1. Scope and roles
These data processing terms apply when an organisation (“Operator”) uses Postalu Social Hub, operated by postalu.com (“Postalu”), and personal data is processed under data-protection law such as the GDPR, the UK GDPR or the CCPA/CPRA. They form part of the Terms of Use.
- Operator = controller (or business): decides what is published, to which accounts, and why.
- Postalu = processor (or service provider): processes personal data only on the Operator's documented instructions, which are the Terms, this page, and what the Operator and its team do in the application.
- Postalu = controller for its own account administration, security monitoring and legal compliance, as described in the Privacy Policy.
- Social platforms (Meta, Google, TikTok, X, LinkedIn) act as independent controllers of the data on their own services.
2. Details of the processing
| Item | Description |
|---|---|
| Subject matter and purpose | Providing a web application to compose, schedule, publish and measure social media posts and to manage the team that does so. |
| Duration | The term of the Operator’s use, then deletion as described below. |
| Categories of data subjects | The Operator’s team members; people who appear in or are named in content the Operator uploads; the owners of connected social accounts. |
| Types of personal data | Names, email addresses, profile pictures, roles, IP addresses and session data of team members; connected-account identifiers and encrypted tokens; captions, media and comments the Operator submits (which may contain personal data); aggregate post metrics. |
| Special categories | None intended. The Operator must not upload sensitive data (for example health data or children’s data) unless it has a lawful basis and tells us. |
| Frequency | Continuous, while the service is used. |
3. Our obligations as processor
- Instructions. We process personal data only on the Operator's instructions, unless the law requires otherwise, and we will tell the Operator if we think an instruction breaks data-protection law.
- Confidentiality. People with access to personal data are bound by confidentiality and given access only as needed.
- Security. We maintain the technical and organisational measures described on our Security page, including encryption of tokens, access control, two-factor authentication, logging and automatic media expiry.
- Sub-processors. We use the sub-processors listed below under written terms that give equivalent protection, and remain responsible for them. We will update this page before adding or replacing a sub-processor that handles personal data, and give Operators an opportunity to object (see below).
- Assistance. Taking into account the nature of the processing, we will help the Operator respond to requests from data subjects (access, correction, deletion, export) and with security, breach-notification, impact assessments and consultations, as far as the application and our records allow.
- Breach notification. We will notify the Operator without undue delay, and aim to do so within 72 hours, after becoming aware of a personal-data breach affecting its data, with the information we have.
- Deletion and return. During use, the Operator can export and delete data through the application and the Data Deletion page. At the end of use, we delete the Operator's personal data within 30 days of a request or termination, except where the law requires us to keep it (and logs that expire on their own schedule: media within 32 days, operational logs within 30 days).
- Audits. We will make available information reasonably necessary to show compliance and allow audits by the Operator or its auditor on reasonable notice, no more than once a year (unless there has been a breach), during business hours, without disrupting the service, and subject to confidentiality.
4. The Operator's obligations
- It has a lawful basis for the personal data it uploads and the instructions it gives, and has given the notices and obtained the consents required (for example from people featured in its content and from its team members).
- It manages its users and permissions, keeps credentials secure and tells us promptly about suspected unauthorised access.
- It does not upload special-category data or data about children without a lawful basis and our agreement.
5. Sub-processors
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Hosting (ECS Fargate, Elastic Load Balancing), database (DynamoDB) and database backups (S3), media storage (S3), TLS and DNS (Certificate Manager, Route 53), secrets (Systems Manager Parameter Store), logs and alarms (CloudWatch), account and alert email delivery (SES, SNS) | All application data, media, account email addresses and alert email addresses | United States (N. Virginia) |
| Google LLC (Gemini API) | AI caption suggestions, only when a user presses AI assist | The composer text, platforms and tone sent in that request | United States and other Google locations |
| Slack, Microsoft Teams (only if the Operator enables them) | Delivering alert messages to a destination the Operator chooses | Short alert text (event, post title, link); no tokens or media | Per provider |
| Paddle.com Market Ltd (Paddle) | Payment processing and merchant of record for subscriptions (acts as an independent controller for payment data) | Billing name, email and payment details entered at checkout; we receive subscription identifiers and status only | United Kingdom, EU and United States |
| Google LLC (Sign in with Google) | Identity sign-in, only if a user chooses it | Google account identifier, email address and name | United States and other Google locations |
| GitHub, Inc. | Source code hosting and deployment pipeline | No customer personal data | United States |
Social platforms are not sub-processors. When the Operator tells us to publish to a platform, we transmit the content to that platform as the Operator's instruction.
Changes and objections. We will update this table before a new sub-processor handles personal data. An Operator may object on reasonable data-protection grounds within 30 days of the change by emailing the address below; if we cannot resolve the concern, the Operator may stop using the service and request deletion.
6. International transfers
Data is processed in the United States. Where the law requires a transfer mechanism for personal data originating in the EEA, the UK or Switzerland, the parties incorporate the European Commission's Standard Contractual Clauses (Module Two, controller to processor; and Module Three for sub-processors) and the UK International Data Transfer Addendum, by reference, with the details on this page forming their annexes, or rely on another valid mechanism such as the EU-US Data Privacy Framework where a provider is certified.
7. US state privacy laws
For personal information subject to the CCPA/CPRA or similar laws, Postalu acts as a service provider/processor: we do not sell or share the information, we do not retain, use or disclose it outside the direct business relationship or for any purpose other than providing the service, and we do not combine it with other data except as the law permits.
8. Order of precedence, signed copy and contact
If these terms conflict with the Terms of Use on the processing of personal data, these terms prevail. Liability is subject to the limits in the Terms of Use.
Last updated October 12, 2026 · Version 1.0
