Postly

GDPR overview

Implementation is claimed in explicit terms. A dedicated GDPR page, last updated 8 March 2023, states that Postly is fully compliant, listing data protection by design, transparency, user rights, encryption and third-party compliance. A data processing agreement is published, effective 16 May 2026, defining controller and processor roles, and access, correction, export and deletion are handled self-service from the account. Concrete gaps remain. No Article 27 representative in the EU is designated and no data protection officer is named. No transfer mechanism is cited — no standard contractual clauses, no adequacy framework — only a commitment to appropriate safeguards where the law requires them. No subprocessor list is published. Both the terms and the privacy policy are governed by Delaware law. The claim of full compliance is therefore broader than the evidence published alongside it.

Who owns the data?

Customers keep ownership of what they upload — the terms state that you retain all ownership rights to your content. In return, Postly Technologies, Inc. receives a non-exclusive, worldwide, royalty-free licence to use, reproduce, modify, adapt, publish, translate, distribute and display that content for the purpose of providing and improving the service. Under the data processing agreement the customer is normally the controller and Postly the processor, acting only on documented customer instructions and free to suspend an instruction it believes unlawful. Data may also reach corporate affiliates, service providers, and an acquirer in the event of a sale or merger.

Reuse rights

Customers supply the content, so their own reuse is not gated: they keep ownership and can export, republish and repurpose their material freely, which is what the platform exists to do on their behalf across the destinations they choose. What the vendor may do is narrower. The licence granted in the terms is tied to providing and improving the service, and anonymised, aggregated customer data may be used for research and product improvement. Google Workspace API data is explicitly carved out: Postly states it does not use it to develop, improve or train generalised AI or ML models, and does not pass it to third-party AI tools. Google AI and OpenAI are named as LLM providers. Outside that carve-out no general position