnostic data via Sentry to keep the product working and improve it.

How we use information

To provide and operate the service: creating and collaborating on content, storing media, routing approvals, and publishing to the social networks you connect.
To power optional AI features you invoke — for example generating briefs, scripts, and captions, transcribing video, or running research for a post.
To bill for subscriptions and manage your plan.
To send transactional email (invites, approval requests, notifications) and, if your workspace enables it, Slack notifications — including optional direct messages, which require matching your work email to your Slack account with your consent.
To respond to support requests and sales inquiries.
To secure the service, prevent abuse, and debug errors.
To understand how the product is used, in aggregate, so we can improve it.

We do not sell your personal information, and we do not use your workspace content to train AI models.

Service providers

We rely on a small set of processors to run Postcard. Each receives only the data needed to perform its function:

Clerk — authentication and account management.
Stripe — payment processing (card data is handled entirely by Stripe).
Ayrshare — social account connections, publishing, and post analytics.
Amazon Web Services (S3) — media file storage.
Mux — video processing and streaming.
OpenAI — AI-assisted briefs, scripts, and captions when you use those features.
AssemblyAI — audio/video transcription when you use that feature.
Tavily — web research for content ideas when you use that feature.
Resend — transactional email delivery.
Slack — workspace notifications, if your organization connects Slack.
Google Drive / Dropbox — optional file pickers, only if you choose to import files from those services.
PostHog — product analytics.
Sentry — error tracking and diagnostics.
Railway — application hosting and databases.

We may also disclose information if required by law, or as part of a merger, acquisition, or sale of assets (in which case this policy continues to apply to your data).

Where your data lives

Postcard is hosted on Railway in the United States (us-east4 region). If you use Postcard from outside the US, your information is transferred to and processed in the United States.

Cookies

We use a small number of cookies:

sc_session — our own session cookie that keeps you signed in to your workspace.
Clerk cookies — set by our authentication provider to manage your sign-in session.
PostHog cookies — analytics cookies that help us understand product usage.

We don’t use third-party advertising cookies. You can block or clear cookies in your browser, though blocking session cookies will prevent you from staying signed in.

Data retention

We keep your account information and workspace content for as long as your account is active. If you cancel, your workspace content remains available on the free tier unless you ask us to delete it. When an account is deleted, we delete or de-identify associated personal information within a reasonable period, except where we must retain records for legal, billing, or security purposes. Backups roll off on a fixed schedule. Analytics and error data are retained per our providers’ standard retention windows.

Your rights and choices

Depending on where you live, you may have rights to access, correct, export, or delete your personal information. To exercise any of these rights — or to ask questions about your data — email support@getpostcard.ai and we will respond within a reasonable timeframe. You can also update most account details directly in your profile settings, and disconnect social accounts or integrations at any time.

Children

Postcard is a business tool and is not directed at children under 13. We do not knowingly collect personal information from children under 13; if you believe a child has provided us information, contact us and we will delete it.

Changes to this policy

We may update this policy as the product evolves. If we make material changes, we will update the date at the top of this page and notify workspace owners by email or in the product before the changes take effect.

Contact us

Social Postcard LLC — questions, requests, or concerns: support@getpostcard.ai.