Privacy Policy
Runpost is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and applicable Lithuanian data protection law. This policy explains what data we collect, why, and how you can control it.
1. Who We Are
Runpost ("we", "us", "our") is a content automation platform that helps professionals curate and publish LinkedIn content using AI. The platform is operated under the brand name Runpost.
For the purposes of GDPR, Runpost acts as the Data Controller for personal data collected through the platform.
Data Controller: Runpost
Email: privacy@runpost.app
Jurisdiction: Republic of Lithuania, European Union
2. Data We Collect
We collect data to provide our service, along with optional information you choose to share. This includes:
| Category | Data Points | Source |
|---|---|---|
| Account data | Name, email address, password (hashed) | Registration form |
| Optional discovery source | Your selected answer to how you heard about Runpost, account ID and response date | Voluntary onboarding question |
| LinkedIn data | LinkedIn profile ID, access token (AES-256-GCM encrypted), post performance metrics | LinkedIn OAuth |
| Content data | RSS feed sources, AI-generated drafts, approved posts, user edits, style preferences | Platform usage |
| Usage data | Feature usage, session timestamps, credit consumption logs | Automatically collected |
| Technical data | IP address, browser type, device type | Automatically collected |
Optional discovery-source answers are associated with your account and used in administrator summaries of registrations and onboarding completion. This question does not collect browsing history or add tracking cookies. You can skip it, change or remove your answer on the Onboarding page, or remove it when deleting your account.
We do not collect sensitive personal data (health data, biometric data, political opinions, etc.).
3. How We Use Your Data
- Service delivery — to operate the content discovery, AI rewriting, and LinkedIn publishing pipeline
- AI personalisation — to learn your writing style and improve draft quality over time based on your approved posts
- Account management — authentication, plan management, credit tracking
- Communication — transactional emails (account updates, security alerts). We do not send marketing emails without explicit consent.
- Security & fraud prevention — monitoring for abuse, unauthorised access, and system errors
- Service improvement — aggregated, anonymised analytics to improve platform performance
4. Legal Basis for Processing (GDPR Art. 6)
| Processing activity | Legal basis |
|---|---|
| Account creation and service delivery | Contract performance (Art. 6(1)(b)) |
| AI style learning from approved posts | Legitimate interests (Art. 6(1)(f)) |
| LinkedIn OAuth and publishing | Explicit consent (Art. 6(1)(a)) |
| Security monitoring and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Marketing communications | Consent (Art. 6(1)(a)) — opt-in only |
5. Data Sharing & Third Parties
We do not sell your personal data. We share data only with the following processors, under data processing agreements:
- OpenAI — AI text and image generation (OpenAI does not use API data for model training by default)
- LinkedIn — OAuth authentication and post publishing via official LinkedIn API only
- Base44 — infrastructure and database hosting (EU-compliant)
- Cloud infrastructure — servers located within the European Economic Area (EEA)
No data is transferred outside the EEA without appropriate safeguards (Standard Contractual Clauses where applicable).
6. Data Retention
| Data type | Retention period |
|---|---|
| Account data | Duration of account + 30 days after deletion request |
| Content & post data | Duration of active subscription |
| AI style profile | Deleted on account deletion or upon request |
| Usage logs | 90 days (rolling) |
| Security / audit logs | 12 months |
| LinkedIn tokens | Until revoked via LinkedIn or account deletion |
7. Your Rights Under GDPR
- Right of access (Art. 15) — request a copy of all personal data we hold about you
- Right to rectification (Art. 16) — correct inaccurate or incomplete data
- Right to erasure (Art. 17) — "right to be forgotten"
- Right to restrict processing (Art. 18) — limit how we use your data
- Right to data portability (Art. 20) — receive your data in a machine-readable format
- Right to object (Art. 21) — object to processing based on legitimate interests
- Right to withdraw consent — at any time, without affecting prior processing
To exercise any of these rights, email privacy@runpost.app. We will respond within 30 days as required by GDPR. No charge for exercising your rights.
You may also lodge a complaint with the State Data Protection Inspectorate of Lithuania: vdai.lrv.lt
8. Cookies
Runpost uses only essential cookies required for the platform to function. We do not use tracking, advertising, or third-party analytics cookies.
| Cookie | Purpose | Duration |
|---|---|---|
| session_id | Authentication session | Session / 30 days |
| csrf_token | Cross-site request forgery protection | Session |
No consent banner is required for strictly necessary cookies under GDPR / ePrivacy Directive.
9. LinkedIn Integration
Runpost connects to LinkedIn via the official LinkedIn API only. We use OAuth 2.0 — we never store your LinkedIn password. LinkedIn access tokens are encrypted with AES-256-GCM before storage.
Through the LinkedIn integration, Runpost may:
- Read your basic profile information (name, profile ID)
- Publish posts on your behalf — only after your explicit manual approval in the review step
- Read engagement metrics (likes, comments, reposts) on published posts
Runpost does not access your LinkedIn messages, connections list, or any private data. Revoke access anytime via LinkedIn Settings → Data Privacy → Other applications.
10. AI Processing
- Article summaries and style preferences are sent to OpenAI's API for text generation
- Content prompts are sent to image generation APIs if you opt in to AI image generation
- Your approved posts are analysed locally to compute a writing style profile — stored in your account, never shared with other users
No content sent to OpenAI's API is used to train OpenAI's models (per OpenAI's API data usage policy).
11. Security
- Encryption in transit (TLS 1.2+) and at rest
- LinkedIn tokens encrypted with AES-256-GCM; keys stored in separate environment variables
- Hashed passwords (bcrypt)
- Access controls — only authorised personnel can access production data
- Regular security reviews
In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay (GDPR Art. 33–34).
12. Contact & Updates
Questions about this Privacy Policy? Contact us:
We may update this Privacy Policy periodically. Material changes will be communicated via email or in-app notification. The "Last updated" date at the top always reflects the current version.