---
title: "PostCliq Privacy Policy | PostCliq"
description: "The complete PostCliq Privacy Policy: what we collect, why, who we share it with and where, how long we keep it, cookies, AI processing, benchmarks, and how to access, correct or delete your data."
url: "https://postcliq.com/privacy"
---

# Privacy Policy

How WP Creative handles personal information in PostCliq, under the Australian Privacy Principles. A plain-English summary comes first; the numbered sections are the policy.

Version

1.4

Effective

2026-10-19

Operator

Naphix Pty Ltd, trading as WP Creative (ABN 65 610 345 198), Sydney, New South Wales, Australia

[Read the Terms and Conditions](https://postcliq.com/terms)

## Summary in 60 seconds

Who is responsible

Naphix Pty Ltd, trading as WP Creative, of Sydney. We handle personal information in PostCliq under the Australian Privacy Principles.

What we collect

Your name, email address and company domain; the sites you add; what our crawler sees on those public pages; aggregates from any analytics you choose to connect; the business numbers you enter; how you use the product; and the details you give us on a lead or contact form.

Why

To run the audits you ask for, decide who can see what, send you service messages and the newsletter, keep the service safe, and improve it. We do not sell personal information and we do not use it for advertising on other platforms.

Who we share it with

The providers that run the service (database and sign-in, hosting, AI analysis, email, Google and Microsoft for connected data), some of them overseas; the people you choose to share a report with; and, only when you ask, WP Creative's sales team.

Optional analytics

You choose whether PostHog may count page and feature use, and separately whether we may sample masked recordings of public pages. Rejecting either does not stop you using PostCliq. Change your choice through "Privacy choices" on the website or app. Signing up does not grant this optional consent.

How long

Raw crawl data for 7 days, screenshots for 30, reports for 12 months while your account is active, lead form submissions for 24 months, and account details while the account exists. The full table is in section 10.

Your rights

You can access, correct and delete your data. You can complain to us, and then to the Office of the Australian Information Commissioner (OAIC).

Benchmarks

Your measurements join an industry benchmark only if you switch contribution on, and never with your name, your domain or your own figures.

The summary helps you read the document. The numbered sections are the agreement.

## 1. About this policy

1.1 This policy explains how WP Creative (Naphix Pty Ltd, ABN 65 610 345 198) handles personal information in PostCliq. We apply the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth), including APP 1 (open and transparent management) and APP 5 (notice at collection), whether or not the law requires a business of our size to.

1.2 "Personal information" means information about an identified or reasonably identifiable individual. Most of what PostCliq handles is information about websites and businesses. This policy covers the parts that are about people.

1.3 This policy applies to PostCliq only. WP Creative's agency services have their own privacy notice, published on wpcreative.com.au.

1.4 This policy forms part of the Terms and Conditions at /terms. Section numbers in this policy refer to this policy unless they say "Terms".

## 2. What we collect

| Category | Examples | Where it comes from |
| --- | --- | --- |
| Identity and contact | First name, email address, Google account identifier if you sign in with Google | You, at registration |
| Company | Your email domain, company type (Brand or Partner), company name and brand name you enter, partner tier | You; derived from your email address |
| Sites | Website addresses you add, the company that holds each site | You |
| Public crawl data | Page text, links, headings, metadata, HTTP headers, robots and sitemap files, rendered screenshots of a small number of pages | Our crawler, from the public web |
| Connected data | Aggregate metrics from Google Analytics, Search Console, Google Ads or Microsoft Clarity that you choose to connect: sessions, page views, conversions, queries, clicks, campaign spend and behaviour signals by page, date and channel. Provider account, property and ad account identifiers. Access tokens | The provider, with your permission |
| Business inputs | Numbers you enter for the scenario model: traffic, conversion rate, deal value and similar | You, optional |
| Sharing and referrals | Email addresses you share a report with, invite links you send, who joined from them | You |
| Lead and contact forms | Your name, email address, company, your message, which resource you asked for, and the consent sentence you agreed to | You, when you request a resource or contact us on postcliq.com |
| Usage | Sign-in events, pages viewed in the app, actions marked on findings, audit requests, device and browser type, IP address, approximate location from IP | Automatically, when you use PostCliq |
| Optional product analytics | Anonymous browser/session identifiers, approved public-page or generic app-screen names, browser/device category and approved feature-action counts; no email, customer website domain, private report contents or business figures | Only after you allow usage analytics in Privacy choices |
| Optional public-page recordings | Sampled clicks, scrolling and page layout, with text, attributes, forms, images and embedded media masked or blocked; no account screens or private reports | Only after you separately allow masked recordings |
| Support | Messages you send us and our replies | You |
| Consent records | Terms version accepted, date, source, newsletter status | Automatically |

