Privacy Policy

Who we are

NextPost (“we”, “us”) helps creators connect social accounts, automate audience replies, schedule bookings, and review performance. This policy explains what we collect, why we use it, and how you can delete it.

Information we collect

• Account data — name, email, and profile photo from your Google sign-in (or another identity provider we support).
• Connected accounts — Instagram, YouTube, and calendar metadata and tokens you authorize (for example username, followers, granted scopes). Access tokens are stored encrypted; we never show them in the browser.
• Product data — workflows, events, contacts, messages we process for automations, bookings, documents, and assets you upload.
• Payment data — when you buy a plan or AI credits, or sell a digital product, our payment partners (Razorpay, Cashfree, or Stripe) collect card, UPI, and bank details directly. We receive the payment status, amount, and a reference, never your full card number. Creators who receive payouts give us bank and PAN details, which we store encrypted.
• Customer data for creators’ shops — when someone buys from a creator’s storefront, we process their name, email, phone (where the payment partner requires it), and order details to deliver the purchase and send invoices. We do this on the creator’s behalf.
• Usage & device data — session cookies, IP address, user agent, and signed-in device labels so you can manage devices and we can keep accounts secure.

How we use information

• Provide and improve NextPost features you request.
• Authenticate you, protect accounts, and show connection health.
• Run automations and send replies or booking messages you configure.
• Comply with law and platform policies (including Meta and Google).

We do not sell your personal information.

AI features

When you use AI features (for example captions, ideas, translations, or video captions), we send the content needed for that request to AI providers such as OpenAI and Google. We use their output only to give you the result, and you review it before anything is posted.

Product analytics

We measure how pages and features are used (for example which screens are opened and which buttons are clicked) to fix problems and improve NextPost. This usage data is tied to your account when you are signed in.

Sharing

We share data with processors that host infrastructure (for example cloud databases and object storage) under contracts that limit use to providing the service. When you connect Instagram, YouTube, or Google Calendar, those providers also process data under their own policies according to the permissions you grant.

Retention

We keep account and workspace data while your account is active. Raw provider event payloads may be purged on a retention schedule. When you deactivate your account, data is retained but the account cannot sign in. When Meta sends a data-deletion request for an Instagram user, we remove linked Instagram connections as described below.

Your choices

• Disconnect a social or calendar connection anytime in Settings → Connections (tokens are wiped; history may remain).
• Deactivate account in Settings → Privacy signs you out and marks your account inactive so you cannot sign in again. Workspace data is retained (not erased). Contact us if you need restoration or a full erasure request.
• Instagram users can also request deletion through Instagram’s app settings; Meta calls our data-deletion callback and we remove linked Instagram connections. Step-by-step instructions are on our Data Deletion page.

Cookies

We use HttpOnly session cookies required to keep you signed in. Preference settings such as theme may use local browser storage. Product analytics may also use cookies or local storage to recognise a returning browser.

Security

Connection tokens and payout details are encrypted at rest, traffic is sent over HTTPS, and you can review and sign out signed-in devices from Settings. No system is perfectly secure, so please tell us at once if you suspect unauthorised access to your account.

Your rights

You can ask us for a copy of your data, to correct it, or to erase it, and you can withdraw consent by disconnecting accounts or deactivating your account. Email us from the address on your account and we will respond within 30 days.

Children

NextPost is for people aged 18 and over. We do not knowingly collect data from children; if you believe a child has used NextPost, contact us and we will delete their data.

Changes

We will update the “Last updated” date when this policy changes, and tell signed-in users about material changes in the app or by email.

Contact

Questions about privacy or deletion: support@nextpost.studio.