Privacy policy

5.1 Registration and account data

• When you register, we collect:
• • Email address (required)
• • Username (required)
• • Password (encrypted with bcrypt, at least 8 characters)
• • Account type (Personal or Company)
• • Date of registration
• • Two-factor authentication (2FA) — optional but recommended
• Purpose: Providing and managing your account, authentication, security
• The 2FA data is stored only locally on your device (QR code scan). We store only the activation status.
• Note: Alternatively, you can also register or log in via Google, Meta (Facebook), LinkedIn, TikTok, or X—see Section 5.1a for the data and permissions requested in each case.
• To protect against automated registrations (bots), we use Cloudflare Turnstile (see Section 10a.2).

5.1a Registration & Sign-In via Third-Party Providers (Social Login)

• In addition to the standard registration with an email address and password, you can register or log in to PostMaestro.ai using the following third-party providers. These connections are used exclusively for account creation and login and are independent of the social media links used for publishing posts (see Section 5.5)—in each case, separate OAuth permissions (scopes) with significantly more limited access are requested:
• • Google (Scopes: openid, profile, email) — the following information is transmitted: Google ID, email address, first and last name, profile picture, and language
• • Meta / Facebook Login (Scopes: public_profile, email) — the following information is transmitted: Facebook ID, email address, first and last name, profile picture, and language
• • Instagram Business Login (Scope: instagram_business_basic) — the following information is transmitted: Instagram ID, username, display name, and profile picture (no email address—this is requested separately during onboarding)
• • LinkedIn (OpenID Connect, scopes: openid, profile, email) — the following information is transmitted: LinkedIn ID, email address, first and last name, profile picture, and language
• • TikTok Login Kit (Scopes: user.info.basic, user.info.profile) — TikTok Open ID, username, display name, and profile picture are transmitted (TikTok does not provide an email address; a placeholder address is used internally until one is entered during onboarding)
• • X / Twitter (OAuth 2.0 with PKCE, scopes: users.read, users.email, tweet.read) — the following information is transmitted: X ID, username, display name, profile picture, and — if provided to X — the verified email address
• These scopes allow only the retrieval of basic profile data for account creation. No posts are published, no messages are read, and no access to your contacts is granted.
• If an email address that is already registered signs up again through a different provider, we recognize the existing account based on the email address (regardless of case) and link the new provider ID retroactively (account linking) instead of creating a duplicate account.
• If enabled in your security settings, we will send an email notification each time you log in (including via social login), including the time, device, browser, and approximate location. Your location is determined based on your IP address using the third-party provider ipinfo.io (see Section 10a.1).
• Meta Account Deletion: For sign-ups via Meta (Facebook/Instagram), we provide the callback endpoints required by Meta for deauthorization and data deletion. If you remove the app in your Facebook account settings or request data deletion there, we automatically receive a corresponding request and provide the processing status via a status URL displayed by Meta.

5.2 Brand profiles and brand data

• When creating a brand profile, we save:
• - Brand name and description
• - Website URL (for Brand Analyser)
• - Uploaded brand guidelines and documents
• - Analysed brand data (colours, fonts, tone of voice)
• - Logo and visual assets
• - Target group definitions
• - Industry and category
• Purpose: Creation of market-compliant content, brand identity management

5.3 Content data (posts, media, campaigns)

• When you use the content creation feature, we store:
• • Social media posts created and scheduled (text, captions, hashtags)
• • Uploaded and generated images, videos, and graphics
• • Campaign data and templates
• • Idea validation (swipe data in the Idea Generator)
• • Research Documents
• • Content Status (Draft, Review, Scheduled, Published)
• • Publication dates and platforms
• • Tagging and origin data for generated media (content class, tagging status, metadata status), as well as your confirmation of the editorial review of generated texts
• Purpose: Content management, planning, automation, archiving, and compliance with AI transparency requirements
• To the extent technically feasible, generated media files contain labeling information, metadata, or comparable technical indicators that indicate that the content is AI-generated or AI-assisted (see Section 8.2).

