Privacy Policy

Postlude ("Postlude," "we," "us") turns your sales call transcripts into follow-up emails. This policy explains what we collect, why, who we share it with, and how you stay in control of it. It applies to postlude.ai and app.postlude.ai.

We collect only what the product needs to work:

• Account information: the email address, password, and company name you sign up with.
• Profile details (optional): your name, phone number, and job title, if you add them in Settings.
• Your business context: anything you fill in during Setup or Settings to help the AI write better drafts (what you sell, who your customers are, your sales process, formatting preferences, and example emails in your voice).
• Drafts and sent emails: AI-generated drafts, your edits to them, and the emails you actually send through Postlude, so future drafts can get closer to how you write.
• Billing information: if you subscribe, your workspace's plan, subscription status and billing periods, the number of seats, how many calls your workspace has used, and the Stripe customer and subscription identifiers that link your workspace to Stripe. Your card or other payment details are entered on Stripe's own pages and are never sent to or stored by Postlude.

When you connect a service, here is exactly what Postlude accesses and why:

• Fathom (your notetaker): the transcript of your call, calendar invitee names and email addresses, basic meeting details (title, date, duration, meeting type), and a shareable link to the recording. Fathom's connection is all-or-nothing, since its API does not offer a narrower slice of this to request. The recording link is a public link anyone with it can open (not tied to your Fathom login); Postlude may include it in a follow-up email, since it is meant to be shared with people who were not on the call.
• Gmail: permission to send an email on your behalf, only when you click Send, and the email address of the account you connect (so you can see which one is connected). Postlude never requests or uses access to read, search, organize, or modify anything already in your inbox. The permission we ask for physically cannot do any of that, even if we wanted it to.
• Attio (your CRM): permission to create or update a contact by email address and attach a note recording the email you sent, when you connect it. This only ever flows in one direction: Attio data is never synced back into Postlude, and nothing that happens in your CRM changes anything Postlude shows you.
• HighLevel, also called GoHighLevel (your CRM, as an alternative to Attio): one sub-account that you choose on HighLevel's own consent screen (or a private integration token that you create in your own HighLevel account and paste into Postlude). The permissions are limited to viewing and editing contacts and viewing the location (the consent screen lists them, and the token carries only the permissions you tick). We use them to look up a contact by email address, create one if none exists, and attach a note recording the email you sent. We read back only the name of the location and the ID of the matching contact. This only ever flows in one direction: HighLevel data is never synced into Postlude, and Postlude never sends email through HighLevel or changes a contact that already exists there. If you start the install from the HighLevel marketplace before signing in to Postlude, we keep the resulting access credentials, encrypted, for at most two hours while you sign in and confirm, then delete them if you have not. If you uninstall Postlude in HighLevel, HighLevel notifies us and we delete the credentials we stored for that sub-account.
• Slack (optional): when you connect it and choose where to post, Postlude posts a notification there for each new draft: the contact's name, company, and email address, the call title, the email's subject, and the first part of the draft, with buttons to approve and send it or open it in Postlude. To make sure only members of your Postlude organization can approve, Postlude looks up the name and email address of the Slack person who clicks Approve and matches it to your Postlude account. Postlude keeps a log of these notifications and approvals, including the approver's email address and any error message. It does not read your Slack messages, channels, or files.

• To generate a follow-up email draft from your call transcript and business context.
• To log emails you send as an activity on the right contact in your connected CRM.
• To improve the quality of your future drafts by learning from emails you have personally sent and edited. This is specific to your own account: your voice, your edits, your drafts. It is never shared with or used to influence another customer's account.
• To manage your plan: to count the calls and seats your workspace uses against its plan, and to process your subscription payments.

Postlude uses Anthropic's Claude API to generate your follow-up drafts from your call transcript and the business context you provide. Anthropic does not use this data to train its models. Under Anthropic's own commercial terms, Anthropic may not train models on customer content processed through its API. Anthropic acts only as a data processor for this purpose; it has no other role in Postlude.

