This policy explains how Toksta Solutions LTD (“we”, “us”) collects, uses, shares and protects personal data when you use Flypost, including https://www.flypost.io, https://app.flypost.io, our free tools, our MCP server and our emails (the “Service”). It also explains how we handle data about people who are not Flypost users but appear in it.
The short version
- We use your data to run Flypost for you. We do not sell it.
- We do not use your content to train AI models, and we do not let our AI providers use it to train theirs. They process it only to return the draft or image you asked for.
- Your content is private to your projects and the team members you invite.
- Our main database is in the United States (AWS us-east-2, Ohio). We protect international transfers with legal safeguards.
- You can ask for a copy of your data, a correction, or deletion of your account at any time by emailing hello@flypost.io.
1. Who we are
Flypost is run by Toksta Solutions LTD, a company registered in England and Wales (number 13018428), at 124 City Road, London, England, EC1V 2NX. We also run Toksta, a sister product. For privacy matters, contact us at hello@flypost.io.
When we are the controller. We decide how and why your account, billing, usage, support and marketing data is used, so we are its controller. This policy covers that data.
When we are a processor. If you use Flypost for a business, the content you and your team put into it, including personal data about your clients, colleagues and other people, is processed on your behalf and under your instructions. For that content, you are the controller and we are your processor, under our Data Processing Addendum. If you are one of our customer's clients or contacts, please contact that customer first about their use of your data.
2. Data we collect about our users
Account and profile
- Name, email address and password (stored only as a secure hash), or your Google account details if you sign in with Google.
- Your job, company and LinkedIn profile details, which we fetch from your public LinkedIn profile during onboarding.
- How you heard about us, any referral or affiliate code you used, and your team and project memberships.
Your content
- Brand, audience and writing-voice settings, and anything else you tell us during onboarding.
- Sources you add to the Brain: website pages, blog posts, documents, notes, call transcripts, YouTube videos and Google Drive files you choose.
- Ideas, drafts, posts, articles, carousels, images, logos and comments you create or upload, and your edits to them.
- Your prompts and instructions to AI features, and the AI output generated for you.
- Your publishing schedule and the posts you publish through Flypost.
Connected accounts
- LinkedIn. When you connect LinkedIn, the sign-in and publishing are handled by our publishing provider, Zernio, through LinkedIn's official API. We do not see or store your LinkedIn password or access tokens. We store your LinkedIn account identifiers, name and profile picture so we can show which account a post will go to.
- Google Drive. If you connect Drive, you choose individual files, and we can only access those files. We store a refresh token so we can keep them in sync, until you disconnect.
- AI assistants. If you connect ChatGPT, Claude or another assistant to our MCP server, see section 6.
LinkedIn performance data (Pro and Agency plans)
If you use post analytics, we collect your public LinkedIn posts from the last 12 months and their performance figures, and for each post up to 30 of the people who engaged with it (see section 3).
Billing
Payments are handled by Stripe. We receive your plan, billing status, billing country and the last four digits and expiry of your card. We never see or store your full card number.
Usage, device and log data
- How you use the Service, such as pages viewed, buttons clicked and features used, collected with PostHog. In the app this is linked to your account so we can support you and see which features help.
- Browser and device type, IP address, approximate location derived from the IP address, and server logs.
- The cost and type of each AI request made for your account, so we can manage plan allowances.
- Security signals from Cloudflare Turnstile on sign-up, sign-in and password reset.
See our Cookie Policy for the cookies and similar technologies involved, and how to turn analytics off.
Communications
Emails, contact-form messages and call notes from sales or onboarding calls with you, so we can respond, support you and remember what you asked for.
Free tools, newsletter and affiliates
- Free tools on our website: the text you enter and the result, which we cache for up to 30 days. We keep a one-way hash of your IP address for a few days to apply daily usage limits.
- Newsletter: your email address and the page you signed up from.
- Affiliate programme: if you join as an affiliate, your name, email, payout method and payout details (such as a PayPal or Wise email or bank reference), and the sign-ups and payments credited to you. When someone clicks your link we record the click and a one-way hash of their IP address. See our Affiliate Programme Terms.
3. Data about people who are not our users
Some features involve personal data about people who have not signed up to Flypost:
- People who engage with our users' LinkedIn posts. For post analytics we collect, for up to 30 people per post, their public name, headline, profile link, reaction type and comment text, and we use AI to estimate whether they match the user's target audience. This helps our users understand who their content reaches. Our user is the controller of this data.
- Creators our users follow for inspiration. Users can add the LinkedIn profiles of public creators. We collect their public posts, profile details and profile picture, and show them to that user as examples of what performs well.
- People mentioned in our users' content, such as clients, colleagues or people quoted in a document or tagged in a post.
