Privacy Policy

• We collect what we need to schedule and publish your social media posts, and nothing more.
• We never sell your personal information and we don’t use it for advertising.
• Access tokens for your social accounts are encrypted and are never sent to your browser.
• We only publish what you create or schedule, to the accounts you connect.
• You can disconnect any social account at any time, and ask us to delete everything.

We use information to:

1. Provide the Service: create your account and workspaces, store your posts and media, and publish them to the accounts you connect at the times you choose.
2. Show you analytics where a connected platform provides them through the permissions you approved.
3. Keep your connections working, for example by refreshing access tokens before they expire.
4. Enforce plan limits, process subscriptions and prevent abuse.
5. Secure the Service, detect fraud and fix problems.
6. Communicate with you about your account, security and important changes.
7. Comply with legal obligations.

Legal bases (EEA/UK users): we process data to perform our contract with you (items 1–4 and 6), for our legitimate interests in running a secure and reliable service (item 5), and to comply with law (item 7). Where we rely on consent, for example connecting a social account, you can withdraw it at any time by disconnecting.

We do not:

• sell or rent personal information;
• use data from social platforms for advertising, profiling or any purpose other than providing the features you use;
• transfer platform data to data brokers or information resellers;
• let humans read your connected-account data, except (a) with your permission, (b) when necessary for security or to investigate abuse, (c) to comply with law, or (d) when it has been aggregated and anonymized for internal operations.

Each platform shows you the exact permissions before you approve them. Here is what PostGic requests and why.

We share information only as needed to run the Service:

• With the social platforms you connect, to publish the content you schedule and, where that platform’s API and your approved permissions allow, to read metrics for your account or posts.
• With service providers who process data on our behalf, under contracts that require them to protect it:

• With members of your workspace, who can see the workspace’s posts, media and connected channels.
• For legal reasons, if required by law or to protect the rights, safety and security of our users, the public or PostGic.
• In a business transfer, such as a merger or acquisition, in which case this policy continues to apply to your information.

• All traffic is encrypted in transit with HTTPS/TLS.
• Social access tokens are encrypted at rest with AES-256-GCM, are only decrypted on our servers at the moment of publishing or refreshing, and are never exposed to the browser.
• Uploaded media is stored in a private bucket. Files are accessed through short-lived signed links.
• Access to production systems is restricted to authorized personnel.

No system is perfectly secure, but we work to protect your information and will notify you and the relevant authorities of a breach where the law requires.

• Account and workspace data is kept while your account is active.
• Posts and media are kept until you delete them or your account is deleted.
• Social access tokens are deleted immediately when you disconnect that account. Incomplete connection attempts expire and are deleted automatically.
• Analytics data is kept while the channel stays connected and is deleted when you disconnect it.
• Billing records are kept as long as tax and accounting laws require.
• Server logs are kept for up to 30 days.
• After account deletion, data is removed from our live systems within 30 days and from backups within a further 30 days.

Depending on where you live (including under GDPR, UK GDPR and California law), you may have the right to:

• access the personal information we hold about you;
• correct inaccurate information;
• delete your information;
• export your information in a portable format;
• object to or restrict certain processing;
• withdraw consent at any time.

To exercise these rights, email privacy@postgic.com from the address on your account. We’ll respond within 30 days. We won’t discriminate against you for exercising them. You may also complain to your local data protection authority.

You can delete your data at any time:

1. Disconnect a social account: in PostGic, open Channels, choose the account, and select Disconnect. Its access tokens and analytics are deleted immediately, along with posts that were only for that account.
2. Delete posts or media: delete them from the post list or media library.
3. Delete your whole account: email privacy@postgic.com from your account’s email address with the subject “Delete my account”. We’ll confirm and delete your account, workspaces you own, posts, media, connected accounts and tokens within 30 days, and send a confirmation.
4. Remove access on the platform side: you can also revoke PostGic from each platform’s settings (see Section 4). When we detect revoked access, we stop using the connection and you can delete it in PostGic.

Facebook and Instagram users can follow these same steps to request deletion of data PostGic received from Meta.

We and our providers may process information in countries other than yours, including the United States. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

The Service is not intended for anyone under 16, and we don’t knowingly collect information from children. If you believe a child has given us information, contact us and we’ll delete it.

We may update this policy from time to time. If changes are significant, we’ll notify you by email or in the app before they take effect. The “Last updated” date above shows when it last changed.

Postgic
191, Kurukulawa, Sri Lanka
Email: privacy@postgic.com