POWER MED LLC • U.S. BASED • FOUNDED 2014

Privacy Policy

Last Updated: November 2, 2026

PostZam uses information needed to move, store, create, and publish your content at your direction and, where separately enabled, to provide agreed tracking services. We do not sell your personal data or use your Content, Output, or conversations to train general-purpose AI models. This notice distinguishes our primary hosting from third-party processing and explains your choices.

1. Introduction

This Privacy Policy describes how Power Med LLC, doing business as PostZam ("PostZam," "we," "us," or "our"), collects, uses, stores, and shares information through postzam.com, app.postzam.com, promozam.com, app.promozam.com, and related PostZam™, DropZam™, PromoZam™, TrackZam™, and Ghost services (the "Service"). It describes processing; it does not replace a separate authorization or consent required by law. Capitalized terms have the meanings given in the Terms and Conditions.

TrackZam™ is under development and is not currently a generally available self-service feature. Contact us for information about client-specific setup. Any agreed tracking or optimization service is subject to its written scope, supported platform permissions, and the authorizations enabled for that customer.

2. Information We Collect

Information you provide directly

• Account information: name, email address, phone number (if provided), business name (if provided), and password or passkey credentials
• Payment information: Authorize.net processes card payments through our merchant account with Chase. PostZam does not store full card numbers, CVV codes, or magnetic-stripe data. We retain payment tokens and limited billing, transaction, and reconciliation details.
• Content and production records: videos, images, audio, documents, links, brand assets, captions, scripts, prompts, and instructions you supply; saved plans, preferences (including font style where offered), original files and edited versions; and Output created at your request. A description alone may be used for new-video creation.
• Links you provide: we may retrieve supported publicly available information from links you supply to help fulfill a request. We do not obtain permission to republish third-party material merely because a link is accessible.
• Camera and microphone data: if you use in-app recording or dictate to Ghost, PostZam accesses your device camera or microphone only while you are actively recording or speaking, and only with your permission. Dictated audio is transcribed to text to process your request
• Ghost conversations and continuity: typed or dictated requests, attachments, and responses retained with your account where this feature is enabled. Related transcripts, extracted text, summaries, and search indexes or embeddings may be retained to retrieve relevant account context. Separate private or enterprise Ghost deployments follow their applicable arrangements and are not made available to public-product customers.
• Contact form and support messages: your name, email, phone number, business name, department selected, and the message you send us

Information collected automatically

• Usage and billing data: features used, selected platforms, posting and scheduling activity, saved production preferences, quote and approval records, Credit reservations, settlements, corrections, storage usage, and session times. Client-specific tracking settings are recorded only when that service is enabled.
• Technical data: IP address, browser type, device type, operating system, and referring URLs
• Authentication logs: login events, email verification events, passkey events, and account access records
• Platform API responses: posting status, identifiers, and error information; performance data only for separately enabled and authorized tracking functions. Current YouTube access is limited as stated in Section 11.

Information from Third-Party Platform connections

• When you connect a social media account, we receive and store the authorization token issued by that platform and the basic account identifiers needed to show you which account is connected (for example, your page, channel, or profile name)
• Tokens are used for the publishing functions you authorize. Any client-specific performance tracking requires a separately enabled service, supported permissions, and authorization; mentioning TrackZam in this notice does not grant access to your analytics.
• We do not receive your social media passwords
• We do not read or send direct messages through the publishing Service. We request only information needed for the enabled and authorized function, rather than access to unrelated contacts, followers, or social data.