- Team members invited by email, before they accept the invitation.
- People we contact about Flypost. We email business contacts we think would benefit from Flypost, using business contact details from commercial data providers and public sources. If someone replies with interest, we may prepare a private preview of Flypost for them, built from their company's public website and public LinkedIn posts, at a link only they receive. We rely on our legitimate interest in promoting our business to other businesses. Every email includes a way to opt out, and you can ask us at any time to stop contacting you and to delete your data.
If you are one of these people and want your data removed, email hello@flypost.io with your LinkedIn profile link. We will remove it from our systems and stop collecting it.
4. How we use data, and our legal bases
| What we do | Legal basis (UK and EU GDPR) |
|---|---|
| Create and run your account, generate content, publish and schedule posts, show analytics, provide support | Contract |
| Take payments, send receipts and invoices, keep financial records | Contract and legal obligation |
| Send service emails: security alerts, billing notices, changes to our terms | Contract and legitimate interests |
| Measure how the Service is used, fix problems and improve features | Legitimate interests (running and improving the Service) |
| Prevent fraud, abuse and security incidents; enforce our terms | Legitimate interests and legal obligation |
| Collect public LinkedIn data about engagers and followed creators for our users | Our user's legitimate interests, as their processor |
| Send product updates, tips and our newsletter to customers and subscribers | Legitimate interests for customers (soft opt-in); consent for newsletter subscribers. You can unsubscribe at any time |
| Contact businesses about Flypost | Legitimate interests |
| Publish aggregated, anonymised research, such as studies of what performs on LinkedIn | Legitimate interests. Research never identifies you or your content |
Where we rely on legitimate interests, we have balanced them against your rights. You can object at any time (see section 11). We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
5. AI and your content
- To write a draft or make an image, we send the relevant parts of your content (for example your brand settings, the sources that match the topic, and your instructions) through OpenRouter to the model provider best suited to the task. We do not send your whole account.
- No training. We do not use your content to train or fine-tune AI models. Our OpenRouter account is set to exclude providers that train on request data, and we have not consented to OpenRouter or any provider using your inputs or outputs to improve their products. Providers may keep requests for a short period to detect abuse, under their own terms.
- We create text embeddings (numeric representations) of your sources so the Brain can find relevant material. They are stored with your project and deleted with it.
- AI output is saved in your account so you can review, edit and publish it.
- Done-for-you customers. If you have asked our team to prepare posts for you, our team members and contractors work in your projects, and may use AI tools including Claude (Anthropic) to draft posts from your material. They work under confidentiality obligations, and nothing is published without your approval.
6. Connecting an AI assistant (ChatGPT, Claude and other MCP apps)
You can connect Flypost to an AI assistant such as ChatGPT or Claude through our MCP server at mcp.flypost.io. This is optional and only happens when you sign in to Flypost from the assistant and click to authorise it.
- What we store: an access grant linking the assistant to your Flypost account (your user ID, email address, the name the app gives itself, and encrypted access tokens), plus the project you last chose to work in. We do not receive your password for the assistant, and we do not receive your chat history: only the individual requests the assistant sends us, such as “list my drafts” or “save this idea” with the text to save.
- What the assistant can access: the same Flypost content you can see in projects you belong to, including brand and voice settings, sources, ideas, drafts, articles, images and post analytics. It reads only what a request asks for. It can also make changes for you, such as saving ideas and drafts, generating images, and scheduling or cancelling LinkedIn posts if LinkedIn is connected.
- Who else receives it: whatever Flypost returns to the assistant is then processed by that assistant's provider (for example OpenAI or Anthropic) under its own privacy policy. We do not control how they handle it.
- Retention: the access grant lasts until you disconnect the app or your account is deleted.
- Your controls: you can disconnect Flypost from within the assistant at any time, or ask us at hello@flypost.io to revoke every connection on your account.
7. Who we share data with
We share personal data only as needed to run the Service, with the service providers below. They act on our instructions under contracts that require them to protect it.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, file storage, sign-in and server functions | United States |
| Cloudflare | Website and app hosting, security, bot protection (Turnstile), our MCP server | Global network |
| Trigger.dev | Background jobs such as content generation, imports and analytics refreshes | United States |
| OpenRouter | Routes AI requests to the model providers below | United States |
| AI model providers (via OpenRouter) | Generate text, images and embeddings. Currently OpenAI, Google (Gemini), Anthropic, DeepSeek, Perplexity, xAI, Recraft and ByteDance (Seedream), Meta and Qwen models | United States and other countries |
| Zernio | Connects to LinkedIn's official API to publish posts and return post analytics | Outside the UK |
| B2B Enrichment, EnrichKit, Apify and RapidAPI | Fetch public LinkedIn profile and post data (yours, your team's and the creators you follow), crawl websites you add, and fetch YouTube transcripts | Outside the UK |
| Stripe | Payments, subscriptions, invoices and fraud prevention | United States / EU |
| PostHog | Product analytics | European Union |
| Loops | Product and lifecycle emails, and our newsletter | United States |
| SMTP2GO | Sending account emails, team invitations and support replies | Outside the UK |
| Google sign-in and Google Drive import, if you choose to use them | United States | |
| Anthropic (Claude) | Used by our team to prepare content for done-for-you customers | United States |
Creator search and inspiration features also use data from Toksta, our sister product run by the same company. We send it search topics and public LinkedIn profile links, not your content.