We do not collect payment details. We do not ask for sensitive information (health, religion, political opinion and similar) and ask you not to enter it.

## 3. How we collect it

3.1 Directly from you when you register, add a site, enter numbers, share, refer, request a resource or contact us.

3.2 Automatically when you use the app, through server logs (section 14).

3.3 From Google when you sign in with Google (name, email, account identifier) or connect a Google property (the data in section 2, under the permission you grant), and from Microsoft when you connect Clarity.

3.4 From the public web, when our crawler reads the pages of a site you add.

3.5 From other users, when someone shares a report with your email address or invites you.

## 4. Why we use it

| Purpose | What we use |
| --- | --- |
| Create and secure your account, and decide which company and sites you can see | Identity, company, usage |
| Run the audits you request and produce reports | Sites, public crawl data, connected data, business inputs |
| Show trends over time and verify fixes | Report history, connected data |
| Send service messages | Identity, usage |
| Send the newsletter and product updates (until you unsubscribe) | Identity |
| Send you the resource you asked for and answer your question | Lead and contact form details |
| Sharing and referrals, including rewarding referrals | Sharing and referral data |
| Prevent abuse, enforce allowances and protect the service and the sites we crawl | Usage, IP address, consent records |
| Support you and resolve disputes about sites or domains | Support, access logs |
| Improve our checks and the product, using aggregated or de-identified data | Usage, report outcomes |
| Build and publish industry benchmarks (section 9A), only if you have switched contribution on | Aggregate funnel and page measurements, check results, sector, country, period |
| Meet legal obligations | Consent records, access logs |

We do not sell personal information. We do not use it for advertising to you on other platforms.

## 4A. Google user data

If you connect Google Analytics 4, Google Search Console or Google Ads, PostCliq reads, with your permission and read-only:

- sessions, key events and landing pages from the GA4 property you choose;
- clicks, impressions, click-through rate and positions by page and query from the Search Console property you choose;
- campaign spend, clicks and reported conversions by landing page from the Google Ads account you choose.

We use this only to show that data beside your website audit. We store it as aggregates, never sell it, never use it for advertising, and never use it to train AI models. People see it only to the extent your company can see its own reports. PostCliq never changes your analytics, Search Console settings or campaigns.

PostCliq's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements (https://developers.google.com/terms/api-services-user-data-policy).

You can disconnect at any time in PostCliq or in your Google account settings. Disconnecting stops new imports and deletes the access token; deleting the saved history is a separate choice in PostCliq.

## 5. Company grouping by email domain and domain-match access

This is how access is decided. It affects who can see information about you and your sites.

5.1 Grouping by domain. When you verify a company email address, we read its domain and place you in the PostCliq company for that domain. Everyone who verifies an address at that domain is placed in the same company and can see the company's sites, reports, members' names and email addresses, connection status and usage. We do not check with anyone at the company before doing this. Free-mail domains (Gmail, Outlook, Yahoo, iCloud, Proton and similar) are excluded and form a personal company of one.

5.2 What colleagues see about you. Your first name and email address in the People list, and the sites and audits you added or ran.

5.3 Company contact. The first registrant of a company is recorded as the company contact and is emailed when a new colleague joins.

