Last updated 17 October 2026.
You bring your own API key and your own social accounts. Your content is generated with your provider account, published to your accounts, and stored on our server so the service can schedule and learn from it. We do not sell anything, track you, or train on your work. If you delete your account, your files are deleted, not flagged.
The controller of your personal data is Mikkel Vejen, trading as Unposed, Hasselhaven 85, Lystrup, Denmark. For anything in this policy, or to exercise any right below, contact [email protected].
Unposed is operated by a sole trader. There is no separate company, and no CVR number has been registered at the time of writing; if that changes, this section changes with it.
| What | Why | Legal basis |
|---|---|---|
| Your email address and a hash of your password | To let you sign in, and to tell one account from another. The password itself is never stored, only a scrypt hash, which cannot be reversed. | Performance of a contract |
| A session cookie | To keep you signed in. Strictly necessary. No analytics, advertising or referral cookies of any kind. | Performance of a contract |
| A referral code, only if you opened another founder's referral link and signed up from it | The short code from the link travels in the page address to the sign-up form; nothing is stored in your browser. Kept with your account so the founder who sent you is credited for what you pay in your first year. | Legitimate interests (crediting the person who referred you) |
| If you refer founders: who signed up through your link, what they paid, your commission and payouts, and the PayPal or Wise email you give us | To work out what you are owed and to pay it. You are shown counts and amounts, never who signed up. A founder you referred has your account recorded as their referrer; we do not tell you who they are. | Performance of a contract |
| Your AI provider API key | So the software can generate content using YOUR account with that provider. Encrypted with AES-256-GCM before it is written down and decrypted only into the process that makes your images, never into a web page, including your own. | Performance of a contract |
| Access tokens for the accounts you connect (your Buffer key, and an X token if you connect X directly), and the account name they belong to | So the software can publish content you have approved, at the times you scheduled, and read how those posts did. The account name is stored so you can see which account is connected, a token alone gives you no way to check. | Performance of a contract |
| The content you create: your product description, audience notes, written copy, generated images and video, captions and schedule | It is the thing the service produces. It is yours. | Performance of a contract |
| Performance figures for the posts Unposed published for you | To learn which of your posts worked, so later ones can be weighted towards what did. Views, likes, replies, shares and saves are read for each post Unposed itself published, through Buffer or X, for thirty days after it goes out. You can also import figures yourself. | Performance of a contract |
| A record of every publish attempt, including failures | So you can see what was posted, what was refused and why. A post that silently failed and a post that has not come up yet are otherwise indistinguishable. | Performance of a contract |
| Your product’s public website, when you ask it to be read | To draft the answers about your product and write your distribution plan. The text of the page is sent to Google’s Gemini to be read; see who else processes your data, below. | Performance of a contract, or steps you asked for before one |
| For the free plan on our website, before any account: the address you enter, the plan written from it, and a one-way hash of your IP address | The plan is what you asked for, and it is kept so you can share it and so it can come with you if you make an account. The hash is used only to count how many plans one visitor asks for in a day, so the free plan cannot be abused. It is salted with the date, so it cannot be linked from one day to the next, and your IP address itself is never stored. | Steps you asked for before a contract; legitimate interests (preventing abuse) |
| A count of visits to our website, without cookies | To know how many people visit and which pages they read. Each visit stores the page, the site that linked to it, the time, and a one-way hash of your IP address and browser salted with the date, so a visitor can be counted once a day but never recognised from one day to the next. Your IP address itself is never stored, and no cookie or script is used. | Legitimate interests (understanding how the website is used) |
| Visits and taps on a customer's link-in-bio page, without cookies | A customer can make a page of their own links at unposed.xyz/l/their-name, with one address per social account, and is shown how many people visited it and tapped each link, from which app and through which of their accounts. Each visit or tap stores the page, the account its address belongs to, the link, the time, the app it was opened in (read from the browser's name, such as TikTok or Instagram), and a one-way hash of the IP address and browser salted with the date. The IP address itself is never stored, no cookie or script is used, and the customer only ever sees totals. When the customer has set it up, a tap on an App Store link carries Apple's campaign tags, which name the customer's account and nothing about the person tapping. | Legitimate interests (telling our customer what their posts led to) |
| An App Store Connect key, if you connect one, and your app's daily download counts | To show your App Store downloads beside your posts. The key is one you make with Apple's Sales and Reports role, which can read sales reports and nothing else; it is encrypted at rest and never shown again. From each day's report we keep only the number of first-time downloads, redownloads and updates for each app in it. Apple's reports hold no personal data about the people who downloaded. | Contract (the service you signed up for) |
| Server and service logs, which include IP addresses, and email addresses in scheduled-run logs | To keep the service running and to investigate faults and abuse. | Legitimate interests (running a secure service) |
Unposed generates your posts on our own accounts with Anthropic (Claude), which writes them, and Google (Gemini), which makes images and writes when Claude is unavailable. Both act as our processors. The information about your product that you give us, and the prompts built from it, are sent to them under our accounts in order to write and illustrate your posts, and for no other purpose. You pay us in credits; you do not need an account with any AI provider.
