Privacy Policy

Posturit is operated by Anderbox Holdings LLC (“we”, “us”). This policy explains what we collect, why, and what we do with it. It covers both the posturit.com website and the Posturit application.

Posturit is early-stage software. Where this policy describes something we don't currently do, that's a statement about today — we'll update this page before that changes.

What we collect

If you request early access: your email address, company name, the role you select, and anything you type into the optional notes field. That's it.

If you have an account:

• Your email address, used to identify and authenticate you.
• If you sign in with Microsoft, we receive your email address, name, and basic profile from Microsoft. We do not receive or store your Microsoft password, and we request no access to your mailbox, files, or tenant.
• The data you enter into the product: your organisation name, the client organisations you manage, posture templates you build, the security tools you select, and the assessments you record.

Automatically: a session cookie so you stay signed in, plus standard server logs (IP address, timestamp, requested page) kept by our hosting providers for security and debugging.

What we don't collect

• We do not connect to, scan, or monitor your systems or your clients' systems. Posturit scores what you tell it. Every control status is entered by a person — there is no agent, no network access, and no automated collection from client environments.
• We don't use advertising or analytics cookies, and we don't run third-party trackers on this site.
• We don't ask for or store payment card details. There is currently no paid tier.
• We don't collect special-category personal data, and the product isn't designed to hold it.

How your data is separated from everyone else's

Posturit is multi-tenant: several organisations use the same application and database. Separation is enforced in the database itself using PostgreSQL row-level security, so a query made on behalf of your account can only return rows belonging to organisations you're a member of. Access within your own organisation is further scoped by role.

No other customer can see your client list, your posture templates, or your assessments. No third-party product vendor has any access to customer data.

Who we share it with

We don't sell your data, and we don't share it for anyone else's marketing. We use a small number of processors to run the service:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting and delivery.
• Brevo — transactional email (sign-in codes and the notification telling us you asked for access).
• Microsoft — only if you choose to sign in with Microsoft.

We'll also disclose data where we're legally required to, or to protect the security of the service.

How long we keep it

• Early-access requests: until you ask us to remove you, or until we close the programme.
• Account and product data: for as long as your account is open. Ask us to delete it and we will.
• Server logs: retained on our providers' standard schedules, which are short.

Your choices

Email us at rich@anderbox.com and we will, without charge: tell you what we hold about you, correct it, export it, or delete it. Depending on where you live you may have additional rights under laws such as the GDPR or the CCPA — we'll honour those requests regardless of whether they strictly apply to us.

There's no marketing list to unsubscribe from. If you asked for early access and change your mind, one email removes you.

Security

Data is encrypted in transit (HTTPS) and at rest by our providers. Access to production data is limited to the operator of the service. Sign-in is by one-time email code or Microsoft OAuth — we never store a password for you.

No system is perfectly secure, and we won't pretend otherwise. If you find a security issue, please email us and we'll respond quickly.

Children

Posturit is a business product and isn't intended for anyone under 16.

Changes

If we change this policy materially, we'll update the date at the top and, for anyone with an account, email you. Continuing to use Posturit after a change means you accept the updated policy.