Privacy Policy

Last updated: November 2, 2026

This Privacy Policy explains how Postlify (“Postlify”, “we”, “us” or “our”) collects, uses, shares and protects personal data in connection with the Postlify social-media scheduling, publishing, analytics and team-collaboration platform (the “Service”) and the website at postlify.site (the “Site”). It applies to visitors to the Site, account holders, members of customer workspaces, and anyone else who interacts with us. By using the Site or the Service you acknowledge this Policy. For our contractual terms, see our Terms of Service.

1. Who We Are (Data Controller)

Postlify is the data controller for account, billing, customer-support, marketing and Service-usage data. For all privacy questions, requests and complaints you can reach us at support@postlify.site.

2. The Service in Brief

Postlify lets you connect social-media and chat channels and centrally schedule, publish, analyse and collaborate on content. The platform includes a calendar and scheduling engine, a media library, a publishing queue, analytics, optional AI-assisted content generation, team and workspace management, and integrations with third-party platforms. Some features depend on the platforms you choose to connect.

3. The Data We Collect

3.1 Account & identity data

• Name, email address, password (stored as a salted hash), profile picture, organisation name, role, language and timezone preferences.
• If you sign in via a social-login provider, the basic profile fields and email returned by that provider.
• Workspace and team membership, invitations sent and accepted, and the permissions granted within a workspace.

3.2 Connected platform data

When you connect a third-party social or messaging account to Postlify we receive and store, via that platform’s API:

• OAuth access and refresh tokens, the scopes you granted, the platform username and identifier, and account-level metadata (for example profile picture, follower counts, page IDs, channel IDs).
• Content and engagement data needed to provide the Service: posts you create or schedule, posts already published, comments, replies, post-level analytics (impressions, clicks, reach, video retention and similar), and audience-level aggregates the platform exposes.
• For Meta platforms (Facebook and Instagram), we access only the Pages and Instagram professional accounts you select when you connect them, and only the permissions you approve in Meta’s consent screen.
• For YouTube, the Service uses YouTube API Services. Your use of those features is also subject to the YouTube Terms of Service and the Google Privacy Policy. You can revoke access to your Google data at any time at https://security.google.com/settings/security/permissions.

3.3 Content you upload

Text, images, video, audio, captions, links, hashtags, schedules, prompts, comments, approval notes, calendar metadata and any other content you upload to or generate within the Service.

3.4 Billing data

If paid plans are offered, we process plan, subscription status, invoice history, billing email, billing address and tax identifiers. Card and bank-account details are collected and stored directly by our payment processor; we only receive a tokenised reference, the last four digits, the brand and the expiry month and year.

3.5 Logs, usage & device data

• IP address, user-agent, browser type and version, operating system, referrer URL, language preference, and approximate location derived from IP (country or region).
• Application telemetry: pages visited, features used, posts created, published or failed, API calls made, and error reports.
• Session and authentication data, including login timestamps, session tokens and security events (for example password changes).

3.6 Communications & support data

Messages you send to us by email, support requests, feedback and feature requests, and engagement metrics for any emails we send you.

3.7 Cookies & similar technologies

We use cookies and local storage for authentication, security and preferences. Disabling strictly-necessary cookies will break parts of the Service. You can manage cookies through your browser settings.

4. How We Use the Data & Legal Bases

We process the data described above for the purposes below. Where the GDPR (or UK GDPR) applies, the legal basis for each purpose is shown in brackets.

• Provide the Service — authenticate users, create and manage your account and workspaces, store and publish your content to connected platforms, return analytics, and provide customer support. (Performance of contract.)
• Bill and collect payment — issue invoices, manage subscriptions, prevent payment fraud, comply with tax law. (Performance of contract; legal obligation.)
• Secure the Service — detect and prevent abuse, fraud, account takeover, brute-force attacks and spam; investigate incidents; enforce the Terms. (Legitimate interests in keeping the Service safe; legal obligation.)
• Operate, maintain and improve the Service — debug, monitor uptime, measure performance and build aggregated usage analytics. (Legitimate interests.)
• Communicate with you — send service-related messages (security alerts, post-failure notices, confirmations) and, where you have opted in or where permitted, other communications. (Performance of contract; consent or legitimate interests.)
• Comply with law — respond to lawful requests, enforce our rights, defend claims. (Legal obligation; legitimate interests.)

We do not use the content of your scheduled posts, your connected-platform content, or your private messages to send you advertising, and we do not sell that data.

5. AI-Assisted Features

The Service can offer optional AI features that generate or rewrite captions, hashtags, image prompts and summaries. These features are only active if enabled for your workspace. When used, the prompts and inputs you choose to include are sent to the AI provider that powers the feature, acting as our sub-processor. AI outputs are generated probabilistically and may be inaccurate; you remain responsible for reviewing them before publishing.

6. Postlify as Controller vs Processor

For account, billing, Site analytics and security data, Postlify acts as a data controller.

For the content you publish through the Service and the personal data of your audience, followers, customers and message contacts that flows through Postlify on your instructions, Postlify acts as a data processor on your behalf, and you are the controller. You are responsible for having a lawful basis for that processing, for providing notices and obtaining consents from your end-users, and for honouring their rights. On request we will provide a Data Processing Agreement; email support@postlify.site to request it.

