Privacy policy

5.1 Registration and account data

• When you register, we collect:
• • Email address (required)
• • Username (required)
• • Password (encrypted with bcrypt, at least 8 characters)
• • Account type (Personal or Company)
• • Date of registration
• • Two-factor authentication (2FA) — optional but recommended
• Purpose: Providing and managing your account, authentication, security
• The 2FA data is stored only locally on your device (QR code scan). We store only the activation status.
• Note: Alternatively, you can also register or log in via Google, Meta (Facebook), LinkedIn, TikTok, or X—see Section 5.1a for the data and permissions requested in each case.
• To protect against automated registrations (bots), we use Cloudflare Turnstile (see Section 10a.2).

5.1a Registration & Sign-In via Third-Party Providers (Social Login)

• In addition to the standard registration with an email address and password, you can register or log in to PostMaestro.ai using the following third-party providers. These connections are used exclusively for account creation and login and are independent of the social media links used for publishing posts (see Section 5.5)—in each case, separate OAuth permissions (scopes) with significantly more limited access are requested:
• • Google (Scopes: openid, profile, email) — the following information is transmitted: Google ID, email address, first and last name, profile picture, and language
• • Meta / Facebook Login (Scopes: public_profile, email) — the following information is transmitted: Facebook ID, email address, first and last name, profile picture, and language
• • Instagram Business Login (Scope: instagram_business_basic) — the following information is transmitted: Instagram ID, username, display name, and profile picture (no email address—this is requested separately during onboarding)
• • LinkedIn (OpenID Connect, scopes: openid, profile, email) — the following information is transmitted: LinkedIn ID, email address, first and last name, profile picture, and language
• • TikTok Login Kit (Scopes: user.info.basic, user.info.profile) — TikTok Open ID, username, display name, and profile picture are transmitted (TikTok does not provide an email address; a placeholder address is used internally until one is entered during onboarding)
• • X / Twitter (OAuth 2.0 with PKCE, scopes: users.read, users.email, tweet.read) — the following information is transmitted: X ID, username, display name, profile picture, and — if provided to X — the verified email address
• These scopes allow only the retrieval of basic profile data for account creation. No posts are published, no messages are read, and no access to your contacts is granted.
• If an email address that is already registered signs up again through a different provider, we recognize the existing account based on the email address (regardless of case) and link the new provider ID retroactively (account linking) instead of creating a duplicate account.
• If enabled in your security settings, we will send an email notification each time you log in (including via social login), including the time, device, browser, and approximate location. Your location is determined based on your IP address using the third-party provider ipinfo.io (see Section 10a.1).
• Meta Account Deletion: For sign-ups via Meta (Facebook/Instagram), we provide the callback endpoints required by Meta for deauthorization and data deletion. If you remove the app in your Facebook account settings or request data deletion there, we automatically receive a corresponding request and provide the processing status via a status URL displayed by Meta.

5.2 Brand profiles and brand data

• When creating a brand profile, we save:
• - Brand name and description
• - Website URL (for Brand Analyser)
• - Uploaded brand guidelines and documents
• - Analysed brand data (colours, fonts, tone of voice)
• - Logo and visual assets
• - Target group definitions
• - Industry and category
• Purpose: Creation of market-compliant content, brand identity management

5.3 Content data (posts, media, campaigns)

• When you use the content creation feature, we store:
• • Social media posts created and scheduled (text, captions, hashtags)
• • Uploaded and generated images, videos, and graphics
• • Campaign data and templates
• • Idea validation (swipe data in the Idea Generator)
• • Research Documents
• • Content Status (Draft, Review, Scheduled, Published)
• • Publication dates and platforms
• • Tagging and origin data for generated media (content class, tagging status, metadata status), as well as your confirmation of the editorial review of generated texts
• Purpose: Content management, planning, automation, archiving, and compliance with AI transparency requirements
• To the extent technically feasible, generated media files contain labeling information, metadata, or comparable technical indicators that indicate that the content is AI-generated or AI-assisted (see Section 8.2).

