Privacy Policy
Updated 12 November 2026
1. Who we are
This Privacy Policy explains how Posthuman AS ("Posthuman", "we", "us", "our") processes personal data when you use the Posthuman web app at app.weareposthuman.com, the Posthuman mobile app and our website weareposthuman.com (together, "the Service").
Posthuman AS is the data controller for the processing described in this policy, unless stated otherwise in section 6.
- Company: Posthuman AS
- Organisation number: 935 637 759
- Address: Ringveien 40, 1459 Nesodden, Norway
- Privacy contact: hello@weareposthuman.com
- We have not appointed a data protection officer. Contact us at the address above for any privacy question.
Our Terms of Service set out the rules for using the Service.
2. Personal data we process
Account data. Email address, name, password (stored only as a salted hash), email verification status and profile picture (optional). If you sign in with Google: the name, email address and profile picture Google provides to us, your Google account ID, and the sign-in tokens Google issues (access token, refresh token, ID token, expiry time and granted scope).
Content you create or upload. Spaces, canvases, notes, quick notes, captures (text, images and voice transcripts from the mobile app), files and images you upload, and messages you exchange with the AI assistant.
Voice recordings. Voice recordings from the mobile app (max. 10 MB per recording) are uploaded to our servers and sent to OpenAI only to be transcribed. We do not keep the audio after it has been transcribed. Only the resulting text is kept as your capture, together with technical usage data (file size, file type, AI usage and cost). The recording is kept on your device until it has been transcribed, and is then deleted. If transcription fails or no speech is detected, the recording stays on your device until you retry or discard the capture.
Sharing and collaboration data. Who you invite to a space, membership roles, invitations, access requests and share notifications.
Usage and activity data. Daily counts of activity on canvases (for example which type of element was created or edited, and whether this was done by you or by the AI assistant), AI usage records (feature used, model, token counts, cost, duration) and credit balances. This data does not include the content of your work.
Billing data. If you buy a paid plan: your Stripe customer and subscription identifiers, plan, subscription status and renewal date. You enter card details directly with Stripe. We do not receive or store them.
Technical and security data. IP address (used for rate limiting and captcha verification), device and session tokens, API keys you create (stored as hashes), and server logs, which may include your email address in error messages.
Website analytics. On weareposthuman.com only: the page you open, the referring page, browser and device type, language, screen size, a random identifier stored in cookies, and an approximate location derived from your IP address. Details are in our Cookie Policy.
Sign-in sessions. For each sign-in session: your IP address in masked form (the last part of an IPv4 address is replaced before storage, so we never store the full IP address), the user agent (browser and operating system), when the session was created and last used, when you signed out, and when the session expires. Sessions expire after 30 days.
Communications. Emails you send us, feedback you submit, requests for access to the Service, and your newsletter preference.
3. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Create and run your account, sign-in, email verification | Account, technical data | Art. 6(1)(b) – contract |
| Provide the Service: store, sync and display your content, collaboration in shared spaces | Content, sharing data | Art. 6(1)(b) – contract |
| AI features: assistant, web search, image search, transcription | Content you send to the AI, prompts, results | Art. 6(1)(b) – contract |
| Payments, subscription management, invoicing, accounting | Billing, account data | Art. 6(1)(b) – contract; Art. 6(1)(c) – legal obligation (Norwegian Bookkeeping Act) |
| Measure AI usage and enforce plan credits and limits | Usage data | Art. 6(1)(b) – contract |
| Security, abuse prevention, rate limiting, captcha, debugging | Technical data, logs, sign-in sessions | Art. 6(1)(f) – legitimate interest in a secure service |
| Product improvement based on aggregated activity counts | Usage and activity data | Art. 6(1)(f) – legitimate interest in improving the Service |
| Measure visits to our website weareposthuman.com | Website analytics | Art. 6(1)(f) – legitimate interest in understanding how the website is used |
| Service and onboarding emails (for example verification, password reset, important changes, onboarding tips) | Email, account data, activity data | Art. 6(1)(b) – contract (service messages); Art. 6(1)(f) – legitimate interest (onboarding tips about our own service) |
| Newsletter and marketing emails | Art. 6(1)(a) – consent (opt-in at sign-up; withdraw any time) | |
| Responding to requests and support | Communications | Art. 6(1)(b) or (f) |
Where we rely on legitimate interest, you may object (section 9). Where we rely on consent, you may withdraw it at any time. This does not affect processing before you withdrew it.