Information we do not request and metadata handling

• We do not store full payment card numbers, CVV codes, or magnetic stripe data
• We do not request Social Security numbers, government ID numbers, or biometric identifiers to use the ordinary Service. Media or documents you choose to provide may nevertheless contain sensitive personal information, faces, voices, or other identifying details; those materials are processed as Content. Do not supply unnecessary sensitive information, and obtain required permissions.
• The Service is for adults and is not directed at minors. We do not knowingly register users under 18. Information about other people, including minors, may appear in material an adult user supplies; that does not permit unlawful or unauthorized processing.
• Original files retained in the Library may contain embedded metadata. Processing or publishing copies may have metadata removed or changed, depending on their format and the operation performed. We do not promise that every original or derivative is stripped of all location, device, or technical metadata. Review files before sharing them externally if embedded information is sensitive.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, maintain, and secure the Service
• Store your media in your Library and make it available on every device signed in to your account
• Process subscriptions, trial offers, renewals, Credit purchases, quotes, approval records, holds, settlements, releases, and corrections, and manage the account's balance and storage
• Credit-cost notices: Credit requirements and future plan or top-up quantities may change with third-party AI, model, API connection, and related processing costs under Terms §6. We use account and quote records to show the applicable price, notify subscribers of applicable renewal changes, and retain approval evidence. Free planning and font-style selection do not themselves reserve or deduct Credits.
• Authenticate your identity and secure your account
• Publish the Content you authorize, including previously approved scheduled posts and AutoPost delivery; separately contracted automation is limited to its specific authorization
• Plan and generate requested captions, hashtags, thumbnails, clips, ads, scripts, narration, music, videos, and edited versions, using only the relevant inputs and enabled functions
• Provide separately agreed, enabled tracking or optimization for your own content using supported permissions; TrackZam is not currently a generally available self-service feature
• Retrieve relevant account context for Ghost where continuity is enabled, without making one customer's private materials available to another customer
• Read publicly available content from links you supply to assist with caption and video generation
• Apply safety and abuse-prevention controls as described in Section 4
• Send service communications, including verification codes, applicable trial and renewal notices, billing receipts, low-credit alerts, posting results, and security notifications
• Respond to contact-form, support, billing, enterprise, compliance, and legal inquiries, including a requested response by phone or text where permitted and appropriately authorized
• Monitor for fraud, abuse, spam, and violations of our Terms
• Maintain logs for security, dispute resolution, and compliance
• Improve the Service through aggregate, de-identified usage analysis

We do not sell personal information or use your Content, Output, Ghost conversations, or platform authorization data for our own targeted advertising or general-purpose AI training. Separately authorized performance data is used for that customer's agreed service. Marketing our own business and creating customer ads are distinct from serving third-party ads inside the workspace.

Attaching a file or asking for an opinion authorizes the requested inspection, not automatic creation, editing, or publishing. Free preparation can involve company-paid AI processing even though no customer Credits are used; this notice still applies to that processing.

4. Content Safety Scanning

Automated safety controls, including applicable provider filters, may evaluate submitted Content and requested Output for prohibited material. Coverage varies by feature and provider. We do not manually preapprove every file or guarantee that every prohibited item will be detected, and we do not represent that every upload is checked against a particular external hash-matching database.

When we obtain actual knowledge of facts or circumstances that trigger a reporting duty under 18 U.S.C. § 2258A, we report to NCMEC's CyberTipline and preserve the required material as the law requires. That provision does not itself require general monitoring or scanning of all user communications. Flagged content may be reviewed by authorized personnel when necessary. Other disclosures and preservation are subject to their applicable legal grounds.

5. How We Share Your Information

PostZam does not sell, rent, or trade your personal information. We share information only in the following limited circumstances.

Service providers

We share information needed for the assigned service with providers subject to the applicable service, confidentiality, data-protection, and security terms. These functions include:

• Authorize.net — card payment processing and payment-token services
• Chase — merchant banking
• Postmark — transactional email delivery
• DigitalOcean — primary application hosting, storage, and related infrastructure in the United States
• Google / Google Cloud — enabled AI functions such as captioning, multimodal analysis, safety filtering, and media generation
• Other enabled AI, speech-to-text, voice, music, image, and video providers — relevant request inputs and Output needed for the function you ask to use; a model catalog listing alone does not mean that provider receives your data
• Content-safety and abuse-prevention processing where integrated; this notice does not represent a connection to a specific child-safety or counter-terrorism hash database
• URL retrieval and reputation checks used for supported links you supply

PostZam does not use your Content, Output, or Ghost conversations to train general-purpose AI models and does not authorize its AI service providers to use those materials for that purpose. Providers process data under the applicable service terms and settings to supply the requested functions; they may also perform limited retention or processing for security, abuse prevention, safety, and legal compliance. A restriction on training does not mean that every provider offers zero retention.