5.4 Usage data and analytics

• We store data to improve the platform:
• - Login times and session duration
• - Features and functions used
• - Token consumption and billing data
• - Error reports and performance data
• - Feedback and support requests
• Purpose: Platform improvement, error analysis, support, billing

5.5 Social Media Platform Links (Publication)

• When you connect social media accounts for publishing (LinkedIn, Instagram, Facebook, Threads, X, YouTube, TikTok, Wix, WordPress, your own website), each platform uses OAuth to request only the permissions (scopes) necessary for that purpose. These connections are independent of the social login used for account registration (see Section 5.1a).
• OAuth access and refresh tokens are stored in the database with AES-256-GCM encryption for each platform (see Section 10). Expired, non-renewable tokens are automatically invalidated.
• For accurate publishing and scheduling, the time zone is primarily retrieved from the respective platform provider (where supported by the platform, e.g. Facebook, Instagram, Wix, WordPress, YouTube) or adopted from your manual setting. If a platform does not support time zone retrieval (such as LinkedIn, where no location derivatives are formed for privacy reasons), we derive the time zone primarily from the country specified in the brand profile, or secondarily from the language or standard brand time zone.
• The following sections describe for each platform which data is processed, what it is used for, and when it is deleted. Platform data is used exclusively to manage the connected presence of the respective customer.
• You can disconnect any connection at any time in the settings. We also recommend revoking app permissions directly on the respective platform (e.g., in your LinkedIn or Meta account settings).

5.6 Team and company account data

• For company accounts with multiple users, we additionally store:
• • Team members and their roles
• • Permissions and access control (including role-based access to brand profiles and social media connections; notifications regarding expiring connections are delivered only to authorized roles)
• • Approval workflows and comments
• • Activity logs (audit log)
• Purpose: Team collaboration, access control, compliance

5.7 Notifications (in the app, push notifications, and email)

• PostMaestro.ai notifies you about events in your account, such as comments and mentions, completed generations, publications, team invitations, billing, security, and maintenance. To do this, we process:
• • Notifications in your inbox (bell icon), including "read" and "hide" statuses
• • Your notification settings by channel, category, section, and team group
• • For push notifications (mobile app and browser): device token, a random device ID, device name, platform, app version, and the time of last use
• • Whether the app is currently open on a device (visibility signal, valid for 90 seconds), so that you don't receive an additional push notification on the device you're currently using
• We send push notifications via Firebase Cloud Messaging (Google) and email notifications via SendGrid (see Section 6.3).
• You can turn optional notifications on or off for each channel under Settings → Notifications; you can also configure push notifications in your device's or browser's settings.
• We will send notifications required for the use of your account (e.g., payment issues, two-factor authentication requirements, maintenance, changes to the Terms of Service) via the app and email, regardless of these settings. Login notifications are excluded from this and are optional (see Section 12.1). In exceptional cases—such as during maintenance or for security-related notifications—we may also display announcements in the app and via push notifications regardless of your category settings; such notifications are marked as “Important.”
• You will only receive promotional emails (e.g., about new features) if you have subscribed to the newsletter (Section 6).

5.8 News, research and RSS feeds

• The platform offers a news function that uses AI-supported research (via Perplexity AI) as standard to provide relevant industry news. You can also add your own RSS feeds. In doing so, we process:
• - Search queries and topic preferences for AI-supported news searches
• - The URLs of the RSS feeds you have added
• - Your preferences and categorizations for these feeds
• - Read or saved articles
• The platform retrieves the content of the third-party feeds via our servers so that your IP address is not transmitted to the operators of the RSS feeds. When using the AI-supported news search, your search queries are transmitted to Perplexity AI (see section 7.3).
• Purpose: Providing personalized industry news, research and content inspiration

6.1 Double opt-in procedure

After signing up via the website, you will receive an email with a confirmation link. We will add you to the mailing list only after you click on that link. We delete unconfirmed sign-ups after 30 days; we do not send a reminder.

