Privacy Policy
Last updated: June 24, 2026
Postraft.com is a product of The Avenue Creatives Ltd., a company incorporated in British Columbia, Canada (the “Company”, “we”, “us”, or “our”). We are the controller responsible for Your Personal Data.
This Privacy Policy summarizes what personal information we collect, how we use and disclose it, and the choices You have, when You visit or make a purchase from postraft.com (the “Site”, the “Application”, or the “App”).
By using the Site, You signify Your consent to this Privacy Policy. If You do not agree with it, we ask that You do not use the Site or submit any personal information to us. We process and host data in several countries, including Canada and the United States of America; if Your organization requires data to be hosted in a specific country or jurisdiction, please do not use the Site.
Unless otherwise defined in this Privacy Policy, terms used here have the same meaning as in our Terms of Service.
We reserve the right to modify this Privacy Policy at any time. Any modifications will be reflected on the Site, and Your continued use of the Site after a change constitutes acceptance of the revised Privacy Policy.
Definitions
The words of which the initial letter is capitalized have meanings defined under the following conditions, and shall have the same meaning whether they appear in singular or plural.
- Cookies: small files placed on Your device by a website, containing details such as Your browsing history on that website.
- Device Information: information about the device You use to access the Site, including Your web browser, IP address, time zone, and certain cookies, as well as how You interact with the Site.
- Personal Data: any information that relates to an identified or identifiable individual.
- Sensitive Personal Information: Personal Data that reveals or includes information such as government identifiers, financial account details, precise geolocation, race or ethnicity, religious beliefs, health, or similar categories treated as sensitive under applicable law. We generally do not collect Sensitive Personal Information.
- Service: any services provided by the Company, including use of the Site and the Application.
- Service Providers: third-party companies or individuals that process data on behalf of the Company to facilitate or provide the Service, or to help us analyze how the Service is used.
- You (“User”): the individual accessing or using the Service, or the company or other legal entity on behalf of which such individual is accessing or using the Service.
Personal Information We Collect
The Personal Data we collect depends on how You use the Service. It may include, but is not limited to:
- Email address and display name
- Branding and contact details You provide for use in templates, such as Your name, phone number, email address, and website
- Content You upload, such as photos, videos, logos, and property details
- Billing information (processed by Stripe)
- Device Information and usage data
- Any other Personal Data You choose to submit to us
We collect Personal Data when You voluntarily provide it — for example, when You sign up for the Service, make a purchase, upload content, or contact us. When You visit the Site, we also automatically collect Device Information using cookies, log files, and similar technologies. You can instruct Your browser to refuse cookies, but some parts of the Service may not function properly as a result.
How Do We Use Your Personal Data?
The Company may use Personal Data for the following purposes:
- To provide and maintain the Service, including monitoring its usage and managing Your account.
- To generate content You request: to process the inputs You provide and produce Generated Content and Output using our AI providers.
- To perform our contract with You: to process Your subscription and payments and deliver the Service.
- To contact You: by email or other electronic communication regarding updates, security notices, and information related to the Service.
- For marketing: to send You news, special offers, and information about our products and services, unless You have opted out.
- To manage Your requests and respond to Your inquiries.
- For business transfers: in connection with a merger, acquisition, financing, or sale of assets.
- For analysis and improvement: to analyze usage patterns and trends, measure the effectiveness of our campaigns, and improve our products, the Service, and Your experience.
Sharing of Your Personal Data
We may share Your Personal Data with: Service Providers (such as those listed below) that process data on our behalf; affiliates, who we require to honor this Privacy Policy; a buyer or successor in connection with a merger, sale, or other business transfer; and any other party with Your consent. If You post or share content in public areas of the Service, that information may be viewed and used by others.
We do not sell Your Personal Data.
Detailed Information on the Processing of Personal Data
Personal Data is collected for the following purposes and using the following services:
Analytics
- Fathom Analytics (Fathom Analytics Inc.): Fathom Analytics is a privacy-focused website analytics service. It is designed not to use cookies and not to collect personal data or perform cross-site tracking, and it provides us with aggregate, anonymized usage statistics.Personal data processed: anonymized usage data and page views.
Tag Management & Advertising
- Google Tag Manager (Google LLC): Google Tag Manager is a tag-management service used to manage and deploy measurement and marketing tags on the Site. Through it we may load Google and other third-party analytics or advertising tags, which may set cookies and collect usage data.Personal data processed: trackers, cookies, usage data, and device information.
Payment Processing
- Stripe (Stripe, Inc.): Stripe is our payment processor. When You make or attempt to make a purchase, You provide Your payment details directly to Stripe. We do not store full payment card numbers; we receive only a confirmation of whether payment succeeded and limited billing details.Personal data processed: name, billing address, and payment information.
Transactional Email
- Resend (Resend, Inc.): Resend is the transactional email service we use to send account-related and verification emails, such as sign-in codes.Personal data processed: email address and email content.
Marketing Email
- SendGrid (Twilio Inc.): SendGrid is an email delivery service we use to send marketing and campaign emails to users who have not opted out.Personal data processed: email address, name, and email engagement data such as opens and clicks.
- Postmark (ActiveCampaign, LLC): Postmark is an email delivery service we use to send marketing and campaign emails to users who have not opted out.Personal data processed: email address, name, email content, and email engagement data.
AI Content Generation
We use third-party AI providers to generate captions, content ideas, and images. The prompts, branding details, listing information, and media You provide may be transmitted to and processed by these providers to produce Generated Content, subject to their terms and policies.
- OpenAI (OpenAI, L.L.C.): OpenAI provides the AI models we use to generate captions, content ideas, and copy from the inputs You provide.Personal data processed: prompts and inputs You provide, including the branding and listing details used to generate content.