5.4 Domain-match access. If your verified email domain matches a site domain that another company (for example an agency) holds, you automatically receive read-only access to that site's report. The company that holds the site can see that a domain-match viewer exists, with the viewer's name and email domain.

5.5 Access logging. Every report access is logged with the user, time and route (member, share, domain match, super admin) so disputes can be resolved.

5.6 WP Creative super admins. A small number of WP Creative staff can view any company and report for support, dispute handling, abuse control and sales follow-up you have asked for. Their access is logged and reviewed.

## 6. Who we disclose it to

6.1 Service providers (processors). We use third parties to run PostCliq. They act on our instructions and may only use the data to provide their service to us.

| Role | Provider | Data | Location |
| --- | --- | --- | --- |
| Database, sign-in and private file storage | Supabase | All account, company, site, report and connected data; screenshots and evidence | Stored in the region we select for the project; the provider is a United States company and its support access may occur from outside Australia |
| Application and worker hosting | Railway | Transit of all data the app handles; server logs | United States and other regions the provider operates |
| AI analysis | OpenAI and Anthropic | Redacted page text and evidence excerpts from public crawls; public page titles, headings and the site's domain for AI-visibility checks; a company's website domain to tell an agency from a brand; no account details, tokens or connected data | United States |
| Email delivery | Resend | Name, email address, message content (which never includes findings or figures) | United States |
| Sign-in and connected data | Google | Sign-in identity; Analytics and Search Console data you choose to connect | Global; under Google's privacy policy |
| Connected behaviour data | Microsoft | Clarity data you choose to connect | Global; under Microsoft's privacy statement |
| Customer relationship management and visit tracking on postcliq.com | HubSpot, Inc. | Cookie identifiers for a returning browser, the postcliq.com pages it visits and where it came from, and the details you give us in a form | HubSpot's Asia-Pacific data centre (AP1); HubSpot's subprocessors may process data elsewhere under its data-processing agreement |
| Website analytics on postcliq.com | Ahrefs Pte. Ltd. | Page views, the referring site, browser, device type and country, without cookies | Global; under Ahrefs' privacy policy |
| Optional website/product analytics and public-page recordings; operational AI usage metrics | PostHog, Inc. | The limited analytics events and masked public-page recordings described in section 14, and the AI usage metrics described in 14.9 | EU Cloud, Germany; support and subprocessors may process data elsewhere under PostHog's data-processing agreement |
| Page performance checks | Google PageSpeed Insights and Chrome UX Report | Public page URLs only | Global |
| Traffic estimates | A third-party traffic estimate provider, named in the help panel beside any figure it feeds | Site domain only | Global |
| Content management for postcliq.com | Payload CMS, hosted by us on the providers above | Lead and contact form submissions; the marketing pages | As above |
| Support and operations | WP Creative staff in Sydney, Australia and Kathmandu, Nepal | Account, company and report data as needed to support you | Australia and Nepal |

6.2 People you choose. When you share a report or send an invite, the recipient sees your name and the site domain. Members of your company see what is described in section 5.

6.3 WP Creative sales. Only when you use the explicit "share selected findings with WP Creative" control, or contact us asking for help. Not otherwise.

6.4 Legal. We may disclose information where the law requires, to protect our rights, or to investigate abuse of the service or harm to the sites we crawl.

6.5 Business transfer. If WP Creative sells or transfers PostCliq, your information may transfer with it. We will tell you first.

6.6 Published benchmarks. If you switch contribution on, we may publish industry benchmarks built from audits (section 9A). What we publish is aggregated and de-identified. It does not name you, your company or your site, and it does not show your figures. Section 9A sets out the limits of that statement.

## 7. Overseas disclosure

7.1 Some of the providers in section 6.1 store or process data outside Australia, in particular in the United States (AI analysis, email delivery, hosting, and provider support access to the database). Our staff in Nepal may also access data to support you.