When you register in the app, you confirm your subscription by clicking the link in the confirmation email sent to your account, where we specifically mention this step.

This prevents unauthorized registration of third-party email addresses.

6.2 Proof of Your Consent

To be able to prove that you have given your consent (Art. 7(1) GDPR), we log sign-ups, confirmations, and unsubscriptions, including the time, source, IP address, browser identifier, and the version of the consent text displayed.

We retain this log for 3 years after you unsubscribe and then delete it automatically.

6.3 SendGrid (Email Delivery)

We use SendGrid (Twilio Inc., USA) to send the newsletter as well as service and notification emails.

SendGrid processes your email address and the contents of the email on our behalf and reports technical delivery events to us (delivered, undeliverable, reported as spam, unsubscribed). We use these events to keep the mailing list up to date: Undeliverable addresses and spam reports result in the address being blocked.

We have entered into a Data Processing Agreement (DPA) with SendGrid in accordance with Article 28 of the GDPR. SendGrid is certified under the EU-U.S. Data Privacy Framework.

Further information: https://www.twilio.com/legal/privacy

Twilio (SendGrid) Privacy Policy

6.4 Newsletter Tracking

We currently do not track either opens or clicks.

Before we implement such statistics, we will inform you in advance and—where necessary—obtain your consent.

6.5 Unsubscribe

You can unsubscribe from the newsletter at any time:

• via the unsubscribe link in each email or the unsubscribe feature in your email program

• Using the form at the bottom of this section: Enter your email address, and we’ll send you a link to confirm your unsubscription

• In your PostMaestro account under Settings → Notifications

• via email to support@postmaestro.ai

After unsubscribing, you will no longer receive newsletters. Your email address will then no longer be on the mailing list; only the record specified in Section 6.2 will be retained.

8.1 Disclosure of Interaction with an AI System

• In PostMaestro.ai, you interact directly with AI systems. All features that generate, evaluate, summarize, translate, or rephrase content are AI-powered and are labeled as such in the user interface.
• The notice is provided before the first interaction, is clear, understandable, and clearly distinguishable from the other user interface elements (Art. 50(1) of the EU AI Act).
• We provide this information in an accessible format and ensure it complies with recognized accessibility requirements (Art. 50(5) of the EU AI Act).
• AI responses and suggestions may be incomplete, outdated, or factually incorrect. They do not constitute legal, tax, medical, or financial advice.

8.2 Machine-Readable Marking of Generated Content

• Under Art. 50(2) EU AI Act, outputs of AI systems generating synthetic audio, image, video or text content must be marked in a machine-readable format as artificially generated or manipulated. The marking must be effective, interoperable, robust, and reliable.
• We implement this requirement through multiple complementary methods, as current state-of-the-art offers no single method with the required robustness:
• • Provenance metadata within the file: We embed standardized metadata directly into image and video files. This includes the IPTC field 'Digital Source Type' (with values 'trainedAlgorithmicMedia' for fully synthetic media and 'compositeWithTrainedAlgorithmicMedia' for AI-modified authentic recordings), Dublin Core descriptions ('AI GENERATED'), EXIF tags, and a dedicated XMP namespace (https://postmaestro.ai/ns/ai-transparency/1.0/) containing details on the AI system, model version, content class, generation timestamp, and labeling status.
• • Content Credentials (C2PA): Images, videos and audio files additionally carry a cryptographically signed provenance record following the C2PA standard (details in Section 8.2a).
• • Provider-side watermarks: Insofar as the respective model provider supplies invisible watermarks, these are retained and not removed. For Google Gemini image models, this includes the SynthID watermarking process.
• • Validation: Following embedding, we re-read the marking and log a per-file status (pending, valid, missing, stripped). If embedding fails, we enforce a visible label for sensitive content classes.
• • Format resilience: If a platform or conversion step strips file metadata, the burned-in visual badge remains effective as the primary safeguard (see Section 8.3).
• Implementation status and grace period: The transparency obligations of Art. 50 EU AI Act apply since August 2, 2026. For AI systems already on the market before this date, such as PostMaestro.ai, the transitional period extends to December 2, 2026. We will complete implementation within this timeframe and document compliance internally.
• A notice in this Privacy Policy alone does not satisfy Art. 50(2) EU AI Act. The determinative factor is the machine-readable mark on the file itself.

