Privacy Policy

Who we are

Postlayer (at postlayer.ai and the API at api.postlayer.ai) is operated by PAULTECH, a company registered in Romania, which is the data controller for the information described here. Contact: [email protected].

What we store

Your Social account

• Your email address and, if your sign-in provider shares it, your name. You sign in with Google or with an email link; sign-in is handled by Supabase Auth. We never see your Google password.
• Your workspaces, your role in them, and the names you give them.
• API keys you create, stored only as a one-way hash (the key itself is shown once and not kept).

Social accounts you connect

When you connect a Facebook Page, Instagram professional account, YouTube channel, X account or LinkedIn profile or page, we store:

• The platform's ids for the account, its display name and its avatar image URL.
• For Facebook and Instagram, the id of the Facebook user who authorized the connection, so we can act on Meta's deauthorization and data-deletion requests.
• The OAuth access and refresh tokens the platform issues, and the permissions (scopes) granted. Tokens are encrypted at rest with AES-256-GCM before they reach the database, are only decrypted on our servers to call the platform on your behalf, and are never returned by our API or shown in the app.

Content you create

• Post text, per-platform variations, labels, schedules and publishing options.
• Images and videos you upload. These are stored in object storage and served from a URL that is not listed anywhere but is not secret either, because Facebook, Instagram and the other platforms must download the file to publish it.
• The result of each publish: the id and link of the published post, or the error the platform returned.

Data fetched from the platforms

• Engagement metrics for posts published through Postlayer (likes, comments count, shares, saves, views, impressions, reach, clicks) and account-level counts (followers, following, number of posts), collected at intervals after publishing.
• We do not read your private messages, your friends lists, or content you did not publish through Postlayer.

Integrations you configure

• Webhook endpoints you add (URL, signing secret, selected events), and the event deliveries we send to them.

Technical logs

Our servers keep short-lived operational logs (request paths, status codes, errors, IP addresses) to run and secure the service. We do not use advertising trackers or third-party analytics on the app.

Why we use it

• To sign you in and keep your workspace separate from everyone else's.
• To publish and schedule posts on your behalf, on the accounts you connected, when you tell us to.
• To show you how your published posts and accounts perform.
• To notify your systems through the webhooks you set up.
• To keep the service secure, debug failures and prevent abuse.

The legal bases are performance of our contract with you (providing the service you asked for) and our legitimate interest in operating it securely. We do not use your data for advertising and we do not sell it.

Where it is stored

• Supabase (database, sign-in and file storage), hosted on AWS in the eu-central-1 region (Frankfurt, Germany).
• DigitalOcean (application servers that run the API and the background publisher), in the Frankfurt region.

Your data stays in the EU at rest. When you publish, the content is sent to the platform you chose, which may process it outside the EU under its own terms.

Who we share it with

We share your content only with the platforms you connect, and only to do what you asked: publishing a post sends its text and media to that platform; reading metrics sends the post id and your token to that platform. We do not sell your data, and we do not share it with advertisers or data brokers.

Sub-processors that host or process data for us:

• Supabase Inc. — database, authentication, file storage (AWS eu-central-1).
• DigitalOcean LLC — application hosting (Frankfurt).
• Google LLC — "Continue with Google" sign-in, if you use it.

The platforms you connect (Meta Platforms for Facebook and Instagram, Google for YouTube, X Corp., LinkedIn) receive data because you direct us to send it to them; their own privacy policies apply to what they do with it. We may also disclose data if the law requires it.

How long we keep it

• Platform tokens: until you disconnect the account, the platform revokes access, or you delete your Social account. Disconnecting stops all use of the token.
• Posts, media and metrics: until you delete them, or delete your Social account. When Meta tells us you removed the app or asked for deletion, we act on it as described on the data deletion page.
• Your account profile: until you delete your Social account.
• Operational logs: kept for a limited period (typically up to 30 days) and then discarded.
• Deleted data can remain in our hosting provider's encrypted backups until those backups roll over.

Your rights

Under the GDPR you can ask us to:

• give you access to the personal data we hold about you;
• export it in a machine-readable format (we provide this on request, by email);
• correct it;
• delete it;
• restrict or object to how we process it.

Write to [email protected] and we will answer within 30 days. You also have the right to complain to the Romanian data protection authority (ANSPDCP, dataprotection.ro) or the authority where you live.

How to delete your data

• Disconnect an account: open Accounts in the app and choose Disconnect. We stop using its token immediately.
• Delete your Social account: Settings → Delete account. This removes your profile and every workspace you alone own, including its posts, media records, metrics, connected accounts and their tokens.
• From Facebook: remove Postlayer under Facebook Settings → Apps and Websites, and request deletion there; you will get a confirmation code you can check on our data deletion page.
• By email: write to [email protected] from the address you sign in with.

You can also revoke our access at any time from each platform's own settings.

Platform-specific terms

Facebook and Instagram

Our use of data from Meta's APIs follows the Meta Platform Terms and Developer Policies. We use Page and Instagram data only to publish the content you create, and to show you insights about it.

Google and YouTube

Postlayer's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use YouTube data only to upload the videos you choose and to show you their statistics; we do not use it for advertising, do not sell it, and do not let humans read it except with your consent, for security, or where the law requires.

By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and the Google Privacy Policy applies to Google's processing. You can revoke Postlayer's access at myaccount.google.com/permissions.

X and LinkedIn

Use of X and LinkedIn data follows their respective developer terms and is limited to publishing and post statistics.

Security

Connections are encrypted with TLS. Platform tokens are encrypted with AES-256-GCM using a key kept outside the database. Access to production systems is limited to the operator. No system is perfectly secure; if a breach affects your data we will tell you and the authorities as the law requires.

Children

Postlayer is not intended for anyone under 16.

Changes

If we change this policy we will update the date at the top, and for material changes we will tell you in the app or by email before they apply.

Contact

PAULTECH, Romania · [email protected]