7.2 Before we disclose personal information overseas we take reasonable steps to make sure the recipient handles it in a way consistent with the APPs, usually through the provider's data processing terms. Where we cannot do that, we will tell you and ask for your consent, or not disclose.

7.3 Selecting an Australian database region does not mean every copy of your data stays in Australia. We do not claim Australia-only storage.

## 8. Public website content and other people's information

8.1 When we crawl a public website you add, the pages may contain personal information that the site owner published: staff names and photos, contact details, testimonials, author bylines. We did not ask for it and the individuals do not know we have a copy.

8.2 We minimise this. We only fetch what an ordinary visitor could see. We store bounded excerpts and screenshots, not whole sites. Where feasible we redact contact details and other personal data from text before it is stored or sent for AI analysis. We delete raw crawl data within 7 days and screenshots within 30 days (section 10). We do not build profiles of individuals from crawled pages and we do not use crawled personal information for marketing.

8.3 If you are named on a website that has been audited and want the excerpt removed, contact us (section 20). We will act on reasonable requests.

8.4 By adding a site, you confirm that you are permitted to request an audit of it (Terms, section 5.2). We rely on that confirmation.

## 9. AI processing

9.1 We send redacted excerpts of public page content and evidence to an AI provider (currently OpenAI or Anthropic) to classify pages, find and explain problems and draft suggested actions. For AI-visibility checks, Anthropic's model is also given public page titles and headings and the site's domain, and searches the public web the way a buyer's AI assistant would. We do not send your name, email, access tokens, connected analytics data or business inputs to an AI provider.

9.2 The AI provider processes the data in the United States. Its API terms state that it does not use API data to train its models by default, and we rely on that setting. Retention at the provider depends on the endpoint and the account settings; we choose the minimum retention available to us.

9.3 AI outputs are validated against evidence before they appear in a report. They are assistance, not decisions about you. No automated decision with legal or similarly significant effect on an individual is made by PostCliq.

## 9A. Industry benchmarks built from audits

### 9A.1 What we do

9A.1.1 If you switch contribution on, we use measurements from the audits we run to build industry benchmarks, such as a typical enquiry rate for a sector in a country. We show those benchmarks in PostCliq and we publish them. No licensed dataset exists for the Australian market, so a first-party benchmark is the only one we can offer honestly.

### 9A.2 What we use for it

9A.2.1 Aggregate funnel measurements, page and category-level performance, check results, the sector we classify the site into, the country and the period. Terms section 7A.3 lists these in full and section 7A.4 lists what is never included.

9A.2.2 Most of this is information about a website and a business, not about a person. It is not personal information under the Privacy Act. We are describing it here anyway, because you should be able to see what happens to your data without having to work out which law applies to which field.

9A.2.3 Where the source records do contain personal information, for example the account that requested an audit, that personal information is stripped before the measurement joins the benchmark pool. It is not part of what we build with and it is not part of what we publish.

### 9A.3 Why we use it

9A.3.1 To produce an industry comparison that our customers can rely on, and to publish research about how Australian websites actually perform. Without contributions there is no benchmark, and without a benchmark no customer sees a comparison.

### 9A.4 Our basis under the Australian Privacy Principles

9A.4.1 We collect the underlying measurements to run the audit you asked for. That is the primary purpose under APP 3 and APP 6.

9A.4.2 Building benchmarks is a secondary purpose. We rely on your express choice: the measurements are used only after you switch contribution on, and we tell you what that means here and in Terms section 7A before you do.

9A.4.3 The OAIC's guidelines treat de-identification as a question of context and risk rather than a one-off technical step. That is the standard we apply in section 9A.5, and it is why a numeric threshold alone is never enough to publish a cell.

### 9A.5 Aggregated and de-identified before use

9A.5.1 Measurements are stripped of identifiers and pooled before they are used. A published cell summarises a group, never a business. At least 30 independent businesses sit behind a published cell, no single business may account for more than a limited share of it, only completed periods are published, and a named reviewer checks each cell for re-identification risk and records the result before it goes out.

