Privacy Policy

1. Introduction

PostShuttle is the name of our social scheduling service for individuals and solo founders. It is owned and developed by PostShuttle. In this policy, "we," "us," and "our" mean PostShuttlein its capacity as operator of the Service. We are committed to protecting your privacy and complying with applicable data protection laws, including the GDPR where it applies. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our websites and applications ("Service"). Please read it carefully.

Data controller: PostShuttle is the data controller for personal data processed in connection with the PostShuttle Service. For privacy enquiries, requests to exercise your data protection rights (including subject access requests in the UK), and service-related legal questions, use only the PostShuttle channels listed in the Contact section below (for example privacy@postshuttle.com and the Contact page). Those channels are the designated way to reach us about the Service; messages are handled by or on behalf of PostShuttle.

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use the Service.

2. Information We Collect

2.1 Information You Provide to Us

We collect information that you provide directly to us, including:

• Account Information: Email address, password (hashed), and timezone preferences
• Profile Information: Any additional information you choose to provide in your account profile
• Content: Post text, scheduled times, destinations, and media you upload for publishing (for example images attached to posts)
• Payment Information: Billing address and payment method details (processed securely through our payment processor)
• Communication Data: Information you provide when contacting us for support or other inquiries

2.2 Information We Collect Automatically

When you use the Service, we automatically collect certain information, including:

• Usage Data: How you use the Service (features accessed, actions taken, approximate timing)
• Device Information: Device type, operating system, browser type, and coarse identifiers useful for security
• Log Data: IP address, access times, request paths, and diagnostic logs on our servers
• Cookies and Similar Storage: Browser cookies for authenticated sessions and browser local storage for non-sensitive preferences (see our Cookie Policy)
• Telemetry (optional): If you accept analytics in the cookie banner, error and performance data may be sent to Sentry to help us fix bugs
• Anti-abuse: When you use signup, login, or contact flows protected by hCaptcha, hCaptcha may process technical data according to its policy

2.3 Information from Third-Party Services

When you connect social media accounts to the Service, we may collect:

• OAuth tokens and credentials for your connected social media accounts
• Account information from connected platforms (as permitted by their APIs)
• Content and metadata from your social media accounts for scheduling purposes

3. Legal Basis for Processing (GDPR)

Under GDPR, we process your personal data based on the following legal bases:

• Consent: When you provide explicit consent (e.g., for marketing communications, cookies)
• Contract Performance: To fulfill our contractual obligations to provide the Service
• Legal Obligation: To comply with legal requirements (e.g., tax records, fraud prevention)
• Legitimate Interests: For security, fraud prevention, and service improvement (where our interests don't override your rights)

4. How We Use Your Information

We use the information we collect for various purposes, including:

• Service Provision: To provide, maintain, and improve the Service
• Account Management: To create and manage your account, process transactions, and send related communications
• Content Scheduling: To schedule and publish your content to connected social media platforms
• Communication: To send you service-related notifications, updates, and support communications
• Security: To protect the security and integrity of the Service and prevent fraud or abuse
• Analytics: To analyze usage patterns and improve the Service's functionality and user experience
• Legal Compliance: To comply with legal obligations and enforce our terms and policies
• Marketing: To send you promotional communications (with your consent, where required by law)

5. How We Share Your Information

We may share your information in the following circumstances:

5.1 Service providers

We may share your information with third-party service providers who perform services on our behalf, such as:

• Payment processing (Stripe)
• Transactional email (Sender.net)
• Cloud hosting, databases, and object storage (for example media for posts)
• Scheduled job delivery (for example Upstash QStash) so due posts can be processed securely
• Error monitoring (Sentry) when you have consented to analytics/telemetry cookies
• Bot protection (hCaptcha) on selected forms

These service providers are contractually obligated to protect your information and use it only for the purposes we specify.

5.2 Social media platforms

When you schedule content through the Service, we transmit your content and associated data to the social media platforms you have connected. This sharing is necessary to provide the Service and is subject to each platform's privacy policy.