8.2a Signed Provenance (C2PA Content Credentials)

• In addition to the metadata described in Section 8.2, we attach a cryptographically signed provenance record to AI-generated and AI-modified images (JPEG, PNG, WebP), videos (MP4) and audio files (MP3, WAV), following the open standard of the Coalition for Content Provenance and Authenticity (C2PA). Platforms and verification tools can read this record and may display it, for example, as a 'CR' (Content Credentials) icon.
• On October 18, 2026, the C2PA confirmed PostMaestro.ai as a conformant Generator Product (Assurance Level 1) in its Conformance Program.
• Contents of the record: name and version of the software ('PostMaestro.ai'), how the content was created (fully AI-generated or AI-modified), the name of the AI system or model used, the time of creation, whether a visible AI label was added, and the digital signature. For edits and for media passed to the AI model as input (e.g. reference, product or portrait photos, logos), the record contains their file name, file format and a cryptographic hash. If such an input carries its own C2PA record, that record is included. Preview images of inputs are not embedded.
• The record does not contain the name, email address or account identifiers of the user or their company. File names of inputs are taken as uploaded; do not use file names containing personal data (e.g. 'max-mustermann.jpg') if they should not appear in the published media file.
• The record is signed with a certificate of Nexaluna AI Solutions UG (haftungsbeschränkt). The private signing key is held in AWS Key Management Service (Frankfurt region), where it is protected by hardware security modules, and never leaves that service. Whether a verification tool displays the record as trusted depends on whether it recognizes the issuing certification authority (e.g. via the C2PA Trust List).
• Time-stamping: So that the signature remains verifiable after the certificate expires, it can be time-stamped by a time-stamping service. Only a hash value is transmitted, neither the file nor any personal data.
• The record is part of the file and is published with it. If you select 'No EU Labeling', no provenance record is embedded. Platforms that re-encode or convert files on upload may remove the record; a burned-in visible label is not affected (see Section 8.3).

Legal Basis: Art. 6(1)(c) of the GDPR in conjunction with Art. 50(2) of Regulation (EU) 2024/1689 (machine-readable labeling of AI-generated content) as well as Art. 6(1)(b) of the GDPR (provision of the contractually agreed labeling function).

