Posto9

    Privacy Policy

    Last updated: October 19, 2026

    This policy explains what personal data PostoNove, Inc. collects, why, and what you can do about it. It covers three things: this website (getposto9.com), the interactive product demo (demo.getposto9.com) and the Posto9 platform our customers use. It is written to be read, not skimmed; if anything is unclear, write to us at the address at the end.

    1. Who we are

    Posto9 is operated by PostoNove, Inc., a Delaware corporation, 251 Little Falls Drive, Wilmington, DE 19808, United States. For the website, the demo and the account data of the people who use the platform, PostoNove, Inc. is the data controller. For the customer data our customers bring into the platform (section 5), PostoNove, Inc. acts as a processor on their behalf, and the customer is the controller.

    Privacy questions and requests: privacy@posto9.app.

    2. The website (getposto9.com)

    What we collect

    • Usage data, only if you accept analytics cookies: the pages you open, where you came from (referrer and campaign parameters), your browser and device type, and an approximate location derived from your IP address by the analytics provider. We use Google Analytics 4 (loaded through Google Tag Manager) and PostHog for this. Session recordings, surveys and advertising features are turned off. Nothing is sent to either provider until you accept analytics in the cookie banner.
    • Invitation tokens: links we send to people we are talking to carry a token that names the company or person the link was sent to. The token is kept in your browser for the session so the website and the demo recognise the same visit. With your analytics consent it is attached to the analytics events, which lets us see how the demo landed with that prospect. Without consent it is used only to open the demo.
    • Forms: when you ask for a demo, book a call or write to us, we collect what you type: name, work e-mail, company, optionally a LinkedIn profile and a description of your situation.

    What we do with it

    • Form submissions are e-mailed to our team (through Postmark, our e-mail delivery provider) and kept in our mailbox and sales tools so we can answer you and prepare the conversation you asked for. We do not add you to a newsletter you did not ask for.
    • Analytics tell us which pages, scenarios and demo stories people read, so we can improve them.

    Legal bases (where the GDPR, the UK GDPR or the LGPD apply)

    • Analytics: your consent, given in the cookie banner and withdrawable at any time (see the Cookie Policy).
    • Forms and follow-up: steps taken at your request before entering into a contract, and our legitimate interest in answering people who write to us.

    3. The product demo (demo.getposto9.com)

    The demo is a static copy of the Posto9 application filled with a fictional book of ten accounts. No real customer data is in it, and nothing you click there changes anything. What the demo stores and sends:

    • Analytics, only if you allow them: the demo uses the same cookie banner as this website, and one answer covers both: if you already answered here, the demo does not ask again, and an answer given in the demo holds here. With your consent the demo sends usage events to PostHog (pages opened, stories started and finished, questions asked to the demo assistant, buttons pressed). If you decline, nothing is sent and no identifier is stored. You can change your choice at any time from the Privacy and cookies control in the corner of the demo or the Cookie settings link on this site.
    • Your invitation token, when you arrived through a link that carried one, so your visit and the website visit are counted as one. It is stored only if you allow analytics.
    • Preferences such as whether the story picker was already shown, the theme and the language, kept in your browser's local storage and never sent anywhere.

    4. The Posto9 platform: people who use it

    When a customer gives you access to Posto9, we process the data needed to run your account:

    • Account data: name, work e-mail, role, team membership, language, authentication details (passwords are stored hashed; single sign-on and magic links are available).
    • Activity data: what you do in the platform (actions taken, decisions recorded, generated drafts you edit), kept as part of the customer's audit trail.
    • Support communications: what you send us when you ask for help.
    • Technical data: server logs with IP address, browser type, timestamps and errors, used to keep the service secure and working.

    The platform uses only strictly necessary cookies (sign-in, security and language). It runs no advertising or third-party analytics trackers.

    Legal bases: performance of the contract with the customer that gave you access, our legitimate interest in keeping the service secure, and legal obligations where they apply.

