Skip to content
Posty
Log inStart free

Privacy Policy

Last updated:

This Privacy Policy explains how Posty (“Posty”, “we”, “us”), a product operated by appzlr, collects, uses, shares and protects personal data when you use the website at posty.appzlr.com and the Posty application (together, the “Service”). Posty helps businesses and the people who run their social media plan, write and schedule posts for Facebook Pages and Instagram accounts.

If you have any question about this policy or your data, email posty@appzlr.com.

1. Who is responsible for your data

appzlr, operating Posty, is the controller of the personal data about you as a Posty user (your account, billing and usage data). For the content you manage in Posty for a business or a client (brand profiles, posts, media, connected accounts), you or the business you work for decide why and how it is used, and we process it on your behalf to provide the Service. You are responsible for having the right to connect those accounts and to use that content.

2. Data we collect

We collect only what the Service needs. We do not ask for national ID numbers, and we never receive or store card numbers or wallet PINs.

Account data. Your email address and, if you give it, your name and profile picture; your language and time zone. You sign in with your email and a password, or with Google, through Firebase Authentication, a Google service. Your password is stored by Firebase in hashed form and never reaches Posty’s servers; Firebase also sends the email-confirmation and password-reset emails. If you sign in with Google, we receive your name, email address and profile picture from Google.

Workspace and brand data. Workspace names, team members and their roles, invitations and settings. For each brand: the business name, industry, a short description of what it sells, the dialect and tone you choose, example posts you paste in, the logo and brand colours.

Content you create. Posts and drafts, scheduled times, monthly content plans, comments, images and videos you upload, and short links with their click counts.

Connected Facebook and Instagram data. When you connect a Facebook Page or an Instagram professional account through Meta’s official login, we receive from Meta, with your permission:

  • an access token that lets Posty publish the posts you schedule;
  • basic information about the Page or account: its ID, name, username and profile picture;
  • simple results for posts published through Posty (likes, comments and shares).

We request only the permissions needed to publish and to show those results. We do not read your private messages or comments, and we never see your Facebook or Instagram password. If you add an account as a manual account instead, we store only the name and username you type.

Client reviews. When a client opens a brand’s approval link, they can approve posts, ask for changes and comment. We store the name they type and their comments; their browser remembers the name for next time. No account is needed.

Billing data. Payments are in Egyptian pounds. Card and wallet payments are processed by Paymob; we receive and keep the transaction reference, plan, amount, status and dates. For InstaPay or wallet transfers, we keep the payment code we gave you and the sender name or number you type so we can match your transfer. We do not handle payments between you and your own customers.

AI features. When you generate captions or a monthly plan, we send the AI provider what it needs to write them: the topic you typed, the brand profile (name, industry, description, dialect, tone and example posts), the occasions involved, and, if you choose, the photo attached to the post. See section 6 for the providers. We store the results only if you save them into a post or a plan.

Usage data. We record a few product events per workspace (for example: signed up, created a brand, generated a caption, scheduled a post, published a post) to understand whether Posty is useful. They are not used for advertising.

Technical data. IP address, approximate country, browser and device type, and logs of requests and errors, used for security, preventing abuse and troubleshooting.

Cookies and local storage. We use one strictly necessary, HTTP-only session cookie to keep you signed in, and your browser’s local storage for small preferences (language, selected workspace, calendar view). We do not use advertising or cross-site tracking cookies. The marketing website loads fonts from Google Fonts.

3. How we use your data

  • To provide the Service: your account, brands, AI suggestions, scheduling, publishing, reminders for manual accounts, team collaboration and client approvals.
  • To publish content only when you or a member of your workspace schedule it or ask to publish it now.
  • To send service emails: reminders to post on manual accounts, failed-post alerts, invitations and billing notices.
  • To process payments and keep the records the law requires.
  • To keep the Service secure, prevent abuse, and improve it using the product events above.

We do not sell or rent personal data, and we do not use data received from Facebook or Instagram for advertising or to build profiles of you or your audience.

We process personal data to provide the Service you signed up for, on the basis of your consent where it is needed (for example when you connect a Facebook Page or Instagram account, which you can withdraw at any time by disconnecting it), to comply with legal obligations such as tax and accounting rules, and for our legitimate interest in keeping the Service secure and working.

We process personal data in accordance with Egypt’s Personal Data Protection Law No. 151 of 2020 and its executive regulations, and other data protection laws that apply to you.

5. Who we share data with

We share data only as needed to run the Service:

Provider What it does for Posty Where
Cloudflare, Inc. Hosting, database, media storage, email delivery, security, and AI processing (Workers AI) Global network, including the United States and the European Union
Anthropic, PBC AI writing of captions and monthly plans United States
Meta Platforms (Facebook, Instagram) Publishing your posts and returning their results, under Meta’s own terms Global
Google (Firebase Authentication) Sign-in with email and password or Google, password storage, confirmation and password-reset emails Global
Paymob Card and wallet payments in Egyptian pounds Egypt

The AI providers process the request to return the result; under their API terms, they do not use it to train their models. We may disclose data if a law or a valid order of a competent authority requires it, or to protect the rights and safety of our users and the Service.

6. Transfers outside Egypt

Our infrastructure and some of our providers are outside Egypt (see the table above), so your data is stored and processed abroad, including in the United States and the European Union. We rely on our providers’ data processing terms and security commitments, and we take the measures required by Egypt’s Law No. 151 of 2020 for cross-border transfers.

7. Security

  • Facebook and Instagram access tokens are encrypted at rest with AES-256-GCM.
  • Passwords are handled by Firebase Authentication and never reach Posty’s servers; every sign-in is checked against Google’s signing keys.
  • All traffic is encrypted in transit with HTTPS/TLS.
  • Access inside a workspace is limited by roles, and approval links can be replaced or revoked at any time.

No system is perfectly secure. If we become aware of a personal data breach affecting you, we will notify you and the competent authority as the law requires.

8. How long we keep data

  • Connected account tokens: deleted immediately when you disconnect the account.
  • Account, workspace and content data: kept while your account is active. When you delete your workspace or account, it is deleted right away in the app and removed from backups within 30 days.
  • Billing records: kept for the period required by tax and accounting law.
  • Your sign-in at Firebase (email and password hash, or the link to your Google account): deleted when you delete your Posty account.
  • Technical logs: kept for a short period (typically up to 30 days).

9. Your rights

Under Egypt’s Law No. 151 of 2020 and other laws that apply to you, you have the right to:

  • know what personal data we hold about you and get a copy;
  • correct inaccurate or incomplete data;
  • have your data deleted;
  • withdraw your consent, for example by disconnecting an account;
  • object to processing or ask us to restrict it;
  • be told about a breach affecting your data;
  • complain to the competent authority (in Egypt, the Personal Data Protection Center).

To exercise any of these rights, email posty@appzlr.com from your account’s email address. We will respond within 30 days. You can delete most data yourself: see our data deletion instructions.

10. Children

Posty is a tool for businesses and is meant for people aged 18 or over. We do not knowingly collect personal data of children.

11. Changes

We may update this policy. If the changes are significant, we will tell you by email or in the app before they take effect. The date at the top shows the latest version.

12. Contact