Privacy Policy

Last updated: 17 October 2026

This Privacy Policy explains how PostBakery ("PostBakery", "we", "us", or "our") collects, uses, shares, and protects your personal data when you use our website at postbakery.aiand our related services (the "Service"). We are committed to processing personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Bulgarian data-protection law.

1. Who we are (Data Controller)

The data controller responsible for your personal data is:

• Melsona Ltd. („Мелсона“ ЕООД)
• Registered in the Republic of Bulgaria, UIC (ЕИК): 208959125
• Registered address: 22 Neofit Bozveli St., Sukhata Reka, 1505 Sofia, Bulgaria
• Contact for privacy matters: privacy@postbakery.ai

2. What data we collect

2.1 Account data

When you create an account we collect your email address and a securely hashed version of your password. We never store your password in plain text.

2.2 Brand and project data

To generate on-brand content we process the information you provide about your brand: project names, brand voice descriptions, website URLs, uploaded screenshots and product photos, extracted color palettes, and the prompts you write. We also store the images, captions and videos we generate for you.

2.3 Videos, audio and voice

When you create a Reel or video Story we process the material you provide for it: video clips you upload (including their original sound), music files you upload for a project or a single video, and the voice-over scripts you write or edit. To build the video we generate a synthetic voice-over from the script (a stock AI voice — we never clone your voice or anyone else's), transcribe that voice-over to time the subtitles, and may describe a frame of your clip to an AI model so the script and motion match what is in it.

Your clips may show or record other people, such as staff or customers. For that personal data you decide what to upload and publish, and we process it on your behalf only to make and publish the video you ask for. Please upload footage of other people only where you have their permission or another lawful basis.

2.4 Data from connected Meta accounts (Facebook & Instagram)

If you choose to connect a Facebook Page or Instagram Business account in order to publish posts, we access and store only the data needed to provide that feature:

• The Facebook Page ID and name, and the Instagram Business account ID and username, that you select.
• Access tokens issued by Meta, which are encrypted at rest and used solely to publish content you explicitly create and approve.
• The granted permission scopes (for example instagram_content_publish, pages_manage_posts, instagram_manage_insights, read_insights).
• Performance statistics of the posts you published through PostBakery (for example reach, views, reactions, comments and shares), read from Meta and shown next to each post.

We request these permissions through Meta's official Login flow and use them only to publish the posts you create in PostBakery to the accounts you connect and to show you how those posts perform. We do not read your private messages, the content of comments, we do not post without your action, and we do not use Meta Platform Data for advertising or profiling.

2.5 Payment data

Paid subscriptions are processed by Stripe. We do not collect or store your full card number. We receive from Stripe a customer identifier, subscription status, and limited billing metadata needed to manage your plan.

2.6 Usage and device data

Our servers keep standard technical logs (IP address, browser type, request timing) needed to operate and secure the Service. In addition, and only if you accept analytics cookies, we collect product analytics in your browser through PostHog: pages visited, features used, and product events such as sign-up or post generation. See section 5 for the cookies involved and how to change your choice.

Separately, and only if you accept marketing cookies, the Meta Pixel on our website tells Meta which of our pages you visit and whether you sign up or buy a plan, so we can measure our own advertising on Facebook and Instagram. See section 5.

2.7 Push notifications

You can ask PostBakery to notify you on a device when a post or reel is ready, or when something needs your attention. This is off by default. A push subscriptionis created only when you turn on "Notify me on this device" and grant the notification permission your browser then asks for. For each device you enable we store the subscription endpoint (a URL issued by your browser's push service), the subscription's public encryption key and authentication secretyour browser generates for it, the browser's user-agent string, when the subscription was created and last seen, and the status of the last failed delivery, if any.

A notification contains only a short title and one line of text (the project name, whether it is a post, story or reel, and a note such as whether credits were returned), a link into the app, and the internal id and type of the notification — never your prompt, caption, image, a failure reason or any Meta Platform Data. The message is encrypted for your browser before it leaves our servers. Your browser's push service relays the encrypted message but cannot decrypt its contents; it receives the subscription endpoint it issued and the technical information needed to route the message. We also keep an in-app record of each notification for 90 days so you can find it in the app: the notification type, the post and project ids, and for failures an internal error code and the platform names — never the failure message, your prompt, caption or image.

When a subscription is deleted.Immediately when you switch notifications off for that device; immediately for all your devices when you use "Log out of all devices", change or reset your password, or your account is deleted. Signing out on a device makes that browser forget its subscription and ask us to delete the record. Independently of this, we delete a subscription automatically 7 days after the push service reports it dead, or after 60 days without you opening the app signed in on that device. You can also revoke the permission in your browser or device settings at any time, which stops delivery.