    5. The Posto9 platform: customer data we process on our customers' behalf

    Posto9 reads the systems a customer connects to it, so it can understand each of that customer's accounts and propose work. Depending on what the customer connects, that includes CRM records (HubSpot, Salesforce, Vitally, RD Station), e-mail and calendars (Gmail, Google Calendar, Microsoft 365, Outlook), messaging (Slack, Microsoft Teams, WhatsApp), support tickets (Zendesk, Jira, Confluence) and call recordings or notes (Gong, Granola). This data often contains personal data about the customer's own customers and colleagues: names, work contact details, job titles, what people wrote and said in business conversations.

    • We process this data only on the customer's documented instructions and for the purposes of the service, under the customer agreement and its data processing terms.
    • We do not sell it, do not use it for advertising, and do not use it to train models.
    • Each customer's data is encrypted with keys specific to that customer (per-tenant encryption at rest), in transit, and access by our staff is restricted and logged.
    • If you are a customer's customer or contact and want to exercise your rights over data a Posto9 customer holds about you, contact that company; we will help them answer you.

    AI processing

    Posto9 uses large language models to grade accounts, summarise conversations and draft messages. To do that, relevant excerpts of the customer's data are sent to a model provider: by default Google Cloud Vertex AI, and Microsoft Azure OpenAI Service for deployments hosted on Azure. Customers may instead bring their own model provider account. We use these providers under business terms that do not allow them to train on the data or keep it beyond what is needed to answer the request. Every generated suggestion is shown to a person for a decision; Posto9 does not take automated decisions with legal or similarly significant effects on individuals.

    6. Who else sees data

    • Hosting: the platform runs on Google Cloud Platform in the European Union (region europe-west1, Belgium), with some deployments on Microsoft Azure. The website and the demo are served from Amazon Web Services.
    • Analytics (website and demo, with your consent): Google (Google Analytics 4 and Google Tag Manager) and PostHog, Inc. (US cloud).
    • Consent management (website and demo): CookieHub, which stores your cookie choices and keeps a record of them.
    • E-mail delivery: Postmark (ActiveCampaign), for form notifications and platform e-mails such as invitations and magic links.
    • Model providers: as described in section 5.
    • The systems a customer connects: data flows to and from them on the customer's instruction (for example, a note written back to the CRM).
    • Authorities and advisers where the law requires it or to defend our rights, and a successor in a merger or acquisition, under the same commitments.

    We do not sell personal data and do not share it for cross-context behavioural advertising.

    7. International transfers

    PostoNove, Inc. is a United States company, and some providers above process data in the United States. Where data about people in the European Economic Area, the United Kingdom, Switzerland or Brazil is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) or an equivalent safeguard, and on the providers' own certifications where they hold them.

    8. How long we keep data

    • Form submissions and sales conversations: for as long as we are in contact with you or your company and for a reasonable period afterwards, unless you ask us to delete them earlier.
    • Website and demo analytics: according to each provider's retention settings for our account; analytics data is aggregated or deleted when it is no longer needed to understand how the site is used.
    • Platform account and customer data: for the term of the customer agreement, then deleted within the period that agreement sets, except for what we must keep by law.
    • Security logs: for a limited period consistent with our security program.

    9. Your rights

    Depending on where you live you may have the right to access the personal data we hold about you, to have it corrected or deleted, to receive a copy in a portable format, to restrict or object to its processing, to withdraw a consent you gave (without affecting what was done before), and to complain to a supervisory authority. Residents of California and other US states with privacy laws may also ask what we collect and why, and will not be treated differently for exercising their rights; we do not sell or share personal information as those laws define it.

    To exercise any of these rights, e-mail privacy@posto9.app. We will answer within the time the applicable law gives us and may ask you to confirm your identity first. Cookie choices can be changed at any time from the Cookie settings link in the footer of this site or the Privacy and cookies control in the demo.

    10. Security

    We protect data with encryption in transit and at rest (per customer in the platform), strict and audited access controls, and continuous security assessment. The full picture is on our Security page.

    11. Children

    Our website, demo and platform are for businesses and are not directed at children under 16. We do not knowingly collect their data.

    12. Changes

    When this policy changes we update the date at the top. If a change matters to you (a new purpose, a new category of recipient), we will say so on this page and, for platform users, in the product or by e-mail.

    13. Contact

    PostoNove, Inc.

    251 Little Falls Drive

    Wilmington, DE 19808, United States

    privacy@posto9.app