Privacy Policy

This Privacy Policy describes how RightBack.com LLC d/b/a Postvertise ("Postvertise," "we," "us," or "our") processes information when you use the Postvertise website and related services (the "Platform").

The Platform is operated by RightBack.com LLC d/b/a Postvertise.

Questions about this policy may be sent using the contact details in Section 31.

This policy applies to visitors, Creators, and Brands who use the Platform.

It should be read with our Terms of Service, Cookie Policy, Social Data Disclosure, and Data Deletion pages.

This policy describes the current production implementation. It does not describe unimplemented roadmap features such as user-to-user direct messaging or publishing content to social platforms.

We process information you provide, information generated by the Platform, and information received from social platforms you choose to connect.

• Account and authentication data
• Creator and Brand profile data
• Campaign, invitation, application, participant, deliverable, and submission data
• Rate-card and frozen participant pricing information
• Payment, billing-address, Creator earning, and Creator transfer records
• Stripe customer, payment, Connect, and webhook identifiers/payloads needed to operate marketplace payments
• Connected social account identity and synced metrics/content permitted by your authorization
• In-app notification records
• Technical session data needed to operate login
• Transactional email content related to magic links, verification, and service messages

Depending on account type and forms you complete, you may provide:

• Email address and account type (Creator or Brand)
• Name and Creator display name / username / niche
• Brand company name, username, and optional website, industry, description, logo, and location
• Creator bio, profile photo, country, optional date of birth, gender, and gender self-description
• Campaign briefs, budgets, targeting metadata, invitation/application messages, and submission captions, URLs, and notes
• Creator rate-card pricing information
• Brand billing address details used for payment and, where Stripe Tax is enabled, tax calculation
• Payment-method authorization details collected through Stripe (Postvertise does not store full payment-card numbers)

If you connect Instagram, Facebook, TikTok, or X, Postvertise receives information permitted by the scopes you approve and by each provider's APIs.

Typical categories include provider account identifiers, usernames, display names, profile URLs, profile images, connection status, and OAuth tokens needed to maintain the connection.

Depending on the provider, Postvertise may also sync profile metrics, audience counts, and a limited sample of public content metrics. TikTok sync does not ingest video content items. See Social Data Disclosure for provider detail.

Postvertise does not receive payment-card data from social platforms and does not use social connections to publish posts on your behalf. Payment-card data for Brand charges is collected and processed by Stripe, not through social OAuth connections.

We generate technical and derived records such as:

• Session records (including IP address and user agent stored with Laravel sessions)
• Email verification timestamps and magic-link token hashes
• Social sync status, snapshots, and derived metrics (for example engagement-related calculations from synced data)
• Campaign participant/deliverable status transitions and review timestamps
• Marketplace payment status timestamps, fee and tax snapshots (when tax is calculated), Creator earning statuses, and Connect transfer statuses
• In-app notification records related to marketplace and payment events

We use information to:

• Create and authenticate accounts (including passwordless magic-link sign-in)
• Operate Creator and Brand profiles and onboarding
• Provide creator discovery/search and public Creator profiles
• Sync and display authorized social metrics for marketplace and Creator analytics features
• Operate campaigns, invitations, applications, participants, deliverables, and submissions
• Authorize Brand payment methods, calculate and collect Brand charges (including platform fees and, where Stripe Tax is enabled, applicable taxes), fund Creator earnings, and initiate Stripe Connect Transfers of Creator service amounts
• Send in-app notifications about marketplace and payment events
• Send transactional email (magic links, welcome, verification, password reset where used)
• Secure the Platform, debug failures, and enforce Terms
• Respond to lawful requests

Postvertise helps Brands discover Creators and helps users run campaign workflows on the Platform.

Public Creator directory and profile pages expose allowlisted profile and social aggregate fields to visitors. Authenticated campaign features share campaign-related data between the Brand and participating Creators.

Postvertise does not sell personal information.

Creators may connect supported social accounts through provider OAuth/OIDC flows. Credentials (access and refresh tokens) are stored encrypted at rest in Postvertise's database and are never shown in public API resources.

You can disconnect a social account in the dashboard. Disconnecting deletes that connection's stored credentials and synced social snapshots/metrics/content for that account.

Connecting an account does not grant Postvertise permission to publish content to that platform; current integrations are read/sync oriented only.

After a connection is established, Postvertise may sync data automatically after linking, when you trigger a manual sync, and on a periodic schedule while the account remains connected (the application currently checks for due accounts about hourly and typically re-syncs an eligible connected account about every six hours after a successful sync). Exact timing is not guaranteed. Synchronization uses official platform APIs only—Postvertise does not scrape social websites.

Synced metrics may include follower-style audience counts, profile counters, verification flags where provided, content engagement counters for ingested items, platform Insights/analytics where the granted permissions and provider APIs make them available, aggregated platform audience demographics when an official Insights API returns them, and derived metrics calculated by Postvertise from those platform-supplied aggregates.

