Privacy policy

Last updated: October 5, 2026

Postmatic is an API and a dashboard for publishing and scheduling content on social networks, Instagram today. This policy states which data we process, why, for how long, and how you delete it. It applies to postmatic.dev and to the API at api.postmatic.dev.

Who we are

Postmatic is operated by Ventry Tecnologia, in Brazil, the controller of the data processed under this policy. Contact: privacidade@postmatic.dev.

Your account data

• Email, used to sign in (email code) and for notices about your account.
• Organization name and internal project identifiers.
• API keys: we store only the hash; the full key is shown once, at creation.
• Session cookies from Supabase Auth, strictly necessary to keep you signed in. We do not use tracking or advertising cookies.

Meta and Instagram data

When you connect an Instagram account, we use the Instagram Graph API (Instagram API with Instagram Login), from Meta Platforms, Inc. In that process:

• What we receive: the Instagram account identifier, username, account type, profile picture, the permissions granted, and a long-lived access token. After each publish we make, we receive the identifier and permalink of that post.
• Why: to publish and schedule posts on behalf of your account, to check whether the connection is still valid, and to show that information on the dashboard. To confirm that a post of ours reached Instagram, we may look up the account's list of recent posts; we do not keep the others. Metrics, comments, and messages are processed only in the optional features described below, and only if the account grants the matching permission and you use the feature.
• Where it lives: in a database and a bucket hosted on Supabase. The access token is stored encrypted (AES-256-GCM) and is never shown on the dashboard, in logs, or in API responses.
• How long: for as long as the Instagram account stays connected. Disconnecting it in the dashboard deletes the token and the profile data (username, picture, account type and permissions) immediately; only the account's numeric identifier is kept, so we can recognize a reconnection or a request from Meta. Removing the app from your Instagram settings deletes the token immediately, and the account shows as disconnected in the dashboard. Deleting your Postmatic account deletes everything. Media uploaded for publishing is stored until the account is deleted.
• Who we share it with: Meta itself, which receives the publishing calls, and the processors that host the service on our behalf (listed under "Where data is processed"). We do not sell or hand over data to third parties.

Our use of Meta's data follows the Meta Platform Terms and the Developer Policies. You can revoke access at any time in your Instagram settings, under Apps and websites.

Images, videos and post content

Text, images and videos you send for publishing are kept so we can publish them at the chosen time and show the history in the dashboard; they are stored until the account is deleted. Images from a URL are copied to our bucket before publishing, because Meta requires a public, stable URL. Videos given by URL are not copied: we read only parts of the file to validate it and pass the same URL to Meta.

Optional features, with additional permissions

Besides publishing, the API offers features that depend on extra permissions, which you grant on Meta's authorization screen. Without the permission, we do not process the corresponding data. With it, we process it only when you call the feature:

• Metrics (instagram_business_manage_insights): we read likes, reach, and views of your posts and account metrics, such as follower count and aggregated demographics, and return the result in the API response. We keep those numbers in memory only, for up to 5 minutes, to avoid repeating the request; we do not write them to the database.
• Comments (instagram_business_manage_comments): list, reply to, hide, and delete comments on your account's posts, at your request through the API. The content passes through the API and is not stored, except when used in automations, described below.
• Direct messages (instagram_business_manage_messages): list conversations and reply within Meta's 24-hour window, at your request through the API. Messages pass through the API and are not stored, except in automations with questions, described below. Incoming messages that do not belong to a flow in progress are discarded immediately, without being kept.

Comment automations

If you create an automation, Meta notifies us of new comments on the posts you chose. The person who comments is a third party: we process that person's data only to run the automation the account holder configured.

• What we keep: only for comments that contain the automation's keyword. Comments without the keyword, comments from the account itself, and empty comments are not stored. We keep the comment identifier, the commenter's numeric identifier and username, the comment text, and the keyword that matched.
• What we send: a private reply to that person, a single message per comment, within the time and conditions Meta allows, and, if you configured it, a public reply on the comment. The first message identifies itself as automated. The conversation continues manually, in Direct.
• Flows with questions: if the flow asks for an answer, we keep the text or option the person sent and the data they voluntarily provide, such as email or phone. It serves only to deliver the result to your system by webhook and to move the flow forward.
• How long: 90 days after the trigger, we automatically delete the username, the comment text, the person's answers, and the collected data. Only the commenter's numeric identifier stays, so we do not reply twice to the same person. The webhook delivery history follows the 30-day rule in the "Webhooks" section.
• How to delete sooner: the account holder can delete a person's conversation through the API. A commenter can write to privacidade@postmatic.dev with their username, and we delete that person's data. Deleting the Postmatic account or removing the app on Instagram deletes that account's automations and trigger history.

Webhooks

If you register a webhook, we keep the destination URL and the signing secret (encrypted) until the account is deleted; removing the webhook disables it. Each completed delivery's history (event, payload sent, response status and time) is deleted after 30 days.

Usage data and logs

We keep, for up to 30 days, technical logs of every API request: time, route, HTTP status, and IP address, hosted at our API provider. They are used for security, usage limits, and support. Logs never contain tokens, API keys, post content, or the text of comments or messages; webhook processing records only technical identifiers (account, post, and comment).

Where data is processed

Database, authentication, and storage on Supabase; API and dashboard on Railway; the login-code email through Resend. They may run on servers outside Brazil, under data-protection agreements.

Your rights

You can access, correct, and delete your data at any time. Full deletion is one click away, at Account → Delete account; the paths are described on the data deletion page. For other requests, write to privacidade@postmatic.dev.

Changes to this policy

Material changes are announced by email at least 15 days in advance. The version in force is always the one published on this page.