Privacy Policy

Last updated

This policy explains what data Postuva collects, why, who it's shared with and how to delete it. The short version: we use your data to publish your posts and run your account, we encrypt access to your social accounts, and we never sell your data.

1. Who we are

Postuva (“we”, “us”) is an online service for planning and publishing social media posts, operated by Postuva. We are the data controller for the personal data described in this policy. For posts and media you upload, we act on your instructions and process them only to provide the service.

2. What data we collect

  • Account data: your name, email address and a hash of your password (we never store the password itself).
  • Workspace data: workspace names, timezones, team members and their roles.
  • Connected accounts: when you connect a social network, we receive an access token (and, for some networks, a refresh token) plus basic profile information such as the account name, handle, profile picture and account ID. For Facebook Pages, LinkedIn Pages, Pinterest boards, Tumblr blogs and Google Business locations, we also receive the list of pages, boards, blogs or locations you manage, so you can choose where to post.
  • Credentials you enter: for networks that use app passwords, bot tokens, webhook URLs or API keys (Bluesky, Mastodon, Telegram, Discord, Slack, WordPress, DEV, Hashnode, Lemmy, Nostr, Listmonk), we store what you enter. For Lemmy we use your password once to sign in and do not store it.
  • Content: the posts you write, the media you upload, schedules, and the results we receive when a post is published (post IDs, links and error messages).
  • Billing data: your plan, billing period and the customer and subscription references from our payment provider. Card details are entered on Paystack's page and never reach our servers.
  • Technical data: IP address, browser type and request logs kept by our hosting provider for security and debugging.
  • Website statistics: on our public pages we count page views, the referring website and daily unique visitors without cookies. A visitor is counted using a one-way hash of the day, IP address and browser that can't be reversed or linked across days; we don't store the IP address itself. We also use Vercel Web Analytics, which is likewise cookieless.

3. How we use your data

Our legal bases under the GDPR and UK GDPR are: performing our contract with you (running the service), our legitimate interests (security, preventing abuse, improving reliability), compliance with legal obligations (tax and accounting records) and your consent where we ask for it.

  • To publish your posts to the accounts you connected, at the times you choose, and to show you whether each post succeeded.
  • To refresh access to connected accounts before it expires, so scheduled posts keep working.
  • To generate network-specific versions of your posts when you use the AI features.
  • To run your account: sign-in, workspaces, team access, plan limits and billing.
  • To keep the service secure, prevent abuse and fix problems.
  • To email you about your account, failed posts and billing. We don't send marketing email without your consent.

4. Data from connected social networks

We only request the permissions needed to publish on your behalf and identify the account you connected. We use data received from each network solely to provide Postuva's features to you: publishing your posts, showing which account a post goes to, and keeping the connection active. We do not use it for advertising, we do not sell it, and we do not use it to build profiles of you or your audience.

Google and YouTube. Postuva's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. By connecting YouTube you also agree to the YouTube Terms of Service; Google's handling of your data is described in the Google Privacy Policy. You can revoke Postuva's access at any time from your Google security settings.

Meta (Facebook, Instagram, Threads), TikTok, LinkedIn, X, Pinterest, Reddit and Tumblr. We follow each platform's developer terms. You can revoke access from that network's app settings or by disconnecting the channel in Postuva; either removes our ability to post.

Data from these networks is not used to train AI models, and it is only shared with the AI provider when you explicitly ask the AI to rewrite a post, in which case only the text of that post is sent.

5. Who we share data with

We use a small number of service providers (processors) who handle data on our behalf under contracts that require them to protect it:

  • Vercel (hosting, file storage for uploaded media, cookieless web analytics): United States and EU.
  • Neon (database): the region where our database is hosted.
  • Upstash (scheduling queue that triggers publishing): no personal content, only timing signals.
  • Paystack (payments): your email and payment details for subscriptions.
  • Anthropic (AI rewriting): the text of a post when you press an AI button. Anthropic does not use API data to train its models.
  • The social networks you connect, which receive the posts and media you schedule for them.

6. International transfers

Some providers process data outside your country, including in the United States. Where data leaves the EEA or UK, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or an adequacy decision such as the EU-US Data Privacy Framework.

7. How we protect data

Access tokens and credentials for connected accounts are encrypted with AES-256-GCM before they are stored and are only decrypted at the moment a post is published or a connection is refreshed. Passwords are hashed with scrypt. All traffic uses HTTPS. Access to production systems is limited to the people who operate the service.

8. How long we keep data

  • Account, workspace and post data: for as long as your account exists.
  • Connected account tokens: until you disconnect the channel or delete your account, when they are deleted immediately.
  • Uploaded media: until you delete the post or your account.
  • Hosting request logs: up to 30 days.
  • Billing records: as long as tax and accounting law requires, usually up to 7 years.

9. Deleting your data

You can delete your account at any time from Settings → Delete account in the app. This permanently deletes your account, every workspace you own, their connected channels and tokens, scheduled posts and uploaded media. Posts already published remain on each network; delete them there if you want them removed. You can also email support@postuva.com and we will delete your data within 30 days. See data deletion for step-by-step instructions.

10. Your rights

Depending on where you live, you have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. Residents of the EEA and UK can complain to their local data protection authority. California residents have the rights described in the CCPA/CPRA, including the right to know and delete; we do not sell or share personal information for cross-context behavioural advertising.

To exercise any right, email support@postuva.com. We will respond within 30 days.

11. Cookies

We only use cookies that are strictly necessary: one that keeps you signed in and one that remembers which workspace you selected. We don't use advertising or tracking cookies, so there is no cookie banner.

12. Children

Postuva is not intended for anyone under 16, and we don't knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

13. Changes to this policy

If we make material changes, we will update the date at the top and email account owners before the changes take effect.

Contact

Postuva. Email support@postuva.com or support@postuva.com.