Privacy Policy
Last updated: 25 July 2026 · Effective: 25 July 2026
1. Who is responsible for your data
AD NETWORK SCREENS ("startposting", "we") is the data controller for personal data processed through startposting.app.
Registered in Tunisia under number 1801733/X, registered office A20, IM PACHA CT BL A ET5, Montplaisir 1073, Tunis, Tunisia. Contact: privacy@startposting.app
2. What we collect
- Account data: your email address and password (stored hashed), display name, and avatar if you add one.
- Content you provide: the product photos you upload and the images and captions you generate.
- Billing data: handled by Paddle as Merchant of Record. We receive limited information (plan, status, country, transaction IDs) but we do not store your full card details — Paddle does, as the payment processor.
- Usage & device data: basic logs, and product-analytics events (page views and funnel steps) via PostHog, used to understand and improve the funnel.
- Security data: signals from hCaptcha used to prevent bots and abuse.
3. Why we process it, and our lawful bases (GDPR)
- To provide the Service (create your account, generate and store your posts, meter credits) — performance of a contract.
- To take payment — performance of a contract (via Paddle) and legal obligation (tax/accounting records).
- To secure the Service and prevent abuse (rate limiting, hCaptcha) — legitimate interests.
- To improve the product through analytics — consent where required (see our Cookie Policy).
- To send service and, if you opt in, marketing messages — consent for marketing; you can withdraw anytime.
4. AI processing of your photos
To generate a result, your uploaded photo and prompt are sent to our AI provider, Google (Gemini API), which returns the generated image and captions. We use the paid Google API tier, under which inputs and outputs are not used to train Google's models. We don't sell your photos, and we don't use them to train our own models. See our AI Content Disclosure.
5. Who we share data with (processors / sub-processors)
We share data only with providers who process it on our behalf under contract:
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Database, authentication, file storage | Account data, uploads, outputs |
| Google (Gemini API) | AI image + caption generation | Uploaded photo + prompt, at generation time |
| Paddle | Payments (Merchant of Record), tax, invoicing | Billing & transaction data |
| hCaptcha | Bot/abuse prevention | Security signals, IP |
| Vercel | Application hosting | Request data / logs |
| PostHog | Product analytics | Usage events, device data |
| OVHcloud | Email for our contact addresses | Correspondence you send us |
6. International transfers
Some providers process data outside your country, including in the United States and the European Union. Where required, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses.
7. How long we keep it
- Account data: for as long as your account is open, then deleted or anonymised within 90 days of closure, except records we must keep for legal or tax reasons.
- Uploaded photos (your raw originals): automatically deleted 12 months after upload. We keep them for that period because the Service lets you restyle the same photo again without re-uploading it; restyling a photo creates a fresh copy with its own 12-month period. You can delete a photo sooner by deleting the post, or immediately by closing your account.
- Generated outputs: kept while your account is active so you retain your history, and deleted when you close your account.
- Billing records: retained as required by tax law (typically several years).
8. Your rights
Depending on where you live (and under GDPR), you can request to access, correct, delete, export (portability), restrict, or object to our processing, and to withdraw consent at any time. To exercise these, contact privacy@startposting.app; we'll respond within the timeframe the law requires (one month under GDPR). You can also complain to your local data-protection authority.
9. Security
We protect data with encryption in transit, per-user access isolation (row-level security), private file storage, hashed passwords, and bot protection. No system is perfectly secure, but we treat your uploaded content as yours and guard it accordingly.
10. Children
The Service isn't intended for anyone under 18, and we don't knowingly collect their data.
11. Changes
We'll post updates here and change the "Last updated" date. Material changes will be signalled more prominently.
12. Contact
AD NETWORK SCREENS · A20, IM PACHA CT BL A ET5, Montplaisir 1073, Tunis, Tunisia · Reg. 1801733/X