Draft: replace the [bracketed] parts with your details and have this reviewed by a lawyer in your country before launch.

Privacy policy

Last updated: [date]

PostBuzzPro is operated by [your name or company], [address, country], the same operator as LeadBuzzPro. This policy explains what data PostBuzzPro handles and why. Contact: hello@postbuzzpro.com.

1. What PostBuzzPro stores

• Your license and account: your license key, email address, plan and sign-in sessions. Licenses are handled by the LeadBuzzPro license server at api.leadbuzzpro.com. Payments are handled by Freemius, Inc., our reseller and merchant of record; we receive your email, name, plan, purchase IDs and renewal, cancellation or refund status, never your card details.
• Connected social accounts: the access tokens each network gives us when you connect it (stored encrypted with AES-GCM), and the account name and picture. For Bluesky, Telegram and Discord, the app password, bot token or webhook URL you enter (also encrypted). We never ask for your main password.
• Your content: posts, drafts, schedules, per-network versions, settings such as your brand voice, and the images and videos you upload to the media library. Uploaded media is served from unguessable links because several networks fetch media by URL; anyone who has such a link can open that file.
• Analytics: views, likes, comments and shares that each network reports for your posts.

2. Attribution data

If you use Attribution, PostBuzzPro also processes data about your visitors and customers on your behalf. You are the controller of that data and we act as your processor.

• Tracked links: when someone clicks a tracked link we record the time, the post, a click id, the referrer and a coarse user agent. Link-preview bots are filtered out.
• Website snippet: sets one first-party visitor id on your site and reports page visits that came from a tracked click, plus the events you send (for example sign-ups and purchases, with an email, value and order id if you include them). There is no cross-site tracking or fingerprinting.
• Survey answers from the "How did you hear about us?" box, and conversions you send from your server or Stripe.
• People who engaged: the public names and handles of people who commented on or reacted to your posts, where a network's official API shares them, used to match them to customers.

Load the snippet only after consent where the law requires it, mention PostBuzzPro in your own privacy policy, and forward deletion requests to us at hello@postbuzzpro.com.

3. Service providers

• Cloudflare (hosting, database and media storage).
• Anthropic (AI features): the text and images you ask the AI to work on are sent to Anthropic's API to generate captions, rewrites, ideas and alt text.
• The social networks you connect, to publish posts and read their statistics.
• Freemius, Inc. (checkout, payments, invoices, sales tax and VAT, as merchant of record; checkout loads from checkout.freemius.com and is covered by Freemius' privacy policy) and the LeadBuzzPro license server (license checks).

4. Cookies and website analytics

postbuzzpro.com only uses analytics if you allow it. On your first visit a banner asks you to Accept all, Reject or Choose. Nothing below loads until you decide, and rejecting is as easy as accepting. If your browser sends a Global Privacy Control or Do Not Track signal, we treat that as "Reject" and don't show the banner; you can still opt in from "Cookie settings".

• Google Analytics 4 (Google Ireland Limited, and Google LLC in the US), the "Analytics" switch. It records the pages you view, how you arrived (the referring site, search engine, and campaign tags in the link such as utm_source or ref), your device type, browser, screen size and language, an approximate location derived from your IP address (Google does not store the IP address itself), and actions on this site such as clicking "Add to Chrome", opening checkout, joining the early-access list or following a link to one of our sister sites. It sets first-party cookies _ga and _ga_<ID>, which last up to 2 years. When you follow a link between leadbuzzpro.com, postbuzzpro.com and sendbuzzpro.com, a _gl parameter is added to the link so the visit counts as one session. We keep Analytics data for [14] months. Advertising storage, ads personalisation and Google Signals are off. See Google's privacy policy and how Google uses data from sites that use its services.
• Microsoft Clarity (Microsoft Corporation), the "Session recording" switch. It records how you use our pages (clicks, taps, scrolling, mouse movement and the page layout) so we can replay sessions and build heatmaps that show where pages confuse people. It also records your device, browser and approximate location. Text you type, such as email addresses and license keys, is masked in your browser and never sent. It sets first-party cookies _clck (up to 1 year) and _clsk (1 day). Clarity is linked to our Google Analytics, so we can open a recording from an Analytics report. Microsoft keeps recordings for about 30 days. See the Microsoft privacy statement.
• Your choice is saved in your browser's local storage (bz-consent) for 6 months, then we ask again. It is not a cookie and is not sent to us. Each of our three sites asks separately.
• Cloudflare Web Analytics, if we turn it on, counts visits without cookies or personal identifiers, so it doesn't need your consent.
• Links to our sister sites carry a ref parameter and campaign tags so we can count visits between them; they identify the site you came from, not you.

Changing your mind. You can withdraw or change your consent at any time: click Cookie settings at the bottom of any page (or the button below), turn the switches off and save. We then stop Google Analytics and Clarity on this site and delete their cookies; clearing this site's data in your browser does the same. Withdrawing doesn't affect data collected before.

Our legal basis is your consent (GDPR Article 6(1)(a), and the ePrivacy rules for cookies). Google and Microsoft may process this data in the United States; both are certified under the EU-U.S. Data Privacy Framework. [Check this paragraph against your local law before launch.]

5. Your rights

You can ask for a copy of your data, ask us to correct or delete it, or object to how we use it, by emailing us. Deleting your account deletes your content; we keep billing records as the law requires.

6. Security

Data is encrypted in transit, secrets are encrypted at rest, and API keys are stored only as hashes.

7. Changes

We'll post changes here and update the date above. For significant changes we'll email you.