9A.5.2 The limit. De-identified is not anonymous. Aggregates drawn from small groups can sometimes be worked backwards, and Australia is a small market with narrow sectors. The threshold and the review reduce that risk. They do not remove it, and we do not claim they do. A cell the reviewer is uneasy about is not published even if the numbers permit it.

### 9A.6 How long it is kept

9A.6.1 The measurements in the benchmark pool are kept in de-identified aggregate form while the benchmark programme runs, and the pool is reviewed at least once every 12 months. They are not tied to your account, so deleting your account does not remove a contribution already pooled, and we cannot pick it out again. Deleting your account does stop any further contribution.

9A.6.2 The audit records the measurements came from are kept and deleted on the ordinary schedule in section 10. Nothing in this section extends that schedule.

9A.6.3 Each published cell carries a recorded expiry date and is reviewed or retired at that date.

### 9A.7 How to switch it on or off

9A.7.1 Contribution is off by default. The control is in Settings, under Company, labelled "Contribute to industry benchmarks". Any member of your company can use it and it applies immediately. Until that switch is shown in your account, contribution is off. You can also email the privacy contact in section 20 and we will action it within five business days.

9A.7.2 Switching off is free. It does not reduce your allowances, change your report or affect your support. See Terms section 7A.7.

9A.7.3 After you switch off, your measurements stop being used within 30 days and are excluded from every cell built afterwards. Cells already published stay as published. They are pooled summaries of at least 30 businesses and do not identify you, and we will not claim we can recall a figure that has already been released.

9A.7.4 If you believe a published cell identifies you or your business, tell us (section 20). We will review it and, if we agree, withdraw it.

## 10. Retention and deletion

We keep information only as long as it is needed for the purpose we collected it. The current schedule:

| Data | Kept for | Then |
| --- | --- | --- |
| Anonymous quick look: the claim token and request details that link it to your browser | 24 hours | Deleted |
| Public quick-look results for a website: what its public pages and Google's public speed data showed, with no personal information and nothing from any connected account | Kept | Shown at app.postcliq.com/scan/ followed by the site's address. A site owner can ask us to take a site off the leaderboard |
| Raw crawl HTML and extraction (redacted) | 7 days | Deleted; the report keeps small evidence excerpts |
| Rendered screenshots | 30 days | Deleted; the report marks the evidence as expired |
| Reports and findings | 12 months while your account is active | Oldest editions deleted; you can delete earlier |
| Connected analytics aggregates | While your account is active | Deleted when you disconnect and choose "delete history", or when the account is deleted |
| HubSpot visit records and contact details | While we have a business relationship with you or your company, then deleted or anonymised; HubSpot's tracking cookies expire under HubSpot's standard settings | Delete on request; clear cookies for postcliq.com to stop recognition on this browser |
| Ahrefs page-view counts | Kept by Ahrefs as aggregate statistics without cookies or identifiers | Not linked to you |
| Optional PostHog analytics | Under PostHog's free-plan retention, currently one year for events and metadata | Withdraw consent to stop new collection; contact us to request deletion of previously collected data |
| Operational AI usage metrics | 30 days on PostHog's free plan for AI events | They contain no personal information |
| Optional masked public-page recordings | 30 days on the configured free plan | Subject to PostHog's recording expiry; earlier deletion on request |
| Optional tracking choice | Six months on this browser, or until you change or clear it | A fresh choice is requested when it expires or the consent version changes |
| Access tokens for connected providers | While the connection is active | Revoked and deleted on disconnect |
| Lead and contact form submissions on postcliq.com | 24 months from submission | Deleted; earlier on request |
| Operational logs (redacted) | 30 days | Deleted |
| Access and security event log (minimal identifiers) | 12 months | Deleted |
| Allowance and referral ledger | 12 months, then reviewed | Anonymised or deleted |
| De-identified measurements in the benchmark pool (section 9A) | While the benchmark programme runs, reviewed every 12 months | Not tied to your account and cannot be picked out again; switching off stops further contribution |
| Published benchmark cells | Until their recorded expiry | Reviewed or retired |
| Account identity and consent record | While your account is active, plus 12 months to evidence consent | Deleted |
| Backups | Up to 35 days | Expire automatically; deleted records are tombstoned so a restore cannot bring them back |