5.4 Usage data and analytics

• We store data to improve the platform:
• - Login times and session duration
• - Features and functions used
• - Token consumption and billing data
• - Error reports and performance data
• - Feedback and support requests
• Purpose: Platform improvement, error analysis, support, billing

5.5 Social Media Platform Links (Publication)

• When you connect social media accounts for publishing (Instagram, Facebook, Threads, WhatsApp Business, LinkedIn, X, YouTube, TikTok, Wix, WordPress, your own website), each platform uses OAuth to request only the permissions (scopes) necessary for that purpose. These connections are independent of the social login used for account registration (see Section 5.1a). In this process, we store:
• • OAuth access and refresh tokens for each platform, stored in the database encrypted using AES-256-GCM (see Section 10)
• • Platform account, page, and channel IDs, as well as display name, profile picture, or logo
• • On LinkedIn, additionally: company pages you manage (ID, name, logo) for selecting the publication destination
• • On Facebook/Instagram/WhatsApp: automatically detected links between a Facebook Page, an Instagram Business account, and a WhatsApp Business account (linked accounts are "carried over" when establishing a connection)
• • Expiration time of the access token for automatic renewal (e.g., for X and Wix)
• • For WordPress or your own website: the login credentials you provided (application password or endpoint URL and secret) instead of an OAuth token
• This data is used exclusively to publish posts on the linked accounts on your behalf and to display related statistics (analytics) within PostMaestro.ai. Access to private messages or contacts occurs exclusively within the scope of the Community Manager feature you have enabled (Facebook Messenger, Instagram Direct, WhatsApp).
• You can disconnect any connection at any time in the settings. We also recommend revoking the app's permission directly on the respective platform (e.g., in your Meta account settings).

5.6 Team and company account data

• For company accounts with multiple users, we also store data:
• - Team members and their roles
• - Authorisations and access control
• - Approval workflows and comments
• - Activity logs (audit log)
• Purpose: Team collaboration, access control, compliance

5.7 Push Notifications (Mobile App)

• If you use our mobile app and enable push notifications, we process:
• • Device token for sending notifications
• • Notification Preferences
• We use Firebase Cloud Messaging (Google) to send push notifications.
• You can turn off push notifications at any time in your device's settings.

5.8 News, research and RSS feeds

• The platform offers a news function that uses AI-supported research (via Perplexity AI) as standard to provide relevant industry news. You can also add your own RSS feeds. In doing so, we process:
• - Search queries and topic preferences for AI-supported news searches
• - The URLs of the RSS feeds you have added
• - Your preferences and categorizations for these feeds
• - Read or saved articles
• The platform retrieves the content of the third-party feeds via our servers so that your IP address is not transmitted to the operators of the RSS feeds. When using the AI-supported news search, your search queries are transmitted to Perplexity AI (see section 7.3).
• Purpose: Providing personalized industry news, research and content inspiration

6.1 Double opt-in procedure

After registering for the newsletter, you will receive a confirmation e-mail.

You will only be added to the newsletter mailing list after clicking on the confirmation link.

This serves to protect against misuse of your e-mail address.

6.2 SendGrid (e-mail dispatch)

We use SendGrid (Twilio Inc., USA) to send newsletters.

SendGrid processes your e-mail address on our behalf to send the newsletter.

We have concluded an order processing agreement (AVV) with SendGrid in accordance with Art. 28 GDPR.

SendGrid is EU-US Data Privacy Framework certified.

Further information: https://www.twilio.com/legal/privacy

Privacy policy of Twilio (SendGrid)

6.3 Newsletter tracking

Current: No tracking of open rates or clicks

Planned: Opt-in for newsletter statistics (opening rate, click tracking)

You will be informed before tracking is activated and can give or refuse your consent.

6.4 Cancellation

You can unsubscribe from the newsletter at any time:

- Via the unsubscribe link in every newsletter e-mail

- By e-mail to newsletter@nexaluna.ai

- In the settings of your account (if available)

After cancellation, your data will be deleted from the newsletter distribution list.

