Privacy Policy

Last updated: August 20, 2026

1. Who We Are

Punch is operated by CF Innovation Labs ("we", "us", "our"). We are committed to protecting your privacy and handling your data transparently.

Data Type	Purpose	Retention
Email address	Account authentication, notifications	Until account deletion
Name, company name	Account personalization	Until account deletion
WhatsApp number (optional)	Approval notifications	Until account deletion
LinkedIn OAuth tokens	Publishing the posts you have approved	Encrypted; until disconnected
Generated content	Queue management and publishing	Until account deletion
Payment info	Processed by Paddle (we never see card numbers)	Per Paddle's policy
Usage data (credits used)	Billing and service delivery	Until account deletion

To provide and operate the Service (content generation, scheduling, publishing).
To authenticate you and secure your account.
To process payments via our Merchant of Record (Paddle).
To send service-related notifications (approval requests, account updates).
To improve the Service based on aggregate usage patterns.

We do NOT sell your data, use it for advertising, or share it with third parties for marketing purposes.

We use the following third-party services:

Firebase (Google): Authentication. Privacy Policy
Google Gemini: AI content and image generation. Your prompts are sent to Google's API.
Paddle.com Market Ltd: Payment processing and merchant of record. Privacy Policy
Microsoft Azure: Hosting and database. Privacy Policy
LinkedIn: Social media publishing (only when you connect your account).
Meta (Facebook, Instagram): Social media publishing (only when you connect a Facebook Page or Instagram account).
Meta (WhatsApp Cloud API): Approval notifications and the WhatsApp assistant.

All data is transmitted over HTTPS (TLS encryption).
Social media credentials are encrypted at rest using Fernet symmetric encryption.
Authentication is handled by Firebase with industry-standard security.
We follow the principle of least privilege for data access.

If you are in the EU/EEA, you have the following rights:

Access: Request a copy of your data (use the "Export Data" feature in Settings).
Rectification: Update your data via your Profile.
Erasure: Delete your account and all associated data (use "Delete Account" in Settings).
Portability: Export your data in JSON format.
Objection: Contact us to object to specific data processing.

To exercise any right, email us at info@cfinnovationlabs.com or use the self-service options in your account settings.

We use the following cookies:

punch_token: Session authentication cookie. Essential for the Service to function. Expires when you log out.

We do NOT use tracking cookies, analytics cookies, or advertising cookies.

We retain your data for as long as your account is active. When you delete your account, the deletion runs immediately:

Deleted at once: your profile, connected LinkedIn pages and their authorisation tokens, brand styles, uploaded photos, approval phone numbers, drafts, published post history and your credit balance.
Kept: records of payments you made: the date, amount and order reference. Accounting and tax law require us to keep records of a sale, and Article 17(3)(b) GDPR withdraws the right to erasure where processing is necessary to comply with a legal obligation. These records are kept for the statutory retention period and are used for nothing else.
Once payment records are all that remain, your account row is reduced to a pseudonym: the email address is replaced, and name, company and phone number are removed, so nothing in the retained records identifies you.
If you never made a payment, nothing is kept and the account is removed entirely.
Aggregate, anonymised usage statistics may be retained.

The Service is not intended for children under 18. We do not knowingly collect data from minors.

We may update this policy from time to time. Material changes will be communicated via email to registered users.

For privacy-related questions or concerns:
Email: info@cfinnovationlabs.com
CF Innovation Labs