Only the providers used for an enabled function receive its necessary inputs. A list of potential models is not a list of every provider to which a customer's materials are sent. Contact admin@postzam.com for information about providers and data handling relevant to a particular service.

Third-Party Platforms

When you authorize publishing, relevant Content, captions, settings, and authentication information are transmitted to the selected platform. Separately enabled tracking reads only the data within the permitted scope. A platform handles information under its own terms and privacy policy, and its published copies are separate from your PostZam Library. We remain responsible for our own processing and disclosures.

Legal requirements

We may disclose limited information when required by law, court order, or other valid legal process, or as lawfully necessary for fraud prevention, payment disputes, or safety. Notice is provided where legally permitted and appropriate. Child-exploitation reporting follows Section 4. An imminent threat may justify or require a disclosure in particular circumstances; it is not a blanket authorization to disclose all account information.

Business transfers

If PostZam or Power Med LLC is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. You will be notified of any change in ownership and of your choices under this Privacy Policy.

Enterprise and White Label accounts

If an Enterprise or White Label customer supplies your access, it may see the account, usage, content, and administrative information within its authorized scope. Its policies and applicable written terms also govern. A separate deployment may have different hosting or retention arrangements; those differences must be disclosed for that service.

6. Data Storage and Security

Primary application hosting and Library storage are in the United States. AI providers, other service providers, and connected platforms may process data in other locations, subject to their applicable terms and required safeguards. The safeguards below are designed to reduce risk, not to promise absolute security or universal U.S.-only processing:

• Encryption in transit: all data transmitted between you and PostZam is protected by TLS (HTTPS)
• Encryption at rest: sensitive data, including platform authorization tokens, is encrypted in storage
• Token protection: encrypted storage, limited access, and redaction controls designed to prevent platform credentials from appearing in ordinary logs, errors, or customer-facing interfaces
• Authentication: email verification codes and, where available, passkeys for account sign-in
• Access controls: production system access is restricted to authorized personnel on a least-privilege basis; administrative access is logged and reviewed
• Platform separation: separate publishing paths designed to limit the effects of an individual integration's failure, although shared-service incidents can affect multiple functions
• Backups: restricted-access backup and recovery procedures
• Media handling: retained originals are distinguished from processing and publishing derivatives; metadata treatment varies by format and operation as explained in Section 2

No system can be guaranteed 100% secure. If you believe your account has been compromised, contact admin@postzam.com immediately.

7. Data Retention

We retain information for the relevant service purpose, applicable obligations, security, and dispute handling. The periods below describe our retention policy, not a statement that every period is a universal legal minimum. Stricter platform-specific deletion rules control for platform data.

• Account information: while the account is active, then removed from active systems within 30 days after verified closure or deletion, except limited records needed for the purposes stated below
• Library media and Output: while the subscription or agreed storage entitlement is active and within its allowance. If a subscription simply expires, Library files are retained for 30 days for download or reactivation; contact support for export if ordinary access is unavailable. A verified account-deletion request starts the deletion process rather than requiring the user to wait through that recovery period. Backups follow controlled rotation, subject to required shorter deadlines.
• Platform tokens and API data: while authorized, then deleted within the specific periods in Sections 8 and 11; general financial or security retention does not permit continued use of revoked tokens
• Ghost continuity and related production data: conversations, attachments, saved plans and drafts, transcripts, summaries, and derived search indexes or embeddings retained for the enabled service are deleted with the account or in response to a valid request, except the limited records lawfully retained below
• Client-specific TrackZam data: retained only within an enabled, authorized client service and its written scope, subject to platform retention limits. De-identified patterns may be kept only where permitted, without retaining data that must be deleted under platform rules.
• Billing, approval, and transaction records: generally 7 years for accounting, tax, audit, and disputes, or another period required by law; these may include quote versions, consents, and hold, settlement, release, or restoration records
• Security and access logs: generally 12 months, and longer when reasonably needed for an incident, legal obligation, or unresolved dispute
• AI processing records: retained as needed for the requested job, troubleshooting, audit, and applicable legal obligations; provider-side retention may differ under its terms and settings. No universal zero-retention or fixed provider deletion period is promised.
• Content-safety evidence and incident records: preserved for applicable reporting, preservation, or legal-hold periods; incident documentation is generally retained for 3 years, with extensions where justified
• Support and contact-form communications: retained for dispute resolution and quality purposes

Retained legal, financial, or security records are limited to their justified purpose and are not used to continue publishing or tracking after authorization is withdrawn. Where applicable, deletion covers service-provider copies and derived account indexes, subject to lawful exceptions and required platform deadlines.

