Privacy Policy

This policy explains how Soxoa LLC, doing business through Postedly ("Postedly," "we," or "us"), handles information when you visit postedly.com, submit an intake, purchase a service, or contact us.

Information you provide

You may provide a company name, company URL, work email, service category, operating regions, target buyer or opportunity, capabilities, exclusions, delivery capacity, credible contract-size range, certifications, partners, negative filters, public-sector experience, references, and other details you choose to include. Stripe receives payment and billing information during checkout; Postedly does not receive or store complete card numbers.

Postedly may send Stripe the selected service, company name, California regions, and optional opportunity or buyer as Checkout fields, together with non-card reconciliation references such as a pre-checkout intake ID and random analytics session ID. These fields help match the payment to the requested service; they are not card credentials.

Temporary same-tab intake storage

After a successful pre-checkout intake, Postedly temporarily stores the company name, company URL, work email, service category, California regions, target opportunity, capabilities, exclusions, delivery capacity, contract-size range, target buyers, certifications and partners, negative filters, and public-sector proof in your browser's session storage. This information is used only to restore those fields during paid onboarding in the same browser tab. It does not include the selected offer, Stripe Checkout reference, payment details, or card information. A service contact already bound to a paid order takes precedence over a temporarily saved email. Postedly clears the saved profile after a successful paid onboarding submission, and the browser normally removes it when the tab session ends.

Information generated through the service

We may create intake references, source notes, opportunity records, review decisions, memos, delivery records, and support correspondence. Public procurement information may be retained with source and freshness context for service integrity and research.

After verified paid onboarding, Postedly stores the service contact email and intake reference in the associated Stripe Checkout Session metadata so the order can be matched to the correct recipient. For Dispatch, Stripe subscription metadata also stores non-personal delivery keys, counts, service-period markers, and reconciliation state used to enforce the purchased memo limit and prevent accidental duplicate delivery.

When an authenticated service-contact correction is pending, active Stripe metadata temporarily retains the prior and replacement contact addresses plus a hashed change reference. Postedly uses those fields to prevent changes to the rest of the confirmed intake and to keep delivery blocked until replacement confirmation. The temporary prior-address field is cleared from active metadata after confirmation; provider audit and support records may retain the change as otherwise described in this policy.

Limited product analytics

When analytics is configured, Postedly records page paths, named interactions such as offer or checklist actions, referring-site host, and campaign parameters such as UTM source or campaign. The site uses a random per-tab session identifier stored in session storage for this purpose. When you start checkout, that identifier may be copied into Stripe metadata so Postedly can record anonymous verified-purchase, paid-onboarding, recurring-invoice, and provider-accepted-send funnel events from the server. The analytics payload excludes form contents, email addresses, Stripe Checkout references, intake references, full query strings, and payment details, and it does not create a persistent analytics cookie or identified user profile.

How information is used

We use information to respond to requests, verify source records, prepare and deliver purchased services, administer billing, prevent abuse, maintain security, troubleshoot problems, improve Postedly, and comply with legal obligations. We do not sell personal information.

Before checkout, an intake is sent only as a private notification to the Postedly operator, and its reference is shown in the browser. Postedly does not send a receipt or other message to the submitted work email based solely on that unpaid intake. After Stripe verifies a paid checkout, Postedly may send paid-checkout recovery and paid-onboarding confirmation messages to the verified service contact.

Abuse prevention and rate limiting

Postedly's application may process the client IP address supplied by its hosting infrastructure to derive temporary, in-memory rate-limit keys for intake, checkout verification, analytics collection, and other protected endpoints. These application-level counters expire after defined windows, are not included in Postedly's product-analytics payloads, and are not used to build identified marketing profiles. Hosting and security providers may separately process ordinary network request data under their own terms.

Service providers

Postedly currently relies on service providers including Vercel for hosting, Stripe for checkout and billing, AgentMail for intake and service delivery, and PostHog for the limited product analytics described above when configured. Those providers process information under their own terms and privacy commitments. We may add or replace providers as the service evolves.

Retention and deletion

We retain intake, service, billing, support, and transaction records only as long as reasonably needed to deliver the service, maintain business and security records, resolve disputes, and meet legal obligations. You may request access, correction, or deletion by emailing john@soxoa.com. Some records may be retained where required for billing, fraud prevention, legal claims, or compliance.

Security and business use

We use reasonable administrative and technical safeguards, but no online service can guarantee absolute security. Postedly is intended for business users and is not directed to children under 13.

Changes and contact

We may update this policy by posting a revised version and effective date. Questions and privacy requests may be sent to john@soxoa.com. Soxoa LLC is located in Sacramento, California.