Privacy Policy

1. Who we are (data controller)

ProPost AI is operated by Dinovix Ltd, registered in Cameroon. Dinovix Ltd is the data controller responsible for your personal data under this policy. You can reach us at contact@dinovix.com for any privacy question or request.

2. What data we collect

Account data: your name, email address, and profile picture, provided by Google or LinkedIn when you sign in.

Profile & persona data: the role, experience, tone of voice, target audience, and niches you enter during onboarding or in Settings, plus any additional named personas you create, writing samples you paste in to teach the app your voice, and the schools or past employers you optionally list.

Contacts you save: names, headlines, companies, profile links, tags, private notes, and follow-up dates for people you choose to track. This is information about other people that you enter yourself; we never fetch it from LinkedIn, which offers no API for connections, search, or messaging. You are responsible for what you record here; keep it accurate and delete what you no longer need.

Job descriptions and watchlists: any job description or role brief you paste in for a profile audit, and the companies or topics you add to the opportunity radar.

LinkedIn posting authorization: if you connect LinkedIn to publish on your behalf, we store an encrypted access token (AES-256-GCM) and its expiry, never your LinkedIn password.

Content: drafts generated for you, any edits or chat instructions you give, images you generate or upload, and posts you approve, schedule, or publish.

LinkedIn profile text: the headline/About-section text you choose to paste in for an AI profile review, and the review results.

Usage & audit logs: timestamps, AI token counts, request outcomes, and the actions you take in the app, kept for security, debugging, and quota enforcement.

Billing data: your selected plan, currency, and billing period, plus payment gateway references. We never see or store your card or mobile-money details; those are handled directly by our payment processors, KoraPay and Chariow.

Technical data: standard server request metadata (e.g. IP address, browser locale) and the timezone you set for scheduling.

Connected channels: for each social account you connect (LinkedIn, X, Bluesky, Threads, Mastodon, Facebook, Instagram, TikTok, Pinterest, YouTube, Google Business, Telegram and others), its name, handle, profile photo, follower count and bio as the network reports them, an encrypted access token, and the posting schedule you set.

AI assistant connections: if you connect an AI assistant (such as Claude, ChatGPT or Cursor) through our MCP server, or create an API key, we keep its name, what you allowed it to do, and when it was connected and last used. Its access tokens and your API keys are stored only as one-way hashes, never in readable form.

Signed-in devices: for each device where you're signed in, its browser and operating system (from the user agent), the approximate city and country our host derives from the connection (the IP address itself isn't kept), and when it was last active, so you can review and sign out devices in Settings → Devices. Removed when the sign-in ends or you sign the device out.

3. Why we use your data (purposes & legal basis)

To provide the service you signed up for (generating, scheduling, and publishing your posts) under the contract formed by these Terms.

To process payments and manage your subscription, under the same contract.

To maintain security, prevent abuse, and debug failures, under our legitimate interest in running a reliable service.

To send service-related notices (e.g. billing or trial-expiry notices) under contract necessity or legitimate interest.

To comply with legal or tax obligations, where applicable, under legal obligation.

4. Who we share it with

We never sell your data or share it for advertising. To run the service, we share data with the following processors, each only as needed to do its job for us:

Google Cloud / Firebase (Google LLC): database hosting (Firestore) and push notifications (Firebase Cloud Messaging); Google also provides "Sign in with Google".

Vercel (Vercel Inc.): application hosting; Vercel Web Analytics, which counts page views without cookies (an anonymous identifier that changes daily, page addresses without their query strings); and the Vercel AI Gateway, which routes your generation requests to the AI model provider for the model in use (OpenAI, Anthropic or Google). The profile and content text behind a draft is sent to that provider to produce it.

Tavily: web search for the opportunity radar. It receives the companies or topics on your watchlist and one of your niches, not your profile, posts or contacts.

Resend: delivery of our emails (reminders, notifications, account messages); it receives your email address and the message.

KoraPay and Chariow: payment processing for checkout and payment verification. They receive what's needed to take a payment; we never receive your card or mobile-money details.

Zernio: the publishing service behind channels connected through it. It receives the posts you send to those channels and returns their analytics, comments and messages.

The social networks you connect (LinkedIn, X, Meta for Facebook, Instagram, Threads and WhatsApp, TikTok, Bluesky, your Mastodon server, Pinterest, YouTube, Google Business, Telegram): for sign-in where offered, and to publish and read back the content you ask us to. Each network handles that content under its own privacy policy.

AI assistants you connect yourself: if you connect an AI assistant through our MCP server, it receives the account, channel and post data its requests ask for, within the permission level you chose. That assistant's provider handles the data under its own terms, which you accept with them; you can disconnect it at any time in Settings → Integrations.

5. International data transfers

Dinovix Ltd is based in Cameroon. The infrastructure providers listed above operate data centers globally, including in the EU and US, so your data may be processed outside your own country. Where this involves transferring personal data out of the EEA, we rely on the safeguards those providers themselves offer (such as standard contractual clauses under their respective data processing terms).

6. How long we keep your data

Account, profile, and content data is kept for as long as your account is active. If you delete your account (see Settings), we delete this data. See "Account deletion" below for exactly what that removes.

Usage and audit logs are kept for 12 months, then deleted automatically. They support billing-quota history and security investigations, and are also removed on account deletion.

AI assistant sign-in codes expire after 10 minutes and access tokens after one hour; both are deleted automatically once expired. API keys and assistant connections stay until you remove them or delete your account.

Cached copies of network analytics are kept for a short time to avoid repeated requests, then deleted automatically.

Payment/checkout records may be retained for a longer period where needed for financial recordkeeping or legal obligations, even after account deletion.

7. Security

LinkedIn access tokens are encrypted at rest (AES-256-GCM) and never stored in plain text. Our database enforces strict per-account data isolation at the security-rule level, so one user's data is never readable by another. All traffic to the app runs over HTTPS. Access to production data is limited to authorized Dinovix personnel.

8. Your rights

Depending on your location, you may have the right to: access the personal data we hold about you; correct inaccurate data; request erasure ("right to be forgotten"); restrict or object to certain processing; and receive your data in a portable format.

You can exercise access, erasure, and portability directly from Settings → Privacy & data ("Export my data" and "Delete my account"). For any other request, or if you'd rather go through us directly, email contact@dinovix.com.

If you believe we haven't handled your data properly, you also have the right to lodge a complaint with your local data protection supervisory authority.

9. Account deletion

Deleting your account from Settings permanently removes your profile, persona and billing data, your LinkedIn connection, all drafts and published-post records, your saved contacts and their notes, your radar watchlist, your LinkedIn profile review data, your connected channels and their tokens, your AI assistant connections, API keys and their tokens, and your usage logs. This action cannot be undone. Payment/checkout records may be retained separately as described in "How long we keep your data".

10. Children's privacy

ProPost AI is not directed at, and should not be used by, anyone under 16 years old. We do not knowingly collect data from children.

11. Cookies

We use only strictly necessary session cookies and a small amount of functional local storage (e.g. your theme preference). See our Cookie Policy for the full list.

12. Changes to this policy

We may update this policy from time to time. We'll update the "Last updated" date above when we do; material changes will be communicated in the app.

13. Contact

Dinovix Ltd | contact@dinovix.com | www.dinovix.com