8. How to Delete Your Data

• Disconnect a platform: use the connection controls in your account or request disconnection at admin@postzam.com. We stop using the connection, revoke the authorization where supported or required, and delete its token and associated API data promptly and within 7 days, or sooner where required.
• Delete files: delete any file in your Library at any time.
• Delete your account: use the account-deletion control where available, or email admin@postzam.com from your account email with the subject "Delete My Data." After verifying the request, we close the account, stop future subscription renewals, delete platform tokens and API data within 7 days, and remove personal information, Library media, Output, and associated Ghost continuity data from active systems within 30 days, except the limited records described in Section 7.
• Platform-side revocation: access can also be revoked in the platform's connected-app settings. We stop using the connection when revocation is detected and delete associated data within the applicable platform deadline. For revocation through Google's security settings, YouTube API data is deleted as soon as possible and within 30 calendar days of revocation, not 30 days after detection. Direct requests to PostZam follow the shorter deadline above; another platform's stricter rule controls for its data.

These are the deletion instructions for connected platforms, including Meta. Deleting material from PostZam does not automatically delete copies already published to a platform or held independently by its users. Limited legal records and backup copies remain restricted; backup rotation does not extend mandatory platform deletion deadlines.

9. Your Rights and Choices

Depending on where you live, you may have the following rights regarding your personal information:

• Access: request a copy of the personal information PostZam holds about you
• Correction: request correction of inaccurate or incomplete information
• Deletion: request deletion of your personal information, subject to legal obligations
• Portability: request a copy of eligible data in a portable format. Library downloads are available within the applicable access or recovery period; support can assist with a timely export request.
• Objection and restriction: object to or ask us to restrict certain processing
• Opt out of marketing: unsubscribe using the link in any marketing email or contact support@postzam.com

Contact admin@postzam.com to exercise your rights. Our response target is within 30 days, subject to the deadlines and any permitted extensions under applicable law; platform deletion deadlines in Section 8 may be shorter. We may verify identity and an authorized agent's authority. We do not discriminate against users for exercising applicable rights.

Some data cannot be deleted where retention is required by law, for fraud prevention, or for legitimate dispute resolution.

U.S. state privacy rights

Residents of states with applicable comprehensive privacy laws may exercise the rights those laws provide. PostZam does not sell personal information or share it for cross-context behavioral advertising. We process sensitive information only as needed for the requested service and permitted security, compliance, or legal purposes. You may appeal a decision by emailing admin@postzam.com with the subject "Privacy Appeal," and retain any right to contact the appropriate regulator.

European Economic Area, United Kingdom, and other international users

If you are in the EEA, the UK, or another jurisdiction with similar laws, our legal bases for processing are: performance of our contract with you (providing the Service you signed up for); our legitimate interests (securing the Service, preventing fraud, and improving it in aggregate); compliance with legal obligations; and your consent, where we ask for it (for example, camera and microphone access and marketing). You have the right to lodge a complaint with your local data protection authority.

10. Cookies and Tracking

PostZam uses cookies and similar technologies to operate and improve the Service:

• Session cookies: to maintain your login state and session security
• Functional cookies: to remember your preferences and settings
• Aggregate analytics: to understand how the Service is used; this data is not used to build individual profiles
• Embedded media: a YouTube player or other embedded service may receive technical information when it loads or is used and may set cookies under its own policy. See the Google Privacy Policy and the controls available for the relevant embed.