10.1 When you delete your account or company, we stop all jobs and revoke all credentials immediately, and delete active records within 30 days. Copies in backups expire within the backup period above. We keep the minimum needed to evidence your consent history and protect against abuse, where the law allows.

10.2 Disconnecting a provider and deleting its saved history are separate actions, so you are not surprised by lost trend data.

## 11. Security

11.1 We take reasonable steps to protect your information. In plain terms:

- Every report requires a signed-in, verified user. There are no public links.
- Database rules enforce that a company's members can only read that company's data, and are tested for every table.
- Access tokens for connected providers are encrypted and never appear in browsers, logs or AI prompts.
- Our crawler runs in isolated containers with no access to our internal systems, and can only reach public internet addresses.
- Crawled content is treated as untrusted data. It cannot instruct our systems.
- Staff access is limited to a small number of named people and is logged.
- Providers are chosen for their security practices and bound by data processing terms.

11.2 No system is perfectly secure. We do not claim any security certification for PostCliq. Keep your email account secure, since it is your key to PostCliq.

## 12. Access and correction

12.1 You can see and change your name and notification settings in the app. You can see your company's members, sites and reports there too.

12.2 You can ask us for a copy of the personal information we hold about you, or ask us to correct it. Contact us (section 20). We will respond within 30 days. We may need to verify your identity. If we refuse a request we will tell you why and how to complain.

## 13. Deleting your account or company

13.1 Your account. Delete it in settings. Your membership ends, your name is removed from the People list, and your personal records are deleted on the schedule in section 10. Sites, reports and connections belong to the company and remain for the other members.

13.2 Your company. The company contact can delete the whole company after re-authenticating. This deletes every site, report, connection, history and membership for every member. Other members are told. This cannot be undone.

13.3 Backup boundary. Deleted data can remain in encrypted backups for up to 35 days. We record deletions so that, if we ever restore from a backup, deleted data is removed again before the system reopens.

13.4 Someone else's site. If a site about you is held by another company, contact us. We can remove excerpts about you (section 8.3) but we do not delete another company's report at your request unless the law requires it.

13.5 A form you filled in. If you asked for a resource or contacted us on postcliq.com and want that submission deleted before the 24 months in section 10, email us (section 20) and we will delete it.

## 14. Your choices about cookies, analytics and recordings

14.1 Essential storage keeps you signed in, protects forms, remembers an audit you started before signing in, and remembers preferences such as reduced motion and your optional-tracking choice. The tracking-choice cookie stores your choices, their version and date, not a tracking identifier. You do not have to allow optional tracking to use PostCliq.

14.2 We do not use advertising or remarketing pixels for this analytics setup. Advertising purposes remain denied in Google Tag Manager. An anonymous analytics identifier can span postcliq.com and app.postcliq.com only after you allow analytics; it is not used to follow you around other websites.

14.3 With your optional consent, we use PostHog to understand page and feature use and returning browser sessions. Events use anonymous browser/session identifiers and approved screen names. We remove customer domains, report and audit identifiers, query strings, fragments, referrer URLs and page titles. We do not send your email, name, private report excerpts, connected figures, business inputs, form contents or access tokens to PostHog. Its project is configured to anonymise IP addresses; like any internet service, its servers receive a network address to handle the connection. No PostHog person profile is created. Account, authentication, connection and administration screens are excluded from this tracking.

14.4 PostHog masked recordings are a separate option. We sample 10% of eligible public-page sessions after you allow them. Text and source attributes are masked, forms and images are blocked, and network bodies, headers, console logs and embedded media are excluded. Private reports, account screens and the app are never recorded. Public pages with query strings or fragments are excluded from replay too. These measures reduce detail in playback to protect privacy.