- Replicate (Replicate, Inc.): Replicate provides AI model hosting we use for image and content generation and processing.Personal data processed: prompts, uploaded media, and related inputs.
- Fal.ai (Features and Labels, Inc.): Fal.ai provides AI services we use for image generation and processing, such as background removal.Personal data processed: uploaded media and related inputs.
User Communication
- Contact form: When You contact us through our contact form or by email, we use the details You provide to respond to Your request.Place of processing: Canada / United States of AmericaPersonal data processed: name, email address, and message content.
Hosting, Storage & Infrastructure
These services host the data and files that enable the Application to run and to store and deliver Your content. Some services may use geographically distributed servers, which can make it difficult to determine the precise location where Personal Data is stored.
- Cloudflare R2 (Cloudflare, Inc.): Cloudflare R2 is the object-storage service where Your uploaded media and rendered Output are stored.Personal data processed: uploaded media, rendered output, and related metadata.
- Cloudflare (Cloudflare, Inc.): Cloudflare provides the content delivery network (CDN), DNS, and security services that sit in front of the Site, processing traffic to improve performance and to protect against malicious activity.Personal data processed: IP address, request metadata, and usage data.
- Vercel (Vercel, Inc.): Vercel is a hosting platform we use to deploy and serve the Postraft web application.Personal data processed: usage data, IP address, and request metadata.
- Amazon EC2 (Amazon Web Services, Inc.): Amazon Elastic Compute Cloud (EC2) provides cloud servers used to run parts of the Application and its background processing.Personal data processed: all data processed by the Application, including account data, usage data, and IP address.
- DigitalOcean (DigitalOcean, LLC): DigitalOcean provides cloud servers and managed database services that host the Application.Personal data processed: all data processed by the Application, including account data, usage data, and IP address.
Monitoring & Error Logging
- Sentry (Functional Software, Inc.): Sentry is an application monitoring and error-logging service that helps us detect, diagnose, and fix technical issues with the Service.Personal data processed: error and diagnostic data, which may include IP address, device and browser information, and limited usage context.
Transfer of Your Personal Data
The Company is based in British Columbia, Canada, and many of our Service Providers are located in the United States and other countries. As a result, Your information may be transferred to, and processed in, countries other than the one in which You reside, where data-protection laws may differ from those in Your jurisdiction. Your consent to this Privacy Policy, followed by Your submission of such information, represents Your agreement to that transfer. We take steps reasonably necessary to ensure Your data is treated securely and that adequate controls are in place.
If the Company is involved in a merger, acquisition, or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different privacy policy.
Disclosure of Your Personal Data Without Consent
Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities. The Company may also disclose Your Personal Data in the good-faith belief that doing so is necessary to:
- Comply with a legal obligation;
- Protect and defend the rights or property of the Company;
- Prevent or investigate possible wrongdoing in connection with the Service;
- Protect the personal safety of users of the Service or the public; or
- Protect against legal liability.
Retention of Your Personal Data
We retain Your Personal Data only for as long as necessary for the purposes set out in this Privacy Policy, including to comply with our legal obligations, resolve disputes, and enforce our agreements. When You delete content or close Your account, we delete or anonymize Your Personal Data within a reasonable period, except where retention is required by law.
Security of Your Personal Data
The security of Your Personal Data is important to us, and we try our best to protect it by maintaining physical, organizational, and technological safeguards appropriate to the sensitivity of the Personal Data we hold, and by limiting access to those within our organization who need it to provide the Service. However, no method of transmitting or storing data over the internet is completely secure, so we cannot guarantee absolute security. You are responsible for keeping Your account credentials confidential.
Links to Other Websites
Our Service may contain links to websites not operated by us. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites or services, and we strongly advise You to review the privacy policy of every site You visit.
Children’s Privacy
The Service is intended for users who are at least 18 years of age. We do not knowingly collect Personal Data from anyone under 18. If You are a parent or guardian and believe Your child has provided us with Personal Data, please contact us, and if we learn that we have collected Personal Data from someone under 18 without appropriate consent, we will take steps to delete it.
Your Privacy Rights (Canada)
As a Canadian company, we handle Personal Data in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including British Columbia’s Personal Information Protection Act (PIPA). You have the right to access and correct Your Personal Data and to withdraw Your consent to our processing, subject to legal and contractual restrictions. To exercise these rights, please contact us.
California Consumer Privacy Act (CCPA)
Under the CCPA, as amended by the CPRA, California consumers have the following rights:
- The right to know: to request disclosure of the categories and specific pieces of personal data we have collected, used, and disclosed.
- The right to delete personal data we have collected, subject to certain exceptions.
- The right to correct inaccurate personal data.
- The right to opt out of the sale or sharing of personal data. As noted above, we do not sell or share Your Personal Data.
- The right to limit the use of Sensitive Personal Information.
- The right to non-discrimination for exercising any of these rights.
To protect Your information, we may need to verify Your identity before fulfilling a request, and You may use an authorized agent to submit a request on Your behalf with proof of authorization. If You make a request, we will respond within 45 days (which may be extended where permitted by law). To exercise any of these rights, please contact us.
General Data Protection Regulation (GDPR) Rights
If You are in the EU or EEA, You are entitled to the following:
- The right to access: to request copies of Your personal data.
- The right to rectification: to request that we correct inaccurate or incomplete information.
- The right to erasure: to request that we erase Your personal data, under certain conditions.
- The right to restrict processing, under certain conditions.
- The right to object to processing, under certain conditions.
- The right to data portability, under certain conditions.
If You make a request, we have one month to respond. To exercise any of these rights, please contact us.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page and updating the “Last updated” date above. You are advised to review this Privacy Policy periodically; changes are effective when posted.
Contact Us
If You have any questions regarding this Privacy Policy, or to access Your information, please contact us at [email protected].