Privacy Policy

The data controller is Individual Entrepreneur Leonid Iakovlev (Georgia, ID 306405253), Police Street I Dead End N5, Floor 2, N4a, Samgori District, Tbilisi, Georgia. Contact: hello@postmately.com.

Postmately (“Postmately”, “we”, “us”) is an early-access social content operations service at postmately.com. This policy explains what data the service collects, why, how long it is kept, and how you remove it. Before paid processing begins, the contracting documents will identify the legal operator and data controller. Questions: hello@postmately.com.

1. Data we collect

Category	What it is	Why we need it
Account data	Email address, password hash, organisation name, time zone.	To create and secure your account.
Billing data	When billing is enabled: billing name and address, tax information, order status, provider customer or subscription identifiers, payment method brand and last four digits. Complete card details are handled by the payment provider and are not stored by Postmately.	To administer orders, subscriptions, refunds, fraud prevention and accounting.
Connected channel data	For each social account you connect: the platform’s account ID, username, display name, avatar URL, account type.	To show you which accounts are connected and to address posts to the right one.
Access tokens	OAuth access and refresh tokens issued by the platform when you authorise Postmately.	To publish on your behalf and read back the metrics of your own posts.
Content you create	Post text, images and video you upload, scheduled times, tags and drafts.	To store your queue and publish it at the time you chose.
Content Studio data	Campaign briefs, source media, edit and localisation instructions, render specifications, generated variants and approval history.	To create the content variants you request and preserve the campaign workflow.
Managed Distribution data	Campaign, market and channel instructions, content approvals, operation status, service evidence and issue history.	To perform and report the managed publishing operations agreed for a pilot.
Performance data	Public metrics of posts published through Postmately: views, likes, comments, shares.	To show analytics for your own content.
Technical logs	IP address, browser user agent, timestamps, error traces.	Security, abuse prevention and debugging. Retained 30 days.

We do not collect special categories of personal data, we do not buy data about you from third parties, and we do not build advertising profiles.

2. How we use it

• To operate the service you asked for: storing your queue, publishing it, reporting results.
• To create approved content variants and perform managed publishing operations you requested.
• To keep accounts secure and to investigate abuse.
• To contact you about the service — outages, changes to these terms, billing. Marketing email only if you opt in, and every message has an unsubscribe link.

We publish only content you scheduled, explicitly approved, or authorised under a written Managed Distribution workflow. We do not sell, rent or trade personal data, and we do not use your content to train our own machine learning models. If an optional AI feature sends content to an external provider, the product will identify that processing and this policy will list the provider category before the feature is enabled.

3. Legal bases (GDPR)

• Performance of a contract — account data, connected channels, tokens, your content: without them the service cannot work.
• Performance of a contract — Content Studio instructions and Managed Distribution operation records when you request those services.
• Legitimate interests — security logging and abuse prevention.
• Consent — optional marketing email, withdrawable at any time.

4. Platform data and limited use

When you connect a social account, Postmately requests only the permissions needed to list your accounts, publish content, and read the metrics of posts published through Postmately. You grant those permissions on the platform’s own consent screen, and you can revoke them at any time in the platform’s settings or by disconnecting the channel in Postmately.

Google and YouTube

Postmately’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through Google APIs is used only to provide and improve the user-facing features described here, is never transferred to others except as required to provide those features, is never used for advertising, and is never read by humans except with your explicit consent, for security purposes, to comply with applicable law, or where the data is aggregated and anonymised.

Postmately uses the YouTube API Services to upload videos to the channels you connect and to read back their statistics. By using these features you agree to the YouTube Terms of Service. Google’s own handling of your data is described in the Google Privacy Policy. Statistics retrieved from YouTube, and the channel name and picture we show, are refreshed or deleted at least every 30 days. You can revoke Postmately’s access to your Google account at any time at myaccount.google.com/permissions. When you disconnect or delete a YouTube channel in Postmately, we revoke our access on Google’s side as well.

Deleting YouTube data: deleting a YouTube channel in Postmately removes the data we obtained for it through the YouTube API Services immediately. After you disconnect a channel or revoke access at Google, that data is deleted within 30 days. You can also ask us at hello@postmately.com to delete it, and we do so within 7 days.

Meta (Facebook, Instagram, Threads)

Postmately accesses the Facebook Pages, Instagram professional accounts and Threads profiles you select, in order to publish content and read the insights of posts it published. We do not access your personal Facebook profile, friend list, private messages, or content posted outside Postmately beyond what those permissions cover. Revoke access in Facebook Settings → Business Integrations, or via our deletion instructions.

TikTok

Postmately uses the TikTok Content Posting API to publish videos and photos to the TikTok accounts you connect, and the Display API to show your account name and the results of those posts. Content is only published after you confirm it in Postmately, and TikTok’s own terms and content rules apply to everything published.

Other platforms

LinkedIn, Pinterest, Bluesky and Mastodon are used the same way: publish what you scheduled, read back the results of those posts, nothing else.

5. Where data is stored and how it is protected

• Servers are located in the European Union (Germany).
• All traffic runs over HTTPS (TLS 1.2+).
• OAuth tokens are encrypted at rest with AES-256-GCM; the key is held outside the database.
• Postmately account passwords are stored as scrypt hashes. OAuth platform passwords are entered only on the platform’s own screen. If a platform such as Bluesky uses a revocable app password, it is submitted securely for session exchange and is not retained after that exchange.
• Access to production data is limited to the operators of the service and logged.

6. Sharing

We share data only with the infrastructure providers needed to run the service, each acting as a processor under contract:

Provider	Purpose	Location
Hetzner Online GmbH	Servers, database, media storage	Germany (EU)
Netlify, Inc.	Hosting of this website and the dashboard, early-access form submissions	US, EU SCCs
The social platforms you connect	Publishing your content, at your instruction	Per platform

Optional Content Studio features may require additional media, translation, voice or AI processors. We will add the relevant provider and transfer information here before sending customer content to it; no future integration listed on the product roadmap is automatically authorised by this policy.

Self-serve payments are not currently enabled. Before a checkout goes live, this policy and the checkout will identify the payment provider. Card details will be collected by that provider through its secure checkout; Postmately will receive only the billing and transaction information needed to operate the account and will not store complete card numbers or security codes.

We also disclose data if legally required, and we will tell you unless the law forbids it.

7. Retention

• Disconnect a channel — its access and refresh tokens are deleted immediately.
• Delete a channel — the channel, its schedule and its unpublished posts are deleted immediately.
• Delete your account — everything is erased within 30 days, backups included.
• Technical logs — 30 days.
• Billing records — kept as long as tax law requires, without content data.

Content already published to a social platform lives on that platform and is governed by its rules; deleting your Postmately account does not remove posts already published. Delete those on the platform itself.

8. Your rights

You can access, correct, export, restrict or erase your data, object to processing, and lodge a complaint with a supervisory authority. Most of it is one click inside the app; for the rest write to hello@postmately.com and we answer within 30 days. See also Data deletion.

9. Cookies

Postmately sets one cookie: a signed, httpOnly session cookie that keeps you logged in. It is strictly necessary, so it needs no consent banner. We run no advertising or third-party tracking cookies.

10. Children

The service is for businesses and adults. It is not directed at children under 16, and we do not knowingly collect their data.

11. Changes

If this policy changes materially we email account holders and update the date above at least 14 days before the change takes effect.

12. Contact