Availability depends on platform, account type, permissions, API eligibility, and whether the platform returns the requested metric. Where available through a connected Instagram Professional account and Meta’s follower demographics Insights APIs, Postvertise may process aggregated audience geographic information, including country- or city-level audience segments, as well as age and gender aggregates. City-level Instagram audience segments, when returned, are shown in authenticated Creator analytics and are not currently included on the public Creator profile allowlist. Availability is not guaranteed for every account (for example, Meta may withhold follower demographics for smaller accounts). Facebook Page audience-country Insights are experimental and disabled by default in Postvertise; Facebook age/gender Page Insights are not available through the current integration. TikTok and X do not supply creator follower demographics through the currently authorized integrations. Platform audience demographics are never scraped or inferred from individual followers.

Public Creator profiles distinguish (A) Creator-provided personal profile information such as optional gender labels and age or age range derived from a date of birth the Creator supplies, from (B) audience demographic information supplied by a connected social platform’s Insights APIs (for example top audience countries, age ranges, or gender mix). Audience demographics describe the Creator’s followers/audience aggregates—not the Creator’s own age or gender.

In-product “Analytics” refers to these synced social metrics, not third-party advertising pixels or website analytics suites. The frontend does not load Google Analytics, Meta Pixel, or similar marketing trackers.

Brands may create campaigns with budgets, schedules, platform targets, audience targeting metadata, and deliverable definitions.

Creators may receive invitations, submit applications, join as participants, receive deliverable tasks, and submit content URLs/captions/notes for Brand review.

Campaign participation may include payment-method authorization at booking and a later Brand charge through Stripe when the applicable payment conditions are met. Campaign data and payment status relevant to a participation are visible to the Brand and Creator counterparties through authenticated APIs. It is not published on the public marketing Creator profile endpoints.

Marketplace payments are processed through Stripe. Depending on your role and the transaction, Postvertise may process or store: Brand billing addresses; Stripe Customer identifiers; SetupIntent and PaymentIntent identifiers and statuses; payment-method references returned by Stripe; frozen Creator service amounts and additive Postvertise platform fees; tax calculation identifiers, tax amounts, and related snapshots when Stripe Tax is enabled; Creator earning records; Stripe Connect Express account identifiers and readiness flags; and Connect Transfer identifiers and statuses.

Payment-card details used to authorize and charge Brands are collected and processed by Stripe. Postvertise does not store full payment-card numbers in its application database.

Where Stripe Tax is enabled, applicable taxes may be calculated at charge time using the Brand billing address and related transaction details. Tax is not always calculated or collected on every transaction. Tax treatment may depend on applicable law and transaction details.

Creator service amounts are transferred through Stripe Connect to the Creator’s Connect Express balance when transfer conditions are met. Postvertise does not currently initiate bank payouts from the application.

We send transactional messages required to operate the Platform, including magic-link emails, welcome messages, email verification, and password-reset messages where that flow is used.

We also create in-app notifications for certain marketplace and payment events (for example invitations, applications, deliverable reviews, payment status changes, and transfer events).

Email delivery is processed by Resend using Laravel Mail. Account creation does not depend on successful email delivery succeeding in every case, but magic-link sign-in requires email delivery to complete authentication.

The primary authentication flow is passwordless: we email a short-lived magic link (token hashed at rest; plain token sent only in the email link). Links expire quickly (currently one minute in application configuration).

Sessions use Laravel Sanctum cookie/session authentication for the SPA. The browser stores session and CSRF cookies required for authenticated API calls. Authentication tokens are not stored in localStorage or sessionStorage.

Passwords may still exist for some accounts or legacy flows and are stored hashed when present. Password fields are nullable for magic-link accounts.

We apply technical controls appropriate to the current stack, including hashed passwords when used, encrypted storage of social OAuth access and refresh tokens via application encryption, server-side session authentication, and CSRF protection for cookie-authenticated API requests.

No method of transmission or storage is perfectly secure. Absolute security is not guaranteed.

Social provider access tokens and refresh tokens are stored in `social_account_credentials` with application-level encryption and are hidden from API serialization.

Magic-link secrets are stored as hashes. CSRF secrets are handled via Sanctum/Laravel cookie conventions.

Tokens are used only to maintain authorized connections and perform permitted syncs. They are deleted when you disconnect the social account.

We share information as follows:

• Public Creator profile and search visitors: allowlisted profile and social aggregate fields
• Brands and Creators interacting on a campaign: campaign, participation, deliverable, submission, and payment-status fields needed for that workflow
• Service providers: currently Resend for email; Stripe for payment processing, Connect transfers, and tax calculation when enabled; social platforms when you authorize connections; optional cloud object storage if configured for files
• Legal: if required by law or to protect rights and safety
• Business transfers: if Postvertise assets are transferred, information may move with them subject to continued protections

Known processors/integrations in the current implementation include Stripe (Customers, SetupIntents, PaymentIntents, Tax Calculations when enabled, Connect Express, Transfers, and payment webhooks), Resend (email), Meta/Instagram/Facebook APIs, TikTok Open API, and X API, plus the database and hosting infrastructure used to run the application.