If you choose to connect an AI provider key of your own, it is encrypted before it is written down. We show you only a fingerprint of it, the first and last few characters, so you can tell which key is stored without it ever being sent back to a browser. You can delete it at any time, and deleting it removes it from our systems entirely.
When you connect a social account, we store an access token, a refresh token if the platform issues one, the platform’s own identifier for the account, and a label so you can see which account it is. These are encrypted at rest with the same protection as your API key.
We use that access for two things: publishing content you have approved, at the times you scheduled it, and reading the numbers on those same posts - views, likes, replies, shares and saves - for thirty days after each one goes out, so the service can learn what worked. We do not read your feed, your followers, your direct messages, or other people’s content.
You can disconnect an account at any time, which deletes our copy of the token. Deleting our copy does not revoke the token at the platform, to do that, remove the app’s access in that platform’s own settings, and you should do both.
Screenshots and images you add to describe your product are stored as files in your workspace and are sent to your AI provider as context when drafting. If those images contain personal data (other people, real names, account details), that data goes with them. Consider what is on a screen before you add it.
Everything is held on servers within the European Union. Your content is not copied to any other service except when it is sent to an AI provider to be generated or read, or to the delivery service and social platforms you connected in order to be published.
When a Reel is published, the video file is briefly reachable on a random, unguessable web address, because Instagram fetches videos rather than accepting uploads. That address is used once, revoked as soon as the publish finishes whether it succeeded or not, and expires regardless.
There are no others, no analytics provider, no advertising network, no customer-tracking tool.
If you are a business customer and your own customers’ personal data passes through Unposed, we will enter into a data processing agreement with you under Article 28 of the GDPR. Ask at [email protected]. Note that the social platforms you connect are your own relationships, not our sub-processors, so their terms are between you and them.
Your account data and content are kept for as long as your account exists. Sessions expire on their own. Logs are kept for as long as they are useful for diagnosing faults and then rotated away.
When you delete your account, the account record is removed and your workspace directory, every file, image, video and database belonging to you, is deleted from disk. Related records are removed with it. This is immediate and cannot be undone, which is the point: “deleted” should mean deleted.
Passwords are stored as scrypt hashes. API keys and platform tokens are encrypted with AES-256-GCM using a key held only on the server and never in our source code, the software refuses to start without one rather than falling back to a default. Traffic is served over HTTPS. Sessions use cookies that JavaScript cannot read, and actions that change anything are protected against cross-site request forgery.
No system is perfectly secure, and we would rather say so than imply otherwise.
Under the GDPR you have the right to:
Write to [email protected] and we will respond within one month. If you are unhappy with how we handle it, you may complain to your local data protection authority. In Denmark that is Datatilsynet (datatilsynet.dk).
This service is for businesses and people marketing their own products. It is not intended for anyone under 16, and we do not knowingly hold data about children.
If this policy changes in a way that affects you, the date above changes and we will tell you before the change takes effect where the law requires it. Past versions are kept in the project’s source history.