We do not use customer Content, Output, conversations, or platform credentials for our own targeted advertising. Before introducing optional advertising or cross-site tracking that requires a notice, consent, or opt-out mechanism, we will supply that notice and mechanism. This Policy does not itself enable such tracking. Browser cookie settings and any applicable on-site choices may be used to control optional storage; legally recognized opt-out signals are honored where required. A browser's "Do Not Track" signal does not replace those legal requirements.

11. Third-Party Platform Privacy

When you connect Third-Party Platforms to PostZam, your use of those platforms is governed by their own privacy policies. PostZam is not responsible for the privacy practices of TikTok, Meta (Facebook and Instagram), Google (YouTube), X, LinkedIn, Pinterest, or any other connected platform.

We request permissions needed for enabled, authorized functions, not undefined future tracking. The publishing Service supports Facebook Business Pages, Instagram professional accounts, and Pinterest accounts where enabled. TrackZam is under development; any client implementation requires its own scope and permissions. YouTube's specific limitation below is not overridden by general tracking language.

YouTube API Services

PostZam uses YouTube API Services to publish your Content to YouTube at your direction. By using PostZam's YouTube features, you also agree to be bound by the YouTube Terms of Service, available at https://www.youtube.com/t/terms.

Your use of YouTube API Services is also subject to the Google Privacy Policy, available at https://policies.google.com/privacy.

PostZam accesses YouTube data to publish at your direction and show upload results. It stores the authorization token while that connection is active and does not currently retrieve or store YouTube analytics or statistics. Any future YouTube performance tracking requires an updated notice and appropriate separate authorization. Direct disconnection or deletion requests to PostZam are handled promptly and within 7 days. You may also revoke access through https://myaccount.google.com/connections; deletion after that revocation follows Section 8.

PostZam's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Meta (Facebook and Instagram)

PostZam uses Meta's official APIs to publish to Facebook Business Pages and Instagram professional accounts you manage, and stores only the authorization token and account identifiers needed to do so. You can remove PostZam's access at any time in your Facebook or Instagram settings under Apps and Websites, or by disconnecting the platform in your PostZam account. Data deletion instructions are in Section 8.

TikTok, LinkedIn, X, and Pinterest

PostZam uses each platform's official API to publish Content you have approved and stores only the authorization token and account identifiers needed to do so. Posting to TikTok requires your per-post selection of privacy level, interaction settings, and commercial content disclosure, as TikTok requires. You can revoke access at any time in that platform's connected-apps settings or by disconnecting the platform in your PostZam account.

12. Children's Privacy

The Service is directed to adults, and users must be at least 18. We do not knowingly register children as users. Adult users remain responsible for the permissions needed for material depicting minors. PostZam has zero tolerance for child sexual abuse material and follows the applicable reporting and preservation obligations described in Section 4.

If you believe a child has registered or provided information in violation of this Policy, contact admin@postzam.com. We will investigate and delete information as appropriate, subject to required safety-evidence preservation and other legal obligations.

13. International Users

PostZam is operated from the United States. Primary application hosting is in the United States, and international use involves transfers there; third-party processing may also occur elsewhere as described in Section 6. Privacy protections may differ by country. Transfers subject to legal restrictions must use the safeguards or other valid transfer mechanism required by applicable law. Merely using the Service is not treated as blanket consent to every international transfer. Contact admin@postzam.com for information about arrangements relevant to your service.

14. Policy Updates

Material Privacy Policy changes will be communicated by email or in-product notice with appropriate advance notice, except where law requires a different approach. Where a new use requires consent or authorization, it is obtained separately before that use. A change to Credit quantities or provider costs does not itself authorize new data sharing, training, or tracking.

15. Contact

• Privacy requests, data deletion, and data rights — admin@postzam.com
• Security incidents — admin@postzam.com
• Legal inquiries — admin@postzam.com
• General support — support@postzam.com
• Mail — Power Med LLC, 2020 Seven Springs Blvd, New Port Richey, FL 34655, United States

PostZam — Where Time Comes Back.

Power Med LLC • 2020 Seven Springs Blvd, New Port Richey, FL 34655

U.S. Based • Founded 2014 • postzam.com

PostZam™ Privacy Policy | November 2, 2026 | admin@postzam.com