Privacy Policy
Last updated: 20 September 2026 · Effective: 20 September 2026
1. Who is responsible for your data
AD NETWORK SCREENS ("startposting", "we") is the data controller for personal data processed through startposting.app.
Registered in Tunisia under number 1801733/X, registered office A20, IM PACHA CT BL A ET5, Montplaisir 1073, Tunis, Tunisia. Contact: privacy@startposting.app
2. What we collect
- Account data: your email address and password (stored hashed), display name, and avatar if you add one.
- Content you provide: the product photos you upload and the images and captions you generate.
- Billing data: handled by Freemius as Merchant of Record. We receive limited information (plan, status, country, transaction and licence IDs, and the email address you buy with) but we never see or store your card details — those go directly to Freemius and its payment providers.
- Usage & device data: basic logs, and product-analytics events (page views and funnel steps) via PostHog, used to understand and improve the funnel. By default this is cookieless: nothing is stored on your device, and you are counted using a temporary identifier that our analytics provider derives on its servers from your IP address and browser user-agent with a secret that changes every 24 hours, so it cannot be linked across days or to any other site. If you accept our cookie banner, cookie-based analytics are used instead, which additionally recognise a returning browser. See our Cookie Policy.
- Site analytics via Ahrefs: page views, the referring site, and your browser and device type. This is always cookieless — nothing is written to your device. Ahrefs uses your IP address to derive your country and city and, per its documentation, discards the raw IP without storing it. We do not switch this to cookies if you accept the banner, and we do not load it at all if your browser sends "Do Not Track" or Global Privacy Control.
- Security data: signals from hCaptcha used to prevent bots and abuse.
3. Why we process it, and our lawful bases (GDPR)
- To provide the Service (create your account, generate and store your posts, meter credits) — performance of a contract.
- To take payment — performance of a contract (via Freemius) and legal obligation (tax/accounting records).
- To secure the Service and prevent abuse (rate limiting, hCaptcha) — legitimate interests.
- To improve the product through cookieless analytics that store nothing on your device — legitimate interests (knowing whether our own site works, balanced against a measurement that cannot profile you or follow you off this site). You can object at any time: privacy@startposting.app.
- To improve the product through cookie-based analytics that recognise a returning browser — consent, given via our cookie banner and withdrawable at any time (see our Cookie Policy).
- To send service and, if you opt in, marketing messages — consent for marketing; you can withdraw anytime.
4. AI processing of your photos
To generate a result, your uploaded photo and prompt are sent to our AI provider, Google (Gemini API), which returns the generated image and captions. We use the paid Google API tier, under which inputs and outputs are not used to train Google's models. We don't sell your photos, and we don't use them to train our own models. See our AI Content Disclosure.
5. Who we share data with (processors / sub-processors)
We share data only with providers who process it on our behalf under contract:
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Database, authentication, file storage | Account data, uploads, outputs |
| Google (Gemini API) | AI image + caption generation | Uploaded photo + prompt, at generation time |
| Freemius | Payments, tax, invoicing (Merchant of Record) | Billing & transaction data, purchase email |
| hCaptcha | Bot/abuse prevention | Security signals, IP |
| Vercel | Application hosting | Request data / logs |
| PostHog | Product analytics (cookieless by default) | Usage events, device data |
| Ahrefs | Site analytics (cookieless, no consent used) | Page views, referrer, device & browser data, IP (used to derive country/city, then discarded) |
| OVHcloud | Email for our contact addresses | Correspondence you send us |
One note on Freemius. Because Freemius is our Merchant of Record, it is the seller of record for your purchase and an independent data controller for that transaction — not only a processor acting on our behalf. Its own privacy policy and terms apply to the purchase alongside this policy.
6. International transfers
Some providers process data outside your country, including in the United States and the European Union. Where required, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses.
7. How long we keep it
- Account data: for as long as your account is open, then deleted or anonymised within 90 days of closure, except records we must keep for legal or tax reasons.
- Uploaded photos (your raw originals): automatically deleted 12 months after upload. We keep them for that period because the Service lets you restyle the same photo again without re-uploading it; restyling a photo creates a fresh copy with its own 12-month period. You can delete a photo sooner by deleting the post, or immediately by closing your account.
- Generated outputs: kept while your account is active so you retain your history, and deleted when you close your account.
- Billing records: retained as required by tax law (typically several years).
8. Your rights
Depending on where you live (and under GDPR), you can request to access, correct, delete, export (portability), restrict, or object to our processing, and to withdraw consent at any time. To exercise these, contact privacy@startposting.app; we'll respond within the timeframe the law requires (one month under GDPR). You can also complain to your local data-protection authority.
9. Security
We protect data with encryption in transit, per-user access isolation (row-level security), private file storage, hashed passwords, and bot protection. No system is perfectly secure, but we treat your uploaded content as yours and guard it accordingly.
10. Children
The Service isn't intended for anyone under 18, and we don't knowingly collect their data.
11. Changes
We'll post updates here and change the "Last updated" date. Material changes will be signalled more prominently.
12. Contact
AD NETWORK SCREENS · A20, IM PACHA CT BL A ET5, Montplaisir 1073, Tunis, Tunisia · Reg. 1801733/X