1. Who we are and what this covers
Postalu Social Hub (“Postalu”, “we”, “us”) is a web application at postalu.com. It lets authorised operators and their team members publish and schedule content to social media accounts they own, and see how that content performs.
This policy explains what information we collect, why, who it is shared with, how long we keep it, and the choices you have. It covers the Postalu website and application, and the data we receive from the social platforms you connect. It does not cover the social platforms themselves, which have their own policies (see section 9).
The word “operator” means the person or organisation that owns the connected social accounts and administers Postalu. A “team member” is anyone the operator invites. For the content and connected accounts, the operator decides what is published and why; we process it on the operator's behalf.
2. Summary in plain language
- We store what is needed to publish and schedule your posts: login details, connected-account tokens (encrypted), your media, captions, schedules and results.
- Your media is kept only as long as it is needed and is removed automatically as soon as your post is live (see section 6).
- You can disconnect any account or delete your data at any time (see sections 6 and 13, and the Data Deletion page).
- Data is stored with Amazon Web Services in the United States.
3. Information we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Workspace and plan | Your workspace name, whether it is a Solo or Agency account, the plan you are on (Free or paid), the number of accounts you have bought, and the dates of sign-up and plan changes. | You, and our billing provider. |
| Billing and subscription | Paddle customer and subscription identifiers, subscription status, the end of the current billing period and payment events (for example paid, past due, cancelled). We never receive or store your card number: payment is taken by Paddle, our merchant of record. | Paddle, when you subscribe. |
| Sign-in with Google | If you choose it: your Google account identifier, email address and name, used only to sign you in and to link the account to your workspace. We do not receive your Google password and do not read your Google data. | Google, when you sign in with it. |
| Email verification and password reset | A one-way hash of the single-use link we email you, with its expiry. The link itself is not stored. | Our systems. |
| Account and team details | Email address, display name, optional profile picture, role and permissions, a one-way Argon2id hash of the password (never the password itself), an encrypted two-factor (TOTP) secret and one-way hashes of recovery codes. | You, or the administrator who created your account. |
| Profile picture | If you upload one: a 256×256 JPEG (cropped by you in the browser) stored in our private S3 bucket and shown only to signed-in team members. | You. |
| Alert settings | If an administrator turns on alerts: the label and event choices, email addresses, and and the Slack or Teams webhook address (encrypted, never shown again). | The administrator. |
| Approval and review activity | Who submitted, approved or asked for changes to a post, the reviewer's notes, and timestamps. | Team members. |
| Scheduling preferences | Recurring queue slots (day, time, platforms) and your time zone. | You. |
| AI usage counter | How many AI suggestions have been requested (not the text itself). | Our systems. |
| Sessions and security | Session records (device description, IP address, timestamps), sign-in and two-factor events, failed-attempt counters used for rate limiting. | Generated when you use the service. |
| Connected-account data | OAuth access and refresh tokens (encrypted), the platform account ID, display name or handle, profile picture URL, and token expiry. | The social platform, when you connect an account. |
| Content you submit | Photos and videos, captions, descriptions, hashtags, first comments or replies, carousel order, per-platform settings (for example YouTube title and visibility; TikTok privacy level, comment/duet/stitch choices, commercial-content disclosure and your consent), and schedule times. | You. |
| Publishing results | Platform post IDs and links, status, timestamps, which team member created the post, and the error text a platform returns when something fails. | The social platforms and our own systems. |
| Performance metrics | Views, likes, comments, shares and, where offered, reach or impressions for posts published through Postalu. | The social platforms, fetched on request. |
| Audit and diagnostic logs | Security-relevant events (who did what, when, and from which IP address), and operational server logs. | Generated when you use the service. |
| Browser storage | A session cookie, short-lived sign-in and account-connection cookies, and a few preferences (see section 7). | Your browser. |
What we do not collect: payment card details (Postalu takes no payments), your precise location, your contacts, private messages, or posts and profile details of other people. We do not read your followers' or audience's personal data; the metrics we fetch are aggregate counts for posts you published.