Postlude does not train or fine-tune any AI model. To make drafts sound like you, it includes a few of your own previously sent emails and a written summary of your style in the request it sends to Anthropic. Those emails are content Postlude generated for you, not data obtained from Google.

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements (see Google's API Services User Data Policy). The only data Postlude obtains from Google is the email address of the Gmail account you connect and confirmation that a message you sent was delivered. Postlude only ever asks Gmail to send a message on your behalf; it holds no scope that reads, searches, or modifies your inbox. This Google-sourced data is used only to send the follow-up emails you draft and review, and to show you which Gmail account is currently connected. It is never used for advertising and never sold. It is not used to create, train, or improve any machine learning or artificial intelligence model, whether ours or anyone else's, and it is never sent to our AI provider, Anthropic. We share it only with the infrastructure providers listed under Subprocessors, solely so that Postlude can operate, and otherwise only when the law requires it.

The follow-up emails themselves are not Google user data. Postlude generates them from your call transcript and business context, and you review and edit them before anything sends. Since Postlude holds no Gmail scope that reads or retrieves mail, this content is Postlude-generated data, not data obtained via the Google API.

A small, named allowlist of Postlude staff can access account data through our internal admin tool, for support requests or to investigate issues. Every lookup is recorded in an append-only audit log. Through that tool they can see the Gmail address obtained from Google (governed by the Limited Use requirements above) and the Postlude-generated follow-up emails drafted or sent through your account.

We do not sell your data, to anyone, ever. We share it only with the services that make Postlude work, each of them only for that purpose:

• Anthropic: generates your follow-up drafts from your call transcript and business context; does not use this data to train its models.
• Supabase: our database and authentication provider; stores your account, contacts, templates, and drafts.
• Vercel: hosts Postlude and serves every page and request.
• Postmark: sends account-related email on our behalf (sign-up confirmation, password reset). This never includes your follow-up emails, which go out through your own connected Gmail, not through us.
• Stripe: our payment processor; processes your subscription payments and holds your payment methods and invoices. When you subscribe we send it your workspace name and the email address of the person who starts checkout. Postlude shows you your card's brand, last four digits, and expiry (or the name of another payment method) and your invoice list, read from Stripe; it never receives your full card number or billing address.
• Google (Gmail): sends the follow-up emails you approve, through your own Gmail account, when you connect it.
• Fathom: the source of your call transcripts and recordings, when you connect it.
• Attio: records contacts and logs sent emails as notes, when you connect it.
• GoHighLevel: records contacts and logs sent emails as notes, when you connect it.
• Slack: receives the draft notifications you choose to send to your own Slack workspace, when you connect it.

We keep your data, including call transcripts, drafts, sent emails, contacts, and templates, for as long as your workspace is active, so your history stays available to you. If a workspace becomes inactive (its free trial or paid subscription has ended), then about two weeks later we disconnect the accounts connected to it and revoke our access to them, and about ninety days later we permanently delete its call transcripts, drafted and sent follow-up emails, and other call data, unless you have subscribed again. We email the workspace's owners and admins before each of those steps. Your account, settings, templates, contacts, and billing records are kept. Data we delete can remain in our infrastructure provider's backups for a limited period until they expire. A few things you delete in-app, such as a call type or template, are archived rather than immediately erased, so they can be restored if you change your mind. Let us know if you would like one permanently removed instead. There is not yet a self-serve way to delete your whole account. Email us at team@postlude.ai and we will take care of it. Stripe keeps payment and invoice records as it is required to by law and under its own policies; deleting your Postlude account does not delete those records at Stripe.

You can ask us to access, correct, or delete the personal data we hold about you. Since there is no self-serve way to do this yet, email us at team@postlude.ai and we will handle your request directly.

Postlude uses two cookies, both strictly functional and never used for advertising or tracking:

• A sign-in cookie, set by Supabase (our authentication provider), that keeps you signed in on app.postlude.ai. It is never set on postlude.ai itself.
• A cookie that lasts 10 minutes, used only to remember you were in the middle of connecting an integration so you land back on the right step afterward.

