Your data, your rights

1. Data Controller

The data controller for all personal data collected via the Postly service is:

Postly Technologies, Inc.
Email: privacy@postly.app

2. Data We Process

We process the following categories of personal data:

• Account data — name, email address, and password hash collected at sign-up.
• Billing data — payment method tokens (we never store raw card numbers; these are held by Polar.sh).
• Email content — messages sent and received through the Postly SMTP/IMAP service while stored on our servers.
• Usage data — delivery logs, open/click events, and API request metadata used to operate and improve the service.
• Technical data — IP address, browser type, and session identifiers for security and fraud prevention.

3. Lawful Basis for Processing

• Performance of a contract (Art. 6(1)(b)) — processing your account, email, and billing data is necessary to deliver the service you signed up for.
• Legitimate interests (Art. 6(1)(f)) — fraud detection, security monitoring, and product analytics to improve Postly.
• Consent (Art. 6(1)(a)) — marketing communications (you can unsubscribe at any time).
• Legal obligation (Art. 6(1)(c)) — retaining billing records as required by tax and financial regulations.

4. Your Rights

Under the GDPR you have the following rights. To exercise any of them, email privacy@postly.app or use the Data settings page in your dashboard. We will respond within 30 days.

You also have the right to lodge a complaint with your local supervisory authority (e.g. the ICO in the UK, CNIL in France).

5. Retention

• Account data is retained for the lifetime of your account, plus 30 days after deletion for recovery purposes.
• Email content is stored for as long as your account is active. On account deletion, email data is purged within 30 days.
• Billing records are kept for 7 years as required by financial regulations.
• Security logs (IP addresses, access logs) are retained for 90 days.

6. International Transfers

Some of our sub-processors operate in the United States. Where data is transferred outside the EEA, we rely on the EU–US Data Privacy Framework and Standard Contractual Clauses (SCCs) as the lawful transfer mechanism. A copy of the SCCs used with any sub-processor is available on request.

7. Sub-Processors

We use the following sub-processors. We will notify you at least 10 days before adding or replacing a sub-processor.

8. Data Protection Officer

Postly has appointed a Data Protection Officer (DPO). You can contact our DPO at:

DPO, Postly Technologies, Inc.
Email: dpo@postly.app

We aim to respond to all DPO enquiries within 10 business days.