4. What we receive from each social platform
We request only the permissions needed for the features you use. You approve them on the platform's own consent screen, and can withdraw them at any time (section 13).
| Platform | What we access | What we use it for |
|---|---|---|
| Instagram, Facebook Pages, Threads (Meta) | Your account or Page identity, permission to create posts, Stories and comments, and post insights. | Publishing and scheduling posts, posting the first comment, showing connected-account details and post statistics. |
| YouTube (Google) | Your channel name, handle and picture; permission to upload videos and to post comments on your videos; read access to your video statistics. | Uploading videos with the title, description and visibility you choose, posting the first comment, and showing statistics. |
| TikTok | Your TikTok open ID, display name, username and avatar; permission to upload or post videos and photos; the posting options TikTok allows for your account. | Publishing with the privacy, interaction and disclosure choices you make, and showing which account is connected. |
| X | Your user ID, name, username and picture; permission to post, post replies and upload media; read access to metrics of your own posts. | Publishing posts with photos or video, posting the first comment as a reply, and showing statistics. X usage is billed by X to the operator. |
| LinkedIn (profile and Company Page) | Your member or organisation identity and permission to post and comment; post statistics for Company Pages. | Publishing, posting the first comment and showing statistics. |
Tokens are used only by our servers. They are never shown to team members and never sent to your browser.
5. How we use information
- Provide the service: publish and schedule content, post first comments, keep accounts connected, show history and statistics.
- Secure the service: authenticate users, enforce two-factor sign-in and permissions, rate-limit abuse, detect and investigate incidents.
- Operate and fix problems: diagnose failures, show you plain-language error messages, and keep the service reliable.
- Meet legal obligations and enforce our Terms of Use.
We do not use your information to build advertising profiles, to make automated decisions with legal effect, or to train AI models. See our AI Features Notice.
Where the law requires a legal basis, we rely on performing our agreement with you, our legitimate interests in running and securing the service, and compliance with legal obligations. Where you connect a platform, you consent to the access you approve there.
6. Media storage, scheduling and retention of uploads
Files you upload are stored in a private Amazon S3 bucket. Your browser uploads directly to the bucket using a short-lived (5-minute), single-file signed link that we issue after checking your permissions. Nothing in the bucket is public.
- Automatic deletion after publishing: the files of a post are deleted as soon as every selected platform has the post. You do not need to do anything.
- Deletion on request: the Postalu team can delete stored files on your request. The post record and statistics stay.
- Scheduled posts: media is kept until the post publishes (up to 30 days ahead). Cancelling a scheduled post deletes its media immediately.
- Automatic expiry: anything left behind is removed by a storage rule 32 days after upload.
- Your own folder: files are stored in a folder that belongs to your account only; other customers cannot read or reference it.
When it is time to publish, the media is handed to the platform through short-lived signed links or streamed from storage by our servers. Please keep your own backup of master files, because storage here is working storage, not an archive.
9. Platform-specific commitments
- YouTube: governed also by the YouTube Terms of Service and the Google Privacy Policy. You can revoke access at myaccount.google.com/permissions.
- Meta (Instagram, Facebook, Threads): governed by the Meta Privacy Policy and the Threads Supplemental Privacy Policy. Our user-data deletion callback is described on the Data Deletion page.
- TikTok: governed by the TikTok Privacy Policy. We follow TikTok's content sharing guidelines: you choose the privacy level, interactions and any commercial-content disclosure, and you confirm before anything is uploaded.
- X: governed by the X Privacy Policy and the X Developer Agreement and Policy. We do not collect or store other people's posts.
- LinkedIn: governed by the LinkedIn Privacy Policy and LinkedIn's API terms.
Stories. When you publish a Story, the photo or video is sent to Meta (Instagram or Facebook) using the connected account's authorised access. Stories are shown by the platform for 24 hours under Meta's own policies.
10. How we protect information
- Tokens: platform access and refresh tokens are encrypted with AES-256-GCM before storage. Each token is bound to its own account, and encryption keys are versioned so they can be rotated.
- Passwords and two-factor secrets: passwords are stored only as Argon2id hashes. Two-factor sign-in is required for every team member, and recovery codes are stored hashed.
- In transit: all traffic uses HTTPS through an AWS load balancer with a managed certificate, and the application runs in private subnets that accept traffic only from that load balancer.
- Access: permissions are checked on the server for every action. The application's cloud identity has the minimum access needed, and secrets are kept in encrypted parameter storage, not in code.