8.1 Disclosure of Interaction with an AI System

• In PostMaestro.ai, you interact directly with AI systems. All features that generate, evaluate, summarize, translate, or rephrase content are AI-powered and are labeled as such in the user interface.
• The notice is provided before the first interaction, is clear, understandable, and clearly distinguishable from the other user interface elements (Art. 50(1) of the EU AI Act).
• We provide this information in an accessible format and ensure it complies with recognized accessibility requirements (Art. 50(5) of the EU AI Act).
• AI responses and suggestions may be incomplete, outdated, or factually incorrect. They do not constitute legal, tax, medical, or financial advice.

8.2 Machine-Readable Markup for Generated Content

• Under Article 50(2) of the EU AI Act, content generated by AI systems that produce synthetic images, audio, video, or text must be labeled as artificially generated or manipulated in a machine-readable format. The labeling must be effective, interoperable, robust, and reliable.
• We implement this requirement using several complementary methods, since, given the current state of the art, no single method alone can achieve the required robustness:
• • Source metadata in the file: During export, we write XMP and IPTC metadata into the generated media files, specifically the IPTC field “Digital Source Type” with the value “trainedAlgorithmicMedia,” as well as information about the AI system used, the model version, and the time of generation.
• • Content Credentials (C2PA): For generated image and video files, we incorporate a cryptographically signed provenance statement compliant with the C2PA standard into the output pipeline.
• • Provider-side watermarks: If the respective model provider includes invisible watermarks, these are retained and not removed. For Google Gemini image models, this is the SynthID watermarking method.
• • Validation: After writing, we read the markup again and log a status for each file (pending, valid, missing, removed). If the embedding fails, we enforce visible labeling for sensitive content classes.
• The marker is set on the server side before a file is stored or delivered, so that it survives rendering, uploading, and downloading. Technically, it cannot be ruled out that third parties or target platforms may remove metadata during re-uploading, compression, or cropping. In this case, the visible mark remains your safeguard (see 8.3).
• Implementation Status and Deadline: The transparency requirements under Article 50 of the EU AI Act have been in effect since August 2, 2026. For AI systems that—like PostMaestro.ai—were already on the market prior to this date, the transition period extends until December 2, 2026. We will fully implement the procedures described above within this period and document the implementation status internally.
• A notice in this privacy policy alone does not satisfy the requirements of Article 50(2) of the EU AI Act. What is required is a machine-readable label on the file itself.

8.3 Your Responsibilities as an Operator Regarding Deepfakes

• If you publish content generated by PostMaestro.ai, you are considered an “operator” under the EU AI Act. In this case, the disclosure requirement under Article 50(4) of the EU AI Act applies to you, not to us.
• If you create or edit image, audio, or video content that bears a striking resemblance to real people, objects, places, institutions, or events (“deepfakes”), you must disclose upon publication that the content has been artificially generated or manipulated.
• According to the European Commission’s guidelines, this obligation applies regardless of whether there was any intent to mislead and even if no specific real person is depicted. It therefore generally applies to posts on social media.
• To assist you, we provide: a visible label as the default setting for sensitive content classes, a suggested warning message during export, and a note in the publishing workflow.
• The default setting is always “enabled.” Disabling this feature must be documented: We record the time, user account, workspace, and version of the confirmation text. For photorealistic depictions of people and synthetic voices, disabling this feature is not permitted.
• You may not remove, disable, circumvent, or interfere with the labeling and disclosure mechanisms we provide (see Section 6.4 of the Terms and Conditions).
• This requirement applies in addition to the disclosure requirements of the respective social media platform. You must determine for yourself whether a disclosure requirement applies in each individual case.