5.3 Legal requirements

We may disclose your information if required by law, court order, or governmental regulation, or if we believe disclosure is necessary to:

• Comply with legal obligations
• Protect our rights, property, or safety
• Protect the rights, property, or safety of our users or others
• Prevent or investigate fraud or security issues

5.4 Business transfers

In the event of a merger, acquisition, reorganization, or sale of assets involving PostShuttle or the PostShuttle Service, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your information where required by law.

5.5 With your consent

We may share your information with third parties when you have given us explicit consent to do so.

6. Data Security

We implement appropriate technical and organizational security measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Secure password hashing using bcrypt
• Regular security assessments and updates
• Access controls and authentication mechanisms
• Secure storage of OAuth tokens and credentials

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

7. Data Retention

We retain your information for as long as necessary to:

• Provide the Service to you
• Comply with legal obligations
• Resolve disputes and enforce our agreements
• Maintain security and prevent fraud

When you delete your account, we will delete or anonymize your personal information, except where we are required to retain it for legal or legitimate business purposes.

8. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information, including:

8.1 Access and portability

You have the right to access and receive a copy of your personal information that we hold. In the UK this is often called a subject access request (SAR). Email privacy@postshuttle.com for assistance, or call GET /api/v1/gdpr/data-export (authenticated) if you use our API directly.

8.2 Correction

You can update or correct your account information at any time through your account settings.

8.3 Deletion

Request account deletion by emailing privacy@postshuttle.com or, if you use our API with your account token, DELETE /api/v1/gdpr/account. We honor requests subject to legal and operational requirements (for example retaining minimal billing records for tax or fraud prevention).

8.4 Opt-out

You can opt out of marketing communications by following the unsubscribe instructions in our emails or by contacting us directly.

8.5 Cookies and similar technologies

We use essential storage (including local storage for your session) and, only if you opt in via the cookie banner, optional analytics cookies/telemetry. You can change analytics consent through the banner or by clearing site data; see the Cookie Policy for detail.

9. Cookies and tracking technologies

We use cookies, local storage, and similar technologies as described in our Cookie Policy. Essential storage keeps you signed in and remembers your cookie choice; optional analytics (for example Sentry) runs only if you accept analytics in the banner.

• Essential: Required for security, session, and consent state
• Optional analytics: Error and performance telemetry when you choose "Accept analytics"

Blocking essential storage may prevent login or break core features.

10. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your country. By using the Service, you consent to the transfer of your information to these countries.

12. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including:

• The right to know what personal information we collect, use, and disclose
• The right to delete your personal information
• The right to opt-out of the sale of personal information (we do not sell personal information)
• The right to non-discrimination for exercising your privacy rights

13. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR), including:

• Right to Access (Article 15): Make a subject access request (SAR) by contacting us or call GET /api/v1/gdpr/data-access with your credentials
• Right to Data Portability (Article 20): Export machine-readable data via GET /api/v1/gdpr/data-export or by contacting us
• Right to Rectification (Article 16): You can update your account information through your account settings
• Right to Erasure (Article 17): Request deletion by email or via DELETE /api/v1/gdpr/account (authenticated)
• Right to Restrict Processing (Article 18): You can request that we limit how we process your data
• Right to Object (Article 21): You can object to certain types of processing
• Rights Related to Automated Decision-Making (Article 22): You have rights regarding automated processing

You can exercise these rights (including subject access requests) by contacting us using the information in the Contact section below (we will respond within the timeframes required by applicable law, typically within one month for access requests under UK GDPR or GDPR where those laws apply).

14. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party websites or services you visit.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated Privacy Policy on this page
• Updating the "Last updated" date
• Sending you an email notification (if you have provided an email address)
• Displaying a prominent notice on the Service

Your continued use of the Service after such changes constitutes your acceptance of the updated Privacy Policy.

16. Contact Us

For privacy, support, account, and other questions about the PostShuttle Service, contact us through: