Privacy Policy

This policy explains what personal data WhatPost (“we”, “us”) collects, why, who helps us process it, and the choices you have. It covers the website at whatpost.io and the WhatPost app.

The short version

• We collect what we need to run WhatPost for you: your account, what you create in it, and the public Instagram data you ask it to read.
• We don’t sell your data, we don’t use advertising trackers, and we never use your content to train AI models.
• You can get a copy of your data, correct it or delete it by emailing us. A deleted account is gone within 30 days.

What we collect

What you give us

• Your account: your email address, your name, and your password, which is stored only as a secure hash that we can’t read. If you continue with Google, Google shares your name, email address and profile picture with us.
• Your workspace: the accounts you track, the videos you ask us to analyse, the notes and files you add, your Brand files, your messages in the Writers’ Room and the scripts you make.
• Support: what you write to us.

From your own Instagram account, if you connect it

On plans that include it, you can connect your own account, read-only. We then receive your profile details, your posts and their performance figures, and summaries of your audience, such as age ranges, gender, countries and cities, as totals rather than as individuals. WhatPost never posts, comments or sends messages for you. You can disconnect in Settings at any time.

Public information about other accounts

When you track an account or analyse a video, we collect publicly available information about it: the profile, its videos, captions, performance figures and public comments. This can include information about the people who posted or commented. We use it only to give our users analysis.

Collected automatically

• Sign-up protection: Cloudflare Turnstile checks sign-ups for bots, using technical signals from your browser.
• Error reports: when something breaks in the app, a report goes to Sentry. It doesn’t include your email, name or IP address, though Sentry works out an approximate location, such as the country and city, from the connection.
• Server logs: our hosting providers record technical data, such as IP addresses, to deliver and protect the service.
• Usage: we record what you use, such as how many videos you analyse, to apply your plan’s limits and to understand, as totals, how WhatPost is used.

Payments

Payments are handled by Creem, our Merchant of Record, which collects your payment details and billing address. We never see or store your card number. We receive what we need to manage your plan: which plan you’re on, its billing status and your country for tax.

How we use it

• to run the service: analyse videos, build your Brand files, write with you and apply your plan;
• to keep the service secure and prevent abuse;
• to support you, and to send emails about your account and billing;
• to send product emails, such as new features, tips and offers. Each has an unsubscribe link, and opting out doesn’t affect emails about your account;
• to improve WhatPost, using usage figures as totals, never your content;
• to meet our legal obligations.

We never use your content to train AI models, and we don’t sell your personal data or share it for advertising.

If you’re in the European Economic Area or the United Kingdom, we rely on these legal bases: performing our contract with you (running your account), our legitimate interests (security, improving the service, and analysing public content for our users), your consent (product emails where it’s required, which you can withdraw at any time), and legal obligations.

Cookies

We don’t use advertising or tracking cookies, on the website or in the app. The app uses your browser’s storage to keep you signed in, and Cloudflare may set a strictly necessary cookie to protect the service. If this ever changes, we’ll update this policy first.

Who helps us process it

We share personal data only with the providers that help us run WhatPost, and only what each one needs. They process it on our behalf:

• Cloudflare: hosts the website and the app, and checks sign-ups for bots (Turnstile)
• Supabase: stores your account, sign-in, workspace and uploaded files (United States)
• Google Cloud: runs background processing, holds videos briefly while they are analysed, and provides AI models (Vertex AI)
• Anthropic: provides AI models for analysis and writing (Claude)
• Groq: turns the speech in a video into text
• SocialFetch and ScrapeCreators: provide publicly available Instagram data: profiles, Reels, captions and public comments
• Zernio: connects your own Instagram account, on plans that include it
• Sentry: receives error reports when something breaks in the app
• Creem: sells paid plans, processes payments and issues refunds

When you analyse a video or write with WhatPost, the content involved is sent to our AI providers to produce the result. We use their business services, whose terms don’t allow them to train their models on what we send.

We may also disclose data when the law requires it, or to protect the rights and safety of our users or others. If WhatPost is ever sold or merged, your data would move under this policy, and we would tell you first.

Where it’s processed

Mainly in the United States, where our main providers store and process data, and wherever our other providers operate. Where the law requires safeguards for these transfers, we rely on our providers’ data protection terms, such as standard contractual clauses.

How long we keep it

• Your account and workspace: while your account is open. When you ask us to delete your account, we delete it within 30 days, and backups expire on their normal cycle after that.
• Analyses of public videos: while they’re useful to the service. They contain nothing about you, and they may be reused for other people who analyse the same video.
• Payment records: kept by Creem for as long as tax law requires.
• Support emails: for as long as we need them to help you.

Your rights and choices

You can ask us for a copy of your data, to correct it, to delete it, or to stop or limit how we use it. You can withdraw consent you’ve given, and you can complain to your local data protection authority. Email support@whatpost.io from your account’s address and we’ll respond within 30 days. It costs nothing.

If you’re in California: we don’t sell or share your personal information, and we won’t treat you differently for using your rights.

If you’re a creator whose public content appears in WhatPost, you can ask us to stop processing it, or to delete what we hold, at the same address.

Security

Data is encrypted in transit, every account’s data is kept separate at the database level, passwords are stored as hashes, and access to production systems is limited. No system is perfectly secure; if a breach affects your data, we’ll tell you as the law requires.

Children

WhatPost is for people aged 18 and over. We don’t knowingly collect data from anyone younger, and if we learn that we have, we delete it.

Changes to this policy

If we change this policy in a way that matters, we’ll email you before the change applies, and the date at the top of this page will change.

Contact

Questions or requests about your data: support@whatpost.io.