This policy explains how Khamarx LLC, a New Mexico limited liability company that operates PostCherry ("PostCherry", "we", "us"), collects, uses, shares and protects personal data when you use postcherry.com and the PostCherry app at app.postcherry.com (together, the "Service"). We are the data controller for this data.
1. Data we collect
- Account data: your name, email address, password (stored only as a secure hash), company or brand name, and team members you invite.
- Connected social accounts: when you connect a social network, that network sends us an access token (and sometimes a refresh token), your account or page ID, display name, username and profile picture. We never see or store your social network passwords.
- Your content: posts, captions, images, videos, comments, schedules and settings you create in PostCherry.
- Statistics from networks: numbers about your own accounts and posts, such as followers, likes, comments, views and impressions.
- Payment data: payments are handled by Stripe. We receive your billing status and the last digits of your card, never the full card number.
- Technical data: server logs (IP address, browser type, time of request) and the cookies needed to keep you logged in.
2. Data we receive from each social network
We only request the permissions a feature needs, and you choose which accounts to connect.
- Facebook and Instagram (Meta): the list of Pages and Instagram professional accounts you manage, their names and pictures, permission to publish posts you schedule, and insights (statistics) for those Pages and accounts.
- Threads: your Threads profile basics, permission to publish posts you schedule, and statistics for your posts.
- TikTok: your TikTok profile basics (display name, avatar), the posting options TikTok allows for your account, and permission to publish the videos or photos you choose, with the privacy settings you choose for each post.
- YouTube (Google): your channel name and picture, permission to upload videos you schedule, and statistics for your channel and videos.
- LinkedIn: your name and profile picture, permission to post on your behalf, and, if you connect a Company Page you administer, permission to post to that Page and read its statistics.
- X, Pinterest and other networks: your profile basics, permission to publish the posts you schedule, and statistics for them.
We use this data only to show your accounts in PostCherry, publish the content you create and schedule, and show you statistics about your own accounts and posts. We do not use it for advertising, we do not sell it, and we do not use it to train AI models.
3. How we use your data
- to provide the Service: schedule and publish your posts, show your calendar and statistics, and run AI features when you use them;
- to manage your account, subscription and support requests;
- to keep the Service secure, prevent abuse and fix problems;
- to send service emails, such as a failed post, a billing notice or a security alert.
We do not sell your personal data and we do not show you ads.
4. Legal bases (EU/UK users)
We process data to perform our contract with you, to meet legal obligations, and for our legitimate interest in running and securing the Service. Where consent is needed, we ask for it, and you can withdraw it at any time.
5. Who we share data with
- The social networks you connect, only to publish your content and read your statistics on your behalf.
- Service providers that run parts of PostCherry for us, under contracts that protect your data: InterServer (server hosting, United States), Cloudflare (DNS and file storage), Stripe (payments), our email delivery provider (account and notification emails), and OpenAI (only the text or images you send to an AI feature, when you use it; OpenAI does not use API data to train its models).
- Authorities, only when the law requires it.
- A buyer or successor, if the business is sold or merged, under this same policy.
6. YouTube and Google user data
PostCherry uses YouTube API Services to upload videos you schedule and to show statistics for your YouTube channel. By connecting YouTube you also agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.
PostCherry's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google or YouTube data for advertising, we do not sell it, we do not let humans read it except with your permission, for security, or when the law requires it, and we do not use it to train AI models.
You can remove PostCherry's access to your Google account at any time on the Google security settings page, or by disconnecting the channel in PostCherry. We delete YouTube data we stored within 7 days after you disconnect or ask us to delete it, and we refresh or delete stored YouTube statistics at least every 30 days.
7. How long we keep data
- Access tokens of a social account: deleted immediately when you disconnect that account, and we also ask the network to revoke our access where it allows it.
- Data received from a social network: deleted within 7 days after you disconnect the account or ask us to delete it.
- Your account and content: kept while your account is active, and deleted or anonymized within 30 days after you delete your account.
- Invoices and billing records: kept as long as tax law requires.
- Backups: overwritten within 14 days.
8. Disconnecting accounts and deleting your data
You are in control of your data:
- Disconnect one social account: in the PostCherry app, open the account's menu in the channel list and choose to delete or disconnect it. Its tokens are deleted right away.
- Delete everything: email hello@postcherry.com from your account email with the subject "Delete my data". We confirm and delete your account and all related data within 7 days.
- Remove access from the network side: you can also remove PostCherry in the settings of Facebook, Instagram, TikTok, Google or LinkedIn. When Meta notifies us that you removed the app or asked for deletion, we delete the related data automatically.
Step-by-step instructions are on our Data Deletion page. Deleting PostCherry data does not delete posts already published on a social network; delete those on the network itself.
9. Security
We use HTTPS encryption for all traffic, store passwords only as secure hashes, restrict server access to key-based logins, keep software updated, and make regular encrypted backups. No system is 100% secure, so please use a strong password and keep it private.
10. International transfers
PostCherry runs on servers in the United States. If you use it from another country, your data is transferred to the United States. Where the law requires it, we use safeguards such as Standard Contractual Clauses.
11. Your rights
Depending on where you live (for example under GDPR in the EU/UK or CCPA in California), you can ask to access, correct, delete or export your data, and to object to or limit some processing. We do not sell or share personal data for cross-context advertising. To use your rights, email hello@postcherry.com. We answer within 30 days. You can also complain to your local data protection authority.
12. Cookies
We only use cookies that are needed to log you in and keep your session secure. We do not use advertising cookies or third-party tracking cookies.
13. Children
PostCherry is not meant for people under 18, and we do not knowingly collect their data. If you believe a child gave us data, contact us and we will delete it.
14. Changes
We may update this policy. If the changes are important, we will tell you by email or in the app before they apply. The effective date at the top shows the latest version.
15. Contact
Khamarx LLC (PostCherry), New Mexico, United States. Email: hello@postcherry.com.