Privacy Policy

Last updated: October 2026

1. Data Controller

NoRisk Solutions FZC LLC
Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates
Authorized representative: Helmuth Rieger
Email: support@postair.ai

2. Data We Collect

• Account data: Email address and encrypted password upon registration. When you sign in with LinkedIn (web and Android): name and email address from your LinkedIn profile. When you sign in with Apple (iOS app): name and email address or the relay address provided by Apple
• Persona data: Name, profession, industry, target customers, tone, language and background description as entered in your profile
• Inputs and history: Text you enter (e.g. LinkedIn post text, ideas for posts) and LinkedIn links, as well as the comments and posts generated from them. We store the generated content in your account and show it to you in the app as your history
• Retrieved LinkedIn content: When you enter the URL of a LinkedIn post or profile, we retrieve the publicly visible content (for posts: text and author name; for profiles: name, job title, industry and description)
• Reports: When you report AI content using "Report content", we store the reported text (up to 4,000 characters), its type (comment or post), the language, the reason you selected and an optional note. The report is also delivered to our support mailbox by email
• Activity & analytics data: Time of your last activity, features used, platform used (iOS/Android/Web) and triggered events (see Section 9)
• Subscription data: Selected plan, remaining credits, renewal date and the subscription identifier from Stripe or Apple
• Payment data: Payments on the web are processed by Stripe, in-app purchases in the iOS app by Apple. We do not store credit card information

3. Purpose of Processing

• Providing app functionality (comment and post generation, history)
• Personalizing AI-generated content based on your persona
• Retrieving the LinkedIn content you provide by link
• Billing and managing your subscription
• Reviewing reported AI content to improve quality and safety
• Technical operation and troubleshooting
• Usage analysis to improve the app (feature usage, activity, stability)

4. Legal Basis

Processing is based on Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest in operating the service).

5. Third-Party Services and Processors

We use the following service providers. Some of them also process data outside the EU/EEA, for example in the USA.

Supabase (Auth & Database)

Authentication and data storage. Servers in the EU. Privacy Policy

Anthropic / Claude (AI Generation)

Comment generation. Input data (post text, persona details) is sent to the API of Anthropic PBC (USA) for processing. According to Anthropic, inputs sent through the API are not used to train its models. Privacy Policy

xAI / Grok (AI Generation)

Post generation, and fallback service for comments if the Anthropic service is unavailable. Input data (post text or idea, persona details) is sent to the xAI API for processing. To our knowledge, xAI does not use inputs sent through the API to train its own models.

LinkedIn

Optional OAuth login (web and Android). We also retrieve publicly visible LinkedIn content when you enter the URL of a post or profile. For this we first use a retrieval service that we operate ourselves (Firecrawl) and, if it does not return usable content, the Apify service.

Apify (retrieval of LinkedIn content)

Fallback service for retrieving LinkedIn posts and profiles. The URL you entered, or the profile name taken from the URL, is sent to Apify Technologies s.r.o. (Czech Republic). The publicly visible content is returned. Privacy Policy

Stripe (payments on the web)

Subscription payment processing. Privacy Policy

Apple and RevenueCat (iOS app only)

Sign in with Apple and in-app purchases are handled by Apple. To manage subscriptions we use RevenueCat, Inc. (USA). Your user ID and purchase information are processed for this purpose. RevenueCat Privacy Policy · Apple Privacy Policy

6. Data Retention

Your data is stored as long as your account is active. Upon account deletion, all personal data will be removed within 30 days. This also applies to history, personas, reports and analytics data.

7. Your Rights

You have the right to:

• Access your stored data
• Rectification of inaccurate data
• Erasure of your data
• Restriction of processing
• Data portability
• Object to processing
• Lodge a complaint with a supervisory authority

Contact us at support@postair.ai to exercise your rights.

To delete your account, use Settings → "Delete Account" in the app or our deletion form.

8. Cookies

PostAir does not use tracking cookies. Only technically necessary data is stored in the browser's local storage (language setting, login session).

9. Usage Analytics

To improve the app, we analyze how PostAir is used. For this purpose we store events such as the time of your last activity, features used (e.g. comment or post generation, post or profile retrieval), the platform used (iOS, Android or Web), and triggered actions (e.g. sign-up, reaching the credit limit, completing a subscription, reporting content).

This data is stored exclusively in our own database (Supabase, EU) and linked to your user ID. We do not use any third-party analytics services (e.g. Google Analytics) or tracking cookies, and we do not sell data. The legal basis is our legitimate interest in improving the product (Art. 6(1)(f) GDPR). When you delete your account, this analytics data is deleted as well.

10. AI-Generated Content and Reporting

Comments and posts are generated by an AI model. They are suggestions and may be inaccurate or inappropriate. Below each result you can report content using "Report content" and select a reason. We use reports to improve the quality and safety of the results.

11. Age

PostAir is intended for people aged 18 and over. We do not knowingly collect data from children.