Privacy Policy

1. Who is responsible for your data

The company operating this instance of Postly is the data controller for the personal data described in this policy. The contact address for privacy enquiries is published on our website and in your account settings. Where we process data on your behalf - for example the audience data we read from your connected channels - we act as a processor and you remain the controller of it.

2. What we collect

We collect the following categories of data:

Account data

Your email address, name, a hashed password where you register with one, the authentication provider you signed in with, your company name, your timezone, your profile picture and your biography.

Organisation and team data

The organisations you belong to, your role in them, and the invitations you send or accept.

Connected channel data

For each social or messaging account you connect: the access and refresh tokens the platform issues, its expiry, the granted scopes, and the public profile details we display - the account name, handle, avatar and identifier.

Content data

The posts, comments, drafts, templates, campaigns and settings you create, and the images, video and other media you upload to the media library.

Analytics data

Metrics we read from your connected channels, such as impressions, engagement and follower counts, so we can show them in the analytics screens.

Billing data

Your plan, subscription status and billing history, plus the customer and subscription identifiers held by our payment provider. We do not store full payment card numbers.

Technical and security data

Your IP address and browser user agent, recorded against your account for security and abuse prevention, your last-online timestamp, and server and error logs.

Communications

The messages you send to support, and your preferences for product and marketing email.

3. Why we use it, and our legal bases

To provide the service

Creating your account, publishing to the channels you connect, storing your content and showing your analytics. Legal basis: performance of our contract with you.

To take payment

Processing subscriptions, invoices and refunds. Legal basis: performance of our contract, and compliance with tax and accounting obligations.

To keep the service secure

Detecting and preventing abuse, fraud and unauthorised access, including by retaining IP addresses and user agents. Legal basis: our legitimate interest in protecting the service and its users.

To support and improve the service

Answering your enquiries, diagnosing faults, and understanding which features are used so we can improve them. Legal basis: our legitimate interests, and your consent where analytics cookies require it.

To send service and marketing messages

Operational notices about your account are sent on the basis of our contract. Marketing email is sent with your consent, or on the basis of legitimate interest to existing customers where local law allows, and you can withdraw at any time.

To meet legal obligations

Responding to lawful requests and keeping records we are required to keep. Legal basis: compliance with a legal obligation.

We do not sell your personal data, and we do not use the content you schedule to train models for other customers.

4. How we handle your channel credentials

The tokens that let us publish on your behalf are the most sensitive data we hold. They are used only to carry out actions you have asked for, are never shown in full in the interface, and are never shared with other customers. Disconnecting a channel removes the stored tokens for it. Revoking the authorisation from the platform side has the same effect on our ability to act, and we recommend doing both if you want to be certain.

5. AI and automated features

Where you use a feature that generates, rewrites or summarises content, the text or media you submit for that purpose is sent to the AI provider that powers the feature so it can return a result. Only what the feature needs is sent, and only when you invoke it. These features make suggestions; they do not make decisions about you that have a legal or similarly significant effect.

6. Who we share it with

We share personal data only with the categories of recipient below, and only as far as each needs it:

Connected platforms

The social and messaging networks you choose to connect, which receive the content you publish to them.

Infrastructure and storage providers

The hosting, database and object storage services that run the platform and hold your uploaded media.

Payment providers

The processor that takes payment and holds your card details on its own systems.

Communication and support providers

The services we use to send transactional email and to run support channels.

Analytics and error-monitoring providers

The services that tell us how the product is used and when it breaks.

AI providers

Where you use an AI-assisted feature, as described above.

Professional advisers and authorities

Where necessary to obtain advice, enforce our terms, or comply with a lawful request.

An acquirer

If the business is merged, acquired or restructured, in which case this policy continues to apply to the data transferred until you are notified otherwise.

Our processors act on our instructions under written terms, and are not permitted to use your data for their own purposes.

7. International transfers

Some of our providers operate outside your country, including outside the European Economic Area and the United Kingdom. Where we transfer personal data to such a country without an adequacy decision, we rely on appropriate safeguards - typically the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum - and assess the transfer before making it. You can ask us for details of the mechanism used for a given provider.

8. How long we keep it

We keep your account, content and connected-channel data for as long as your account is open. When you close your account, we delete or anonymise it within a reasonable period, except where we must keep specific records for longer:

• Billing and tax records are kept for the period our tax and accounting obligations require.
• Security and abuse records, including IP addresses associated with suspicious activity, are kept for as long as needed to prevent recurrence.
• Backups are retained on a rolling schedule and are overwritten in the ordinary course, so deleted data may persist in a backup for a limited period after deletion from the live system.
• Records needed to establish, exercise or defend a legal claim are kept until the claim is resolved.

9. Security

We take appropriate technical and organisational measures to protect your data, including encryption of traffic in transit, hashing of passwords, access controls that limit who on our side can reach production data, and validation of uploaded files. No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal data and presents a risk to you, we will notify you and the relevant supervisory authority as the law requires.

10. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you, and receive a copy of it.
• Have inaccurate data corrected.
• Have your data deleted, where we have no overriding obligation to keep it.
• Restrict or object to processing we carry out on the basis of legitimate interests.
• Receive the data you provided to us in a portable format, and have it sent to another provider where technically feasible.
• Withdraw consent at any time, where we rely on consent - which does not affect processing already carried out.
• Complain to your local data protection authority.

Much of this can be done directly in the application: you can edit your profile, disconnect channels, delete content and media, and close your account. For anything else, contact us at the address in your account settings and we will respond within the period the applicable law sets, normally one month.

11. Cookies and similar technologies

We use cookies and local storage that are strictly necessary to run the service - keeping you signed in, remembering your selected organisation, your language and your theme. Where we use analytics or product-measurement cookies that are not strictly necessary, we ask for your consent first and you can change your choice at any time. Blocking strictly necessary cookies will prevent the application from working.

12. Children

The service is not directed at children, and we do not knowingly collect personal data from anyone under 16 or under the minimum age of digital consent in their country. If you believe a child has given us personal data, contact us and we will delete it.

13. Self-hosted deployments

Postly can be self-hosted. If you are using an instance operated by your own organisation or a third party rather than by us, that operator is the controller of your data and its own privacy notice applies - not this one. This policy describes the instance you are reading it on.

14. Changes to this policy

We may update this policy as the service, our providers or the law change. If a change materially affects how we use your data, we will notify you by email or in the application before it takes effect. The date at the top of this page shows when it was last changed.

15. Contact

To exercise a right, ask a question about this policy, or raise a concern about how we handle your data, use the support address shown in your account settings or the contact address published on our website.