8.3 Your Responsibilities as an Operator Regarding Deepfakes & Visible EU Labeling

• When publishing content generated by PostMaestro.ai, you are considered an 'operator' under the EU AI Act. The disclosure obligation under Article 50(4) of the EU AI Act for image, video, and audio content that bears a resemblance to real people, places, or events ('deepfakes') applies directly to you.
• Official EU Badges: To facilitate compliance, PostMaestro.ai incorporates the official badge assets provided under European Commission guidance, burned directly into the image pixels as vector overlays:
• 1. 'AI GENERATED' (Pill Badge): For fully synthetic visual media.
• 2. 'AI MODIFIED' (Pill Badge): For authentic photographs or human-origin images modified or retouched using generative AI.
• 3. 'AI' (Circular Icon): For synthetic voice content and as a responsive fallback for narrow formats or small dimensions where pill text would be illegible.
• Three Transparency Tiers: Prior to publication, you can select from three transparency tiers for each individual asset via the EU menu:
• • AI Badge + Metadata (default for generated media): Burned-in official EU badge plus embedded machine-readable XMP/IPTC metadata and a signed C2PA provenance record (see Section 8.2a).
• • Metadata Only: Full machine-readable XMP/IPTC provenance metadata and a C2PA provenance record in the file, with no visible badge on the image.
• • No EU Labeling: Clean asset without a visible badge, stripped of AI provenance metadata and without a C2PA provenance record.
• Strict Safeguards for Sensitive Classes: For photorealistic depictions of persons (Content Class A1) and synthetic voice cloning (Content Class V1), visible disclosure is mandatory under the law. While the brand's EU AI Act switch is active for the respective language, the system disables 'Metadata Only' and 'No EU Labeling' for these classes ('LABEL_REQUIRED'). If the switch is turned off for a language because the content is not intended for the EU market, the user may choose 'Metadata Only'; machine-readable marking is always retained ('METADATA_REQUIRED'). The user is responsible for complying with labelling obligations in the respective target market.
• You remain solely responsible for verifying prior to publication that your chosen transparency tier satisfies the EU AI Act and the terms of the target publishing platform.

8.3a Badge Styling, Contrast Assurance, and Composition Planning

• To ensure that mandatory disclosures do not impair the visual quality of your post while maintaining required legibility, PostMaestro.ai provides flexible design options:
• • Available Color Variants: You can select between five styles in the EU menu: 'Auto' (default), 'Black', 'White', 'Black 50% transparent', and 'White 50% transparent'.
• • Default 'Auto' Mode: Automatically selects a 50% semi-transparent plate contrasting with the corner background – White 50% on dark corners, Black 50% on light corners.
• • AI Composition Planning: Our prompt agents (Visual Agent, Thumbnail Agent, Visual Creator) proactively plan a calm, low-detail image corner (disclosureCorner) free of text, faces, or logos and propose an appropriate badge style (disclosureStyle).
• • Algorithmic Contrast Verification: During rendering, the system measures the actual luminance and standard deviation of the target corner. If the rendered image deviates from the agent's expectation, the renderer automatically adjusts the tone to guarantee readability and prevent illegible placements (e.g., dark badges on dark shadows).

8.3b User Uploads ('Not an AI Image') and Clean-Source Lifecycle

• No Misclassification of Authentic Media: Files uploaded by you or authentic media from the Content Library are identified as non-AI origin (aiOrigin: false) and displayed in the interface with a neutral gray badge as 'Not an AI image'. By default, no AI badge or provenance tag is applied to authentic media.
• Voluntary AI Tagging: You may voluntarily apply an official EU badge and metadata to uploaded media if desired (e.g., to comply with internal company policies or composite workflows). Voluntary labels may be removed at any time.
• Temporary Clean Source Copies: To allow seamless switching between transparency tiers ('Badge + Metadata', 'Metadata Only', 'No EU Labeling') during draft editing, PostMaestro.ai temporarily stores an unlabelled clean source copy of the image in secure storage.
• Irrevocable Deletion Upon Publication: As soon as a post is published (status 'published'), our automated media cleanup routine (post-media-cleanup) permanently and irrevocably deletes all unlabelled clean copies from our servers. The publication state is locked, preventing retroactive removal of badges after public distribution.

Retention Period: Unlabelled clean source copies exist only until the moment of publication or until the draft post is deleted.