- Abuse protection: rate limiting on sign-in and sensitive actions, and an audit trail of security events. Tokens, passwords and keys are kept out of logs.
More detail is on our Security page, including how to report a vulnerability. No system is perfectly secure. If a breach affecting your information occurs, we will investigate promptly and notify affected operators and, where required, the relevant authorities, without undue delay.
11. How long we keep information
| Information | How long |
|---|---|
| Profile picture | Until you change or remove it, or your account is deleted (it is then deleted from storage). It is not covered by the 32-day upload expiry. |
| Alert settings | Until an administrator removes the channel; the secret and any email subscription are deleted with it. |
| Account and team details | Until the account is deleted. Deleting a team member removes the login, sessions, two-factor secret and recovery codes immediately. |
| Sessions and rate-limit counters | Sessions expire automatically; rate-limit counters expire within hours. |
| Connected-account tokens and profile details | Until you disconnect the account, which deletes them immediately. |
| Uploaded media | As described in section 6: deleted on auto-delete, manual deletion or cancellation, and in any case 32 days after upload. |
| Posts, schedules, results and metrics | Until the operator deletes the post or a deletion request is completed. Posts created by a deleted team member remain, shown as “Deleted user”. |
| Audit log entries | Kept for security and accountability. They contain event details and IP addresses but not your media or tokens. We delete or anonymise them on a verified request unless we need them to meet a legal obligation or investigate abuse. |
| Billing records | Paddle keeps transaction and invoice records as the law requires. We keep your subscription status for as long as the workspace exists. |
| Database backups | Encrypted backups of the database are kept for up to 90 days and then expire. Data you delete remains in a backup until that backup expires. |
| Operational server logs | 30 days. |
Backups are used only to restore the service after a failure or loss, are encrypted, and are not used for any other purpose. They are not an archive of your content.
12. International transfers
Our infrastructure is in the United States. If you use Postalu from another country, your information is transferred to and processed in the United States, where data-protection rules may differ from those where you live. We apply the protections described in this policy wherever the data is processed, and rely on the transfer mechanisms the law requires where they apply.
13. Your rights and choices
Depending on where you live, you may have the right to access your information, correct it, delete it, receive a copy, object to or restrict certain processing, withdraw consent, and complain to a data-protection authority. You can:
- Disconnect a platform in Settings, which immediately deletes its stored tokens and profile details.
- Revoke access on the platform itself (for example Google permissions, Meta Business Integrations, TikTok Manage App Permissions, X Connected apps, LinkedIn Permitted Services).
- Delete media and posts from History, Scheduled and Storage.
- Ask us to access, export, correct or delete your information, or to close your account, by emailing the address below or following the Data Deletion page. We may need to verify your identity, and for an operator's data we may need the administrator's confirmation. We aim to respond within 30 days.
We will not treat you differently for exercising these rights.
14. Additional information for the EEA, UK and certain US states
Roles. For the content and connected accounts of an organisation, the operator is the controller and we are its processor (see the Data Processing terms). For account administration, security and legal compliance, we are the controller.
Legal bases (GDPR / UK GDPR). Contract (providing the service), legitimate interests (security, reliability, preventing abuse, which we balance against your rights), legal obligation, and consent where you connect a platform or press AI assist. You may object to processing based on legitimate interests and withdraw consent at any time.
Complaints. You can lodge a complaint with your local data-protection authority. We would appreciate the chance to resolve it first.
California and similar laws. In the last 12 months we collected the categories in section 3 (identifiers such as email and IP address, internet activity such as session logs, and content you provide) for the purposes in section 5. We do not sell personal information, do not share it for cross-context behavioural advertising, and do not use or disclose sensitive personal information for purposes beyond providing the service. You may request access, deletion, correction and portability, and we will not discriminate against you for doing so.
Automated decisions. We make no decisions with legal or similarly significant effect about you by automated means.
15. Children
Postalu is for people aged 18 or over. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.
16. Changes to this policy
We may update this policy as the service or the law changes. The effective date and version at the top show the latest revision. For material changes we will notify operators in the application or by email before they take effect where practical. Continued use after a change means you accept the updated policy.
17. Contact
For questions, requests or complaints about this policy or how your information is handled:
Last updated October 12, 2026 · Version 3.4