Postlude does not use any analytics, advertising, or cross-site tracking cookie, and loads no third-party tracking script of any kind.

When you subscribe or manage your payment method, Postlude sends you to a page hosted by Stripe, which sets its own cookies under Stripe's own policy. Postlude's own pages do not load any Stripe script.

This section describes the protections in place today. Where a protection is provided by one of our infrastructure providers rather than by Postlude itself, we say so.

• Encryption in transit. Everything between your browser and Postlude uses HTTPS: requests to postlude.ai and app.postlude.ai over plain HTTP are redirected to HTTPS, and our sites tell browsers to connect only over HTTPS. Postlude's servers also reach our providers (Supabase, Anthropic, Google, Fathom, Attio, GoHighLevel, Stripe, and Slack) over HTTPS.
• Encryption at rest. Our database and file storage are provided by Supabase, which states that all customer data is encrypted at rest with AES-256. Our hosting provider, Vercel, states that it encrypts data at rest with AES-256 as well.
• Extra protection for connected-service credentials. When you connect Gmail, Fathom, Attio, GoHighLevel, or Slack, the access and refresh tokens we receive are encrypted again by Postlude itself, using AES-256-GCM, before they are stored in our database. They are decrypted only on our servers, at the moment they are needed to act on your behalf. The signing secret we hold for Fathom webhooks is protected the same way. Our own API keys and service credentials are kept in server-side environment variables, not in code that runs in your browser.
• Access controls. Each customer organization's data is separated in our database by row-level security: when you use Postlude, the database returns only the rows that belong to your own organization, so another customer's account cannot read your data. Access by Postlude staff to customer account data through our internal admin tool is limited to a short, named list of accounts, is read-only, and every lookup is recorded in an audit log. The audit log is append-only: our application cannot edit or delete its entries.
• Public files. Documents you upload as Assets, and profile photos, are stored in publicly readable storage: anyone with a file's direct link can open it. The files are not listed or publicly enumerable: nobody outside your organization can browse or search them, so a file can be opened only by someone who has its exact link. This is by design for Assets, which are meant to be shared with your prospects, so only upload files you are comfortable sharing this way.
• Infrastructure. Postlude runs on Vercel (hosting) and Supabase (database, authentication, and file storage). Vercel states that it holds a SOC 2 Type 2 attestation and is ISO 27001:2022 certified (security.vercel.com); Supabase states that it is SOC 2 Type 2 compliant and ISO 27001 certified (supabase.com/security). These are our providers' own certifications. Postlude itself does not currently hold SOC 2 or ISO 27001 certification.
• If something goes wrong. If we become aware of a security breach that affects your data, we will notify the affected users without undue delay, and tell you what happened and what data was involved, to the extent we know.
• Deleting your data. You can ask us to delete your account and the data in it at any time by emailing team@postlude.ai; there is not yet a self-serve way to do this, so we handle the request directly. You can also disconnect Gmail, Fathom, Attio, GoHighLevel, or Slack at any time from the Integrations page, which deletes the credentials we stored for that service (for Gmail, including the connected email address). To remove the permission on the provider's side as well, remove Postlude in that service's own settings (for Google, myaccount.google.com/permissions); disconnecting Slack also asks Slack to revoke Postlude's access. Our database provider keeps routine backups for a limited period (currently about seven days), so deleted data can remain in those backups until they expire.

Every draft is reviewed by you before it sends. Nothing goes out automatically. You can disconnect any integration (Fathom, Gmail, Attio, GoHighLevel, Slack) at any time from the Integrations page, which stops Postlude from accessing that account going forward.

Postlude is a business tool and is not directed at, or knowingly used to collect information from, anyone under 16.

If we make a material change to this policy, we will update the date at the top of this page and, where appropriate, let you know directly.

This policy is governed by the laws of the Commonwealth of Pennsylvania, United States, without regard to its conflict-of-laws principles. Any dispute arising from this policy will be resolved in the state or federal courts located in Pennsylvania.

Questions about this policy or your data? Email team@postlude.ai.