8.4 AI-Generated Text and Editorial Responsibility

• With regard to text, Article 50 of the EU AI Act is significantly more narrowly defined than for images, audio, and video. A disclosure obligation applies only if all three of the following conditions are met:
• 1. The text was generated or manipulated by AI.
• 2. The text will be published.
• 3. The purpose of the publication is to inform the public about matters of public interest—such as news, political or social commentary, and contributions to public debates.
• The labeling requirement does not apply if the content has been subject to human review or editorial oversight and a natural person or legal entity bears editorial responsibility for the publication.
• There is no general requirement to label every piece of AI-generated text. Anyone who uses AI as an assistive tool, reviews the texts editorially, and takes responsibility for them is generally not subject to any additional labeling requirement.
• PostMaestro.ai is designed precisely for this purpose: The generated texts are suggestions. Before scheduling or publishing, we require explicit confirmation that you have reviewed the text and assume editorial responsibility. We log this confirmation along with the time, user account, and text version so that the exception remains verifiable.
• The note in the application reads: “This text is a suggestion. Please review it before publication. By reviewing it, you assume editorial responsibility.”
• Without this review, you may not publish generated texts as editorially responsible content; the disclosure requirement under Article 50(4) of the EU AI Act may then apply.

8.5 No Emotion Recognition and No Biometric Categorization

• PostMaestro.ai does not use emotion recognition systems and does not infer emotions, emotional states, or intentions from biometric data.
• We do not engage in biometric categorization, facial recognition, biometric identification, or the identification of protected characteristics such as ethnic origin, political views, religion, union membership, health, or sexual orientation.
• Evaluation features such as Idea Validation, Brand Analyser, and performance analyses relate exclusively to content, brand, and reach data—not to individuals or biometric characteristics.
• The disclosure requirements under Article 50(3) of the EU AI Act for emotion recognition and biometric categorization systems therefore do not apply to us.

8.6 Prohibited Use: Intimate depictions without consent and depictions of child abuse

• Article 5 of the EU AI Act prohibits AI systems whose reasonably foreseeable output consists of non-consensual intimate images (NCII) or child sexual abuse material (CSAM). As a provider of a general-purpose image and video generation tool, we assess this risk of misuse as early as the design phase and implement technical safeguards.
• Protective measures implemented:
• • Input filters that block relevant prompts even before the image and video models are called
• • Output filters and the security settings of the model providers used
• • Blocking content that targets minors in a sexualized context or depicts intimate images of identifiable individuals
• • Disabling the Persona and Voice features without the data subject’s documented consent (see Section 5.9)
• • Logging of blocked requests for abuse detection, as well as the ability to suspend affected accounts
• Any use of the platform for these purposes is strictly prohibited and will result in the immediate suspension of the account and, if there is evidence of criminal activity, the involvement of the appropriate authorities.
• Report Abuse: You and third parties can report violations at any time by emailing info@nexaluna.ai with the subject line “Report AI Abuse.” We prioritize incoming reports and will confirm receipt.
• We document our risk assessment from the design phase, the filters used, and the handling of reports internally, and provide this documentation to the relevant authorities upon request.

8.7 Division of Roles: Providers and Operators

• The provider, as defined by the EU AI Act, is Nexaluna AI Solutions UG (limited liability) for the PostMaestro.ai AI system. We are subject to the provider obligations, in particular the machine-readable labeling of outputs pursuant to Article 50(2) and the disclosure of AI interaction pursuant to Article 50(1).
• You are considered an operator as soon as you use the platform under your own responsibility and publish content you have created. You are subject to the obligations of an operator, in particular the disclosure requirement under Article 50(4) regarding deepfakes and texts of public interest.
• The base models used are provided by third parties (see Section 7). These third parties are the providers of the respective AI models; we are the provider of the AI system built on top of them.
• We maintain an internal registry of all models in use, along with their respective role assignments, and update it whenever changes occur.
• To ensure AI competence in accordance with Article 4 of the EU AI Act, we train our employees on how to use the AI systems we employ and document the training sessions.

8.8 Oversight and Complaints

• As of July 29, 2026, the Federal Network Agency has been the competent market surveillance authority, central point of contact, and complaints office for the EU AI Act in Germany.
• Federal Network Agency, Tulpenfeld 4, 53113 Bonn, https://www.bundesnetzagentur.de
• You can file a complaint regarding AI transparency there at any time. We ask that you contact us in advance at info@nexaluna.ai so that we can address your concern immediately.