8.4 AI-Generated Text and Editorial Responsibility

• With regard to text, Article 50 of the EU AI Act is significantly more narrowly defined than for images, audio, and video. A disclosure obligation applies only if all three of the following conditions are met:
• 1. The text was generated or manipulated by AI.
• 2. The text will be published.
• 3. The purpose of the publication is to inform the public about matters of public interest—such as news, political or social commentary, and contributions to public debates.
• The labeling requirement does not apply if the content has been subject to human review or editorial oversight and a natural person or legal entity bears editorial responsibility for the publication.
• There is no general requirement to label every piece of AI-generated text. Anyone who uses AI as an assistive tool, reviews the texts editorially, and takes responsibility for them is generally not subject to any additional labeling requirement.
• PostMaestro.ai is designed precisely for this purpose: The generated texts are suggestions. Before scheduling or publishing, we require explicit confirmation that you have reviewed the text and assume editorial responsibility. We log this confirmation along with the time, user account, and text version so that the exception remains verifiable.
• The note in the application reads: “This text is a suggestion. Please review it before publication. By reviewing it, you assume editorial responsibility.”
• Without this review, you may not publish generated texts as editorially responsible content; the disclosure requirement under Article 50(4) of the EU AI Act may then apply.

8.5 No Emotion Recognition and No Biometric Categorization

• PostMaestro.ai does not use emotion recognition systems and does not infer emotions, emotional states, or intentions from biometric data.
• We do not engage in biometric categorization, facial recognition, biometric identification, or the identification of protected characteristics such as ethnic origin, political views, religion, union membership, health, or sexual orientation.
• Evaluation features such as Idea Validation, Brand Analyser, and performance analyses relate exclusively to content, brand, and reach data—not to individuals or biometric characteristics.
• The disclosure requirements under Article 50(3) of the EU AI Act for emotion recognition and biometric categorization systems therefore do not apply to us.

8.6 Prohibited Use: Intimate depictions without consent and depictions of child abuse

• Article 5 of the EU AI Act prohibits AI systems whose reasonably foreseeable output consists of non-consensual intimate images (NCII) or child sexual abuse material (CSAM). As a provider of a general-purpose image and video generation tool, we assess this risk of misuse as early as the design phase and implement technical safeguards.
• Protective measures implemented:
• • Input filters that block relevant prompts even before the image and video models are called
• • Output filters and the security settings of the model providers used
• • Blocking content that targets minors in a sexualized context or depicts intimate images of identifiable individuals
• • Disabling the Persona and Voice features without the data subject’s documented consent (see Section 5.9)
• • Logging of blocked requests for abuse detection, as well as the ability to suspend affected accounts
• Any use of the platform for these purposes is strictly prohibited and will result in the immediate suspension of the account and, if there is evidence of criminal activity, the involvement of the appropriate authorities.
• Report Abuse: You and third parties can report violations at any time by emailing info@nexaluna.ai with the subject line “Report AI Abuse.” We prioritize incoming reports and will confirm receipt.
• We document our risk assessment from the design phase, the filters used, and the handling of reports internally, and provide this documentation to the relevant authorities upon request.

8.7 Division of Roles: Providers and Operators

• The provider, as defined by the EU AI Act, is Nexaluna AI Solutions UG (limited liability) for the PostMaestro.ai AI system. We are subject to the provider obligations, in particular the machine-readable labeling of outputs pursuant to Article 50(2) and the disclosure of AI interaction pursuant to Article 50(1).
• You are considered an operator as soon as you use the platform under your own responsibility and publish content you have created. You are subject to the obligations of an operator, in particular the disclosure requirement under Article 50(4) regarding deepfakes and texts of public interest.
• The base models used are provided by third parties (see Section 7). These third parties are the providers of the respective AI models; we are the provider of the AI system built on top of them.
• We maintain an internal registry of all models in use, along with their respective role assignments, and update it whenever changes occur.
• To ensure AI competence in accordance with Article 4 of the EU AI Act, we train our employees on how to use the AI systems we employ and document the training sessions.

8.8 Oversight and Complaints

• As of July 29, 2026, the Federal Network Agency has been the competent market surveillance authority, central point of contact, and complaints office for the EU AI Act in Germany.
• Federal Network Agency, Tulpenfeld 4, 53113 Bonn, https://www.bundesnetzagentur.de
• You can file a complaint regarding AI transparency there at any time. We ask that you contact us in advance at info@nexaluna.ai so that we can address your concern immediately.