We send service messages and onboarding emails about Posthuman to all users. We send newsletters and other marketing only to users who have opted in. You can opt out of onboarding emails at any time by emailing hello@weareposthuman.com (Norwegian Marketing Control Act § 15).
We do not sell your personal data, and we do not use your content for advertising.
4. AI processing
Posthuman uses AI models to power the assistant, web search, image search and transcription. When you use these features, the relevant content (your prompt, relevant parts of your space and, for transcription, audio) is sent to the provider listed in section 6 to generate a response.
- When you chat with the assistant, you are interacting with an AI system, not a person.
- AI output can be inaccurate or incomplete. Review it before relying on it.
- We do not use your content to train AI models for other users or for general models.
- OpenAI does not use data sent through its API to train its models unless the customer opts in, and we have not opted in. OpenAI may keep prompts and outputs for up to 30 days for abuse monitoring. Under OpenAI's published terms, audio sent for transcription is not kept for abuse monitoring.
- Web search queries are sent to Tavily to fetch web results. Tavily states in its privacy policy that it acts as controller, may use query data to improve its service, and may pass queries to third-party search providers. Do not include personal data about other people in your search requests.
- We do not use AI to make decisions that have legal or similarly significant effects on you (GDPR Art. 22).
5. Shared spaces
Content in a shared space is visible to its members according to their role.
Content you contribute to a shared space stays with the space when you leave it or delete your account, so that the other members keep their work. Before you leave a space or delete your account, remove any content you do not want to remain there.
If you own a shared space and want to delete your account, transfer ownership of the space to another member first. Contact us at hello@weareposthuman.com if you need help.
6. Service providers and transfers outside the EEA
We use the following service providers.
| Provider | Purpose | Data | Location | Basis and safeguards |
|---|---|---|---|---|
| Google Cloud (Google Cloud EMEA Ltd.) | Hosting (Cloud Run), database (Cloud SQL), file storage, logs | All Service data | EU: application and storage of user data and application logs in europe-north2 (Stockholm, Sweden); database in europe-north1 (Finland). Google Cloud audit logs about administrative changes (with the email and IP address of the Posthuman staff making the change, not user data) are stored globally by Google | Processor. Google Cloud Data Processing Addendum with Standard Contractual Clauses |
| OpenAI (OpenAI Ireland Ltd. / OpenAI OpCo LLC) | AI models for the assistant, embeddings, and speech-to-text for voice captures | Prompts, relevant content, AI output; audio recordings and transcripts | USA | Processor. OpenAI Data Processing Addendum, part of the OpenAI Services Agreement, with Standard Contractual Clauses for transfers outside the EEA |
| Tavily (AlphaAI Technologies Inc.) | Processing web search queries to fetch web results | Search queries generated from your requests | USA | Under Tavily's own terms and privacy policy, in which Tavily describes itself as controller |
| Brevo (Sendinblue SAS) | Transactional email (verification, password reset, invitations, feedback), service emails and newsletter | Email address, list membership, email content | EU (France); Brevo may transfer data to the USA and India | Processor. Brevo Data Processing Agreement; Brevo Inc. is certified under the EU–US Data Privacy Framework |
| Cloudflare, Inc. (Turnstile) | Bot protection (captcha) at sign-up | IP address, TLS fingerprint, user agent, site key | USA / global | Processor under Cloudflare's Data Processing Addendum; EU–US Data Privacy Framework, with Standard Contractual Clauses as fallback. Cloudflare is an independent controller when it uses these signals to improve Turnstile |
| Google (Google Sign-In) | Optional sign-in with Google | The account data listed in section 2 | USA / global | Your Google account is governed by Google's own privacy policy. We use the data we receive only as described in this policy |
| Stripe (Stripe Payments Europe Ltd.; Stripe, LLC) | Payments and subscriptions | Name, email, billing details, payment data, device and IP data | EU / USA | Stripe Data Processing Agreement and Data Transfers Addendum (EU–US Data Privacy Framework / Standard Contractual Clauses). Stripe is an independent controller for fraud prevention, legal compliance and its own product improvement |
| Expo (650 Industries, Inc.) – EAS Update | Updates of the mobile app | IP address, device operating system, app version and a random token used to check for updates | USA | Expo is certified under the EU–US Data Privacy Framework |
| Google Fonts (Google) | Fonts on our website weareposthuman.com | IP address and browser data of website visitors | USA / global | Google's own privacy policy applies |
| Google Analytics 4 (Google) | Visit statistics for weareposthuman.com | Page address, referrer, browser and device data, cookie identifiers, approximate location from IP address | USA / global | Google's own privacy policy applies. Google Analytics 4 does not store the full IP address in its reports |
When a provider transfers personal data outside the EEA on our behalf, we rely on an adequacy decision (including the EU–US Data Privacy Framework for certified recipients) or the European Commission's Standard Contractual Clauses, as listed above. You can ask us for more information about these safeguards.