7. Who We Share Data With

We do not sell personal data and we do not rent it to third parties. We share data only with:

• Service providers and infrastructure — companies that provide cloud hosting and storage, database and backup services, email delivery, payment processing, error monitoring, analytics and (if you use AI features) AI-model providers. We require them to protect the data and to process it only on our instructions and for the agreed purposes. You can ask for the current list by emailing support@postlify.site.
• Connected third-party platforms — when you schedule or publish content, we transmit it to the platform you selected (for example Facebook, Instagram, TikTok, YouTube, X, LinkedIn); when you request analytics, we receive it from that platform. Each platform’s own privacy policy governs what it does next.
• Other members of your workspace — content, schedules, comments and approval activity are visible to the other people in the workspaces you join, according to the role and permissions assigned to them.
• Professional advisors — accountants, auditors, lawyers, insurers and similar advisors, under confidentiality.
• Authorities — when we are legally required to disclose data, or when disclosure is necessary to investigate or prevent fraud, abuse, security threats or harm to people.
• Successor entities — in the event of a merger, acquisition, financing, reorganisation or sale of assets, in which case we will require the recipient to honour this Policy or provide notice of any new policy.

8. International Data Transfers

Our servers and service providers may be located in countries other than your own. Where personal data subject to the GDPR or UK GDPR is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (with the UK Addendum where it applies). You can ask which safeguard applies by emailing support@postlify.site.

9. Data Retention

• Account data — kept while your account is active. After you close your account, we delete or anonymise your data unless the law requires us to keep it.
• Content, media and connected accounts — kept while you use Postlify. Content you delete and accounts you disconnect are no longer shown or used.
• OAuth tokens — kept while the connection is active; a disconnected account’s tokens are no longer used. You can disconnect a platform at any time from your account settings.
• Billing records — retained for the period required by tax and accounting law (typically 7 years).
• Logs and error reports — kept for a limited period needed for security and troubleshooting.
• Backups — our databases are backed up regularly; deleted data leaves the backups as they are replaced.

Where retention is required for legal, regulatory, dispute-resolution or fraud-prevention reasons, we may keep data longer than the periods above.

10. Security

We maintain administrative and technical safeguards designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include TLS on connections to the Service, passwords stored only as salted hashes, access to a workspace only for its members, regular database backups, and error monitoring. No system is fully secure, and we cannot guarantee absolute security.

11. Your Rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy in a portable format;
• request correction of inaccurate or incomplete data;
• request deletion of your data, subject to retention obligations;
• object to or restrict certain processing, including direct marketing;
• withdraw consent where processing is based on consent (without affecting the lawfulness of processing already carried out);
• opt out of the “sale” or “sharing” of personal information — Postlify does not sell personal data and does not share it for cross-context behavioural advertising;
• lodge a complaint with your local data-protection supervisory authority.

Most account changes can be made by signing in and editing your profile, billing or workspace settings, or by disconnecting a platform from the integrations page. To exercise rights that cannot be handled in-product, email support@postlify.site. We will respond within the timeframe required by applicable law (typically 30 days, extendable for complex requests). We may need to verify your identity before acting on a request. We will not discriminate against you for exercising your rights.

If your request concerns data that a business customer controls in its Postlify workspace (Section 6), we pass it to that customer and tell you so; the customer answers it.

12. Deleting Your Data and Disconnecting Meta Accounts

You can disconnect a Facebook Page or Instagram account at any time from the integrations page in Postlify, or by removing the app in your Facebook settings under Settings & privacy → Settings → Apps and Websites. To have your Postlify account and the data associated with it deleted, email support@postlify.site from the address on your account; we will confirm and complete the deletion within 30 days.

13. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you the rights summarised in Section 11, including the right to know what categories of personal information we collect and why (described in Sections 3 and 4), the right to delete, the right to correct, the right to limit the use of sensitive personal information, and the right not to be discriminated against for exercising your rights. Postlify does not sell personal information and does not share it for cross-context behavioural advertising. To exercise your California rights, email support@postlify.site.

14. Children

The Service and the Site are intended for business use and are not directed to children. We do not knowingly collect personal data from children under the age of 18. If you are a parent or guardian and believe a child has provided us with personal data, please contact us at support@postlify.site and we will delete it.

15. Marketing & Cookie Choices

You can unsubscribe from marketing emails at any time using the unsubscribe link in any such email. Unsubscribing does not stop transactional and account-related emails, which are necessary while your account is active. You can manage cookie preferences through your browser settings.

16. Third-Party Sites and Services

The Site and the Service link to and integrate with third-party services. Their handling of your data is governed by their own privacy policies, not this one. We encourage you to review the privacy policy of any platform you connect to Postlify, including the Google Privacy Policy at https://policies.google.com/privacy for YouTube integrations and Meta’s Privacy Policy at https://www.facebook.com/privacy/policy for Facebook and Instagram.

17. Changes to this Policy

We may update this Privacy Policy from time to time. If a change is material we will provide reasonable notice (for example by email or in-product notice) before it takes effect. The date the Policy was last updated is shown at the top of this page; we encourage you to review it periodically.

18. Contact Us

For privacy questions, requests or complaints, email support@postlify.site.