14.5 Our marketing site's existing Google Tag Manager container may load Google Analytics and Microsoft Clarity. To cover both usage measurement and possible recordings in that container, it loads only when you accept both optional categories and visit an eligible public page. We exclude CMS previews, framed pages, contact and legal pages, and pages with query strings or fragments from initial loading. Choosing "Analytics only" enables PostHog's limited event analytics without loading that container. We do not add PostHog through Tag Manager as well. Changing or withdrawing the choice may reload the page so previously loaded optional tags stop.

14.6 The first-visit banner offers "Accept all", "Analytics only" and "Reject optional". You can change or withdraw consent at any time through "Privacy choices". Your selection is remembered on this browser across our website and app for six months. Agreeing to the Terms or Privacy Policy when signing up does not turn on either optional category. Browser Do Not Track and Global Privacy Control signals prevent our optional PostHog and Tag Manager collection. Refusing or withdrawing does not affect access to PostCliq.

14.7 Two services run on every visit to postcliq.com and are not part of the optional choices above. HubSpot is our customer relationship management system: it sets cookies to recognise a returning browser, records the postcliq.com pages it visits and where it came from, and links those visits to the details you give us when you fill in a form, so our team knows what you were looking at. Ahrefs Web Analytics counts page views without cookies. Neither runs in the PostCliq app, on account screens or inside private reports. To stop HubSpot recognising your browser, block or clear cookies for postcliq.com; to have your HubSpot record deleted, contact us. These services do not receive your report contents, connected figures or business inputs.

14.8 Withdrawing consent stops new optional collection; it does not erase data already received. See section 10 for retention and sections 12 and 13 for access and deletion requests. You may also block browser storage, although blocking essential sign-in storage can prevent sign-in from working.

14.9 Separately from the choices above, our servers send PostHog operational metrics about PostCliq's own calls to AI providers: the provider and model, the type of task, token counts, response time, whether the call succeeded or the general kind of failure, and estimated cost, labelled with random identifiers created for each request. These metrics contain no prompts, page text, AI answers, website addresses or domains, email addresses, or account, company, site or report identifiers, and they are not linked to you, your browser or your analytics choices. We use them to monitor the cost, speed and reliability of the service.

## 15. Children

PostCliq is a business tool for people aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe we have, contact us and we will delete it.

## 16. Direct marketing

16.1 We send our newsletter and product updates to active account holders, as explained in the Terms (section 4). Every message identifies us and has an unsubscribe link. Unsubscribe at any time from any message or in settings.

16.2 A resource or contact form on postcliq.com asks you to agree to the Terms and Conditions. It does not subscribe you to the newsletter. We use those details to send you what you asked for and to answer you.

16.3 We do not give your details to third parties for their marketing.

16.4 You can ask us to tell you where we got your information. We will tell you unless it is impracticable or unreasonable.

## 17. Data breaches

If we experience a data breach that is likely to result in serious harm to you, we will notify you and the OAIC as the Notifiable Data Breaches scheme requires. We will tell you what happened, what information was involved and what you can do.

## 18. Complaints

18.1 If you think we have breached the APPs or this policy, contact us first (section 20). Tell us what happened and what you would like us to do. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.

18.2 If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC):

- Web: www.oaic.gov.au
- Phone: 1300 363 992
- Post: GPO Box 5288, Sydney NSW 2001

## 19. Changes to this policy

We may update this policy. Material changes will be notified by email or in the product at least 14 days before they take effect. The version and effective date are at the top of this page.

## 20. Contact

Privacy contact, WP Creative (Naphix Pty Ltd, ABN 65 610 345 198)

- Email: [\[email protected\]](https://postcliq.com/cdn-cgi/l/email-protection), with "Privacy" in the subject line
- Post: 63/89-97 Jones Street, Ultimo NSW 2007, Australia