3. How we use your data and our legal bases

4. Third parties and sub-processors

We share data only with service providers who process it on our behalf and under contract and, for push notifications, with your browser's push service (see below):

• Meta Platforms — to publish content to your connected Facebook and Instagram accounts.
• Anthropic — to write captions, post ideas and video scripts from your prompts and brand inputs, and to describe uploaded images and video frames.
• OpenAI — to generate images, synthetic voice-overs, and the transcription that times the subtitles.
• fal.ai (Features & Labels Inc.) and the video models it runs for us — to turn your post image into a video clip and to add ambient sound to it. They receive your post image, the clip generated from it and text prompts — never the clips you upload.
• Stripe — payment processing.
• Amazon Web Services / CloudFront — hosting, media storage and delivery, including the processing of your uploaded clips and music into the final video.
• PostHog — product analytics.
• Meta Platforms Ireland — advertising measurement through the Meta Pixel, only with your marketing consent. For this collection Meta acts as a joint controller with us (see section 5).
• Your browser's push service — to deliver the notifications described in section 2.7, only if you turned them on. Depending on your browser this is Google (Chrome, Edge and most Android browsers), Apple (Safari and iOS), Mozilla (Firefox), Microsoft (Edge on Windows), Samsung (Samsung Internet) or Huawei (Huawei Browser); we deliver to no other push service. They receive the encrypted notification and the subscription endpoint they issued — never your account data or Meta Platform Data. Each push service is operated by the maker of your browser under its own privacy terms.

We do not sell your personal data, and we do not share Meta Platform Data with any party except as needed to deliver the publishing feature you requested.

5. Cookies and similar technologies

A cookie is a small text file placed in your browser. We use three kinds. Strictly necessary cookies are required for the Service to work and are set without consent, as permitted by Article 5(3) of the ePrivacy Directive (Art. 4a of the Bulgarian Electronic Communications Act). Analytics cookies are optional and are set only after you opt in through the cookie banner. Marketing cookies are optional too, are set only after a separate opt-in, and are used solely to measure our own advertising on Meta platforms. We do not sell data or show third-party ads on the Service.

Changing your choice.Use the "Cookie settings" link in the footer of every page to give or withdraw consent at any time. Withdrawing consent stops the affected category immediately and removes its cookies (PostHog's cookies and storage, Meta's _fbp/_fbc) from your browser; it does not affect the lawfulness of processing that took place before the withdrawal. We ask again after 12 months, or earlier if the cookies we use change.

Analytics data is processed by PostHog on servers in the European Union and is not combined with advertising profiles. Signed-in users may be associated with their account so we can understand how features are used across sessions.

Meta Pixel

If you accept marketing cookies, our website loads the Meta Pixel. It sends Meta Platforms Ireland Ltd. the address of the page you are on, the event (page view, viewing prices, sign-up, email confirmation, starting checkout, purchase and its value), your IP address, your browser details and the _fbp/_fbccookies. We do not send your name or email address from your browser, and we do not use Meta's automatic form or button tracking. For the collection and transmission of this data we and Meta are joint controllers (GDPR Art. 26) under the Meta Controller Addendum to the Meta Business Tools Terms; Meta is responsible for what it does with the data afterwards, as described in the Meta Privacy Policy. You can manage how Meta uses it for ads in your ad preferences. The Meta Pixel never receives data from your connected Facebook or Instagram accounts (Meta Platform Data). Withdrawing marketing consent stops the pixel at once and deletes its cookies.

6. International transfers

Some of our sub-processors are located outside the European Economic Area. Where data is transferred internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. Our AI providers (Anthropic, OpenAI and fal.ai) process requests in the United States, and fal.ai may also run video models on servers in other countries. Meta Platforms, Inc. (United States), which receives Meta Pixel data, is certified under the EU-US Data Privacy Framework.

7. Data retention

We keep your account and content data — including uploaded clips and music, scripts, and the images and videos we generate — for as long as your account is active, or until you delete the post, file or project they belong to. Meta access tokens are retained only while a connection is active; when you disconnect an account or delete your PostBakery account, the related tokens and connection data are deleted. Certain records (such as invoices) may be retained longer where required by law. See our Data Deletion page for details. Push subscriptions and the in-app notification records follow the shorter periods in section 2.7 (subscriptions until you switch them off for that device, log out of all devices, change or reset your password or delete your account, and automatically 7 days after the push service reports them invalid or 60 days unused while signed in; notification records 90 days).

8. Security

We use industry-standard measures including encryption in transit (TLS), encryption of access tokens at rest, hashed passwords, and access controls. No method of transmission or storage is completely secure, but we work to protect your data and to limit access to it.

9. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, and port your personal data, and to object to certain processing. You may exercise these rights at any time by emailing privacy@postbakery.ai. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (КЗЛД) or your local supervisory authority.

10. Deleting your data

You can delete your account and all associated data from within the application, by email, or — for data we accessed through Meta — by removing PostBakery from your Facebook settings, which triggers automatic deletion on our side. Full instructions are on our Data Deletion page.

11. Children

The Service is not directed to individuals under 16, and we do not knowingly collect their personal data.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will revise the "Last updated" date above and, where changes are material, provide additional notice.

13. Contact us

For any privacy question or request, contact us at privacy@postbakery.ai.