We also share personal data:
- with team members you invite to a project, who can see and edit that project's content;
- with services you connect or send data to yourself, such as LinkedIn, Google Drive, an AI assistant, or a webhook URL you set up;
- with our professional advisers (such as lawyers and accountants) where needed;
- where the law requires it, or to protect the rights, safety and security of our users, us or others;
- with a buyer or successor if our business, or part of it, is sold or reorganised, who must keep it under this policy.
Our team. A small number of our staff and contractors can access customer accounts. They do so only to provide support you have asked for, to carry out done-for-you work, to investigate a technical problem, or to keep the Service secure. Access to an account in this way is logged.
We do not sell personal data or share it for cross-context behavioural advertising, and we do not use advertising cookies or pixels.
8. International transfers
We are based in the UK, and our main database is hosted in the United States (AWS us-east-2, Ohio). Some providers process data in other countries, as listed above. When personal data is transferred from the UK or the European Economic Area to a country without an adequacy decision, we rely on an approved safeguard, such as the UK-US data bridge or the EU-US Data Privacy Framework for certified US companies, or the European Commission's Standard Contractual Clauses with the UK International Data Transfer Addendum. Ask us for more information about these safeguards.
9. How long we keep data
| Data | How long |
|---|---|
| Your account and content | While your account exists, including after a paid plan ends, so you can come back. You can delete projects yourself at any time. |
| Accounts you ask us to delete | Deleted from our live systems within 30 days of your request |
| Inactive accounts with no paid plan | May be deleted after 24 months without a sign-in. We will email you 30 days beforehand |
| Backups | Overwritten on a rolling basis, usually within 30 days of deletion from live systems |
| Billing records and invoices | 6 years after the end of the financial year they relate to, as UK tax law requires |
| Security and server logs | Up to 12 months |
| Free-tool results and IP hashes | Up to 30 days for results; a few days for IP hashes |
| People we contacted about Flypost who did not sign up | Up to 12 months after our last contact, or straight away if you ask us to stop |
| Support conversations | Up to 3 years after the conversation ends |
To delete your account, email hello@flypost.io from the address on your account. Cancel any paid plan first so you are not charged again. We may keep limited data where the law requires it, or to resolve a dispute or prevent fraud.
10. Security
We protect personal data with encryption in transit and at rest, database access rules that keep each workspace's data separate, bot protection, logged and limited staff access, and regular reviews of our code and dependencies. No system is perfectly secure. If a breach affects your personal data in a way that puts you at high risk, we will tell you without undue delay.
11. Your rights
Under UK and EU data protection law you have the right to:
- get a copy of your personal data, and information about how we use it;
- have inaccurate data corrected;
- have your data deleted;
- restrict how we use your data, or object to our use of it, including for direct marketing (always respected);
- receive data you gave us in a portable, machine-readable format;
- withdraw consent at any time, where we rely on consent.
Email hello@flypost.io to use any of these rights. We will respond within one month, and may need to confirm your identity first. There is no charge. If you live in a US state with a privacy law, you can use the equivalent rights there in the same way, and we will not treat you differently for doing so.
12. Complaints
If you are unhappy with how we have handled your personal data, please tell us first at hello@flypost.io with “Privacy complaint” in the subject. We will acknowledge your complaint within 30 days, investigate it, and tell you the outcome without undue delay.
You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint, or, if you are in the EU, to the data protection authority where you live or work.
13. Marketing emails
If you have an account, we may email you about product updates, new features and LinkedIn tips. If you subscribe to our newsletter, we will send it to you. Every marketing email has an unsubscribe link. We will still send service emails, such as receipts and security notices, while you have an account.
14. Children
Flypost is for professionals and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you think a child has given us personal data, contact us and we will delete it.
15. Changes to this policy
We update this policy when our practices or the law change. We will post the new version here with a new date and, for significant changes, email account holders before they take effect.
16. Contact
Toksta Solutions LTD, 124 City Road, London, England, EC1V 2NX. Email: hello@flypost.io.