7. Cookies and similar technologies
The web app uses only cookies and local storage that are strictly necessary to provide the Service: sign-in session cookies (an encrypted session token valid for up to 30 days), a security cookie against cross-site request forgery and a cookie that remembers where to return after sign-in, set by our sign-in system, and a local-storage entry that remembers your colour theme. These do not require consent under section 3-15 of the Norwegian Electronic Communications Act.
The mobile app stores sign-in tokens in your device's secure storage (iOS Keychain / Android Keystore). They are deleted from the device when you sign out. The mobile app does not use push notifications, analytics or crash reporting.
The website weareposthuman.com uses Google Analytics 4 to count visits and see which pages are used. When you open a page, your browser loads a script from Google, and Google sets the cookies listed in our Cookie Policy. We do not use these cookies for advertising. The web app and the mobile app do not use analytics cookies or other tracking tools.
Our website loads fonts from Google Fonts. When you visit the website, your browser connects to Google's servers, which receive your IP address.
Cloudflare Turnstile may set or read technical data needed to tell humans from bots during sign-up.
8. How long we keep data
| Data | Retention |
|---|---|
| Account data and content | As long as you have an account. When you ask us to delete your account, we delete it within one month. Copies may remain in backups for a limited time until they are overwritten |
| Uploaded files and images | Deleted together with your account |
| Usage and AI usage records, daily activity counts | As long as necessary for the purposes in section 3, and deleted on request |
| Billing records | 5 years after the end of the financial year (Norwegian Bookkeeping Act) |
| Application and security logs | 30 days |
| Google Cloud audit logs (administrative changes by Posthuman staff) | 400 days, set by Google |
| Sign-in sessions, tokens, verification and reset links | Sessions expire after 30 days, and links when they expire or are replaced. Session records are kept as long as necessary for security, and deleted when your account is deleted |
| Newsletter and email list membership | Until you unsubscribe or your account is deleted |
| Requests from people who are not users | As long as necessary to handle the request, and deleted on request |
| Google Analytics data from the website | Cookies in the browser last up to 2 years. Google keeps the statistics for the period set in our Analytics property (2 months unless that setting is changed) |
| Data held by AI providers | OpenAI: up to 30 days for abuse monitoring (not for transcription). Tavily: according to Tavily's own privacy policy |
9. Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy
- correct inaccurate data
- have your data deleted, including deleting your account
- restrict processing
- data portability (receive data you have provided in a structured, machine-readable format)
- object to processing based on legitimate interest, and at any time to direct marketing
- withdraw consent at any time
To use your rights, email hello@weareposthuman.com. We respond within one month. If a request is complex, we may extend this by up to two more months, and we will tell you why within the first month. We may need to verify your identity.
10. Complaints
If you believe we process your personal data unlawfully, you can complain to the Norwegian Data Protection Authority (Datatilsynet), www.datatilsynet.no, or to the supervisory authority where you live or work in the EEA. We would appreciate the chance to resolve your concern first.
11. Children
You must be at least 16 years old to use the Service (see our Terms of Service). We do not knowingly collect data from children under 16. If we learn that we have, we will delete the account and its data.
12. Where the data comes from
Most data comes from you. Some data comes from others: space members who share content with you or invite you, Google (if you use Google Sign-In), Stripe (payment status) and, for visits to weareposthuman.com, Google Analytics.
13. Security
We use technical and organisational measures appropriate to the risk, including hashed passwords, email verification, rate limiting, captcha, role-based access to spaces, encrypted transport (HTTPS), and encryption at rest (AES-256) of the database and file storage by Google Cloud.
14. Changes to this policy
We may update this policy. If changes are significant, we will tell you by email or in the app before they take effect. The date at the top shows when the policy was last updated.
15. Contact
Posthuman AS (org. no. 935 637 759), Ringveien 40, 1459 Nesodden, Norway. Email: hello@weareposthuman.com.