Production hosting provider and primary data-center region are not documented in the application repository and should be published by the operator when available.

Each social platform and Stripe process data under their own terms and policies when you authorize access or complete a payment-related action.

Public Creator profiles and search results may show username, display name, bio, profile image, country, niche, limited personal demographic labels derived from Creator-provided profile inputs (such as optional gender and age or age range), connected provider labels/usernames, and aggregate social metrics such as followers, views, and engagement-related figures when available.

When a connected platform’s Insights APIs return aggregated audience demographics, public profiles may also show allowlisted top audience countries, audience age ranges, and audience gender mix sourced from that platform. Those fields are audience aggregates from the connected account—not the Creator’s personal age or gender. City-level Instagram audience segments are not currently published on public Creator profiles.

Email addresses, passwords, session data, OAuth tokens, date of birth (raw), billing addresses, payment identifiers, and non-public account settings are not included in public Creator profile resources.

Brands can access the same public discovery/profile information available to visitors.

When a Brand invites a Creator, reviews an application, or works with a participant, the Brand can also see campaign workflow data (messages, statuses, deliverables, submissions, and review notes) exchanged for that campaign, as well as payment-status information relevant to that participation.

Brands do not receive Creator OAuth tokens, magic-link secrets, or Creator Connect bank-account details through Postvertise APIs.

Examples of data not exposed on public profiles include account email, authentication secrets, social access/refresh tokens, provider credential rows, internal sync failure details, raw date of birth, Brand billing addresses, Stripe payment-method secrets, full Stripe webhook payloads, and city-level Instagram audience demographic breakdowns (when synced, those segments remain in authenticated Creator analytics).

Creator analytics detail endpoints require Creator authentication.

Social platform APIs, Stripe, and Resend are third-party services that may process data in multiple countries.

Because production hosting region is not documented in this repository, we cannot assert a single storage country here. If you need transfer details for a specific region, contact us using Section 31 after the operator publishes infrastructure details.

Account and profile data are retained while your account remains open. The application does not currently include an automated retention purge job for closed accounts.

Magic-link tokens expire after a short period and are marked consumed when used. Sessions expire according to server session configuration (default idle lifetime is 120 minutes).

Social connection data and synced metrics/content are retained until you disconnect the account (which deletes that connection's stored social data) or until you delete your Postvertise account.

Payment, earning, transfer, and related Stripe webhook records may be retained after account deletion or anonymization where needed for operational, contractual, accounting, fraud-prevention, or legal purposes. The application does not currently encode a coded TTL purge for those financial records.

We do not publish fixed multi-year retention schedules in code; any legal hold requirements would be handled operationally.

Authenticated Creators and Brands can delete their Postvertise account from Dashboard → Settings (Danger Zone), which calls DELETE /api/account for the signed-in owner only.

Deletion disconnects social accounts, removes stored social credentials and synced social data from Postvertise, invalidates sessions and unused magic-link tokens, and removes or anonymizes personal profile information. Shared campaign relationship rows and certain payment, earning, or transfer records may remain in retained or anonymized form where required for referential integrity, accounting, fraud prevention, or legal purposes.

Deleting a Postvertise account does not necessarily delete Stripe Customer or Connect objects held by Stripe. Stripe may retain information independently under its own policies and legal requirements.

Postvertise deletes stored social credentials and connection data on its side. Provider-side OAuth token revocation with Instagram, Facebook, TikTok, or X is not currently implemented.

If you cannot sign in, follow the offline request instructions on our Data Deletion page and contact us using Section 31.

Creators can disconnect a connected social account from Social Accounts in the dashboard.

Disconnection deletes stored OAuth credentials and synced social snapshots, metrics, and content items for that connection from Postvertise.

Disconnecting a social account is the self-service method to delete that provider's stored connection and synced data from Postvertise.

Deleting your Postvertise account also removes all social connections on that account as described on Data Deletion.

Data may remain in encrypted backups or logs for a limited operational period until overwritten; the application does not expose a backup-purge SLA.

Depending on where you live, you may have rights to request access, correction, deletion, or restriction of certain personal information.

Self-service account deletion is available while signed in. A formal DSAR portal is not implemented; other rights requests can be made by contacting us using Section 31. We may need to verify control of the account email before acting.

This policy describes practices; it does not claim certification under any specific privacy law framework.

Postvertise uses essential cookies for session authentication and CSRF protection. See the Cookie Policy for details.

We do not currently use analytics or marketing cookies or third-party advertising pixels on the site.

Postvertise is intended for users who are at least 18 years old (or the higher age of majority required where you live).

We do not knowingly collect personal information from children under 18. If you believe a minor has created an account, contact us using Section 31.

We may update this Privacy Policy to reflect product or legal changes. We will post the updated policy and revise the “Last updated” date.

Material changes should be reviewed on this page before you continue using the Platform.

Privacy and data requests:

RightBack.com LLC d/b/a Postvertise

Email: support@postvertise.com

Address: 8101 College Blvd Ste 100-1023 Overland Park, KS 66210 United States

Use the email above for privacy and deletion requests, or visit Contact & Support.