Privacy Policy

Data we collect

• Account data: email, password hash, sign-in timestamps.
• Content you create: brand profiles, email campaigns, subscriber lists you upload.
• Usage data: technical logs such as IP address and user agent, used for security and to operate the service.
• Analytics data (only with your consent): pages you visit, actions such as signing up, creating an email or starting a subscription, device and browser type, how you arrived at our website, approximate location, and a pseudonymous account ID when you are signed in.
• Payment and billing data: name, email, billing address, and subscription status, processed by Stripe. We never store full card numbers — these are handled solely by Stripe.
• Cookie data: see our Cookie Policy.

How we use your data

• To provide and secure the PostFly service (legal basis: performance of a contract).
• To send transactional emails you trigger, such as campaigns and account notifications (contract).
• To understand how our website and app are used so we can improve them, using Google Analytics and only if you accept analytics cookies (legal basis: consent, which you can withdraw at any time).
• To comply with legal obligations.

Who we share data with

We share the minimum necessary data with service providers who process it on our behalf:

• Supabase — authentication and database hosting.
• SendGrid — transactional and marketing email delivery you initiate.
• Anthropic — AI processing for brand analysis and email generation.
• Firecrawl — fetches and parses public web pages of URLs you submit to power Brand DNA extraction.
• Stripe — payment processing, subscription billing, and billing addresses.
• Vercel — application hosting and delivery network; processes request metadata such as IP addresses.
• Google (Google Analytics) measures how our website and app are used, only if you accept analytics cookies. Google does not receive your name, your email address or the content of your emails.
• HubSpot — optional CRM contact import. Data is exchanged only if you choose to connect your HubSpot account.

We never sell your personal data.

Internal access

A small number of authorized PostFly staff may access your account data (including email address, campaigns, and usage statistics) for operations, support, and abuse prevention. All such access is recorded in an internal audit log that we review regularly.

International transfers

Some of our providers are located outside the European Economic Area. Where that is the case, we rely on an adequacy decision (such as the EU-U.S. Data Privacy Framework, for providers certified under it), Standard Contractual Clauses, or equivalent safeguards to protect your data.

Retention

We retain your account data for as long as your account is active. If you delete your account, we delete or anonymize your data within 30 days, except where longer retention is required by law. Two exceptions: payment and invoice records are kept for as long as Norwegian bookkeeping law requires, and where a recipient on one of your lists has opted out, we retain a minimal record (the email address) for as long as your account is active — this is necessary to keep honoring that opt-out and to prevent the address being re-added by a later import.

Analytics data in Google Analytics is deleted automatically after 14 months.

Your rights

• Access, correct, or export your data.
• Delete your data ("right to erasure").
• Restrict or object to processing.
• Withdraw consent at any time — manage cookie preferences.
• Lodge a complaint with your local data protection authority.

Security

We use industry-standard technical and organizational measures, including encryption in transit (TLS), encryption at rest for sensitive fields, and least-privilege access controls.

Contact

For privacy questions or to exercise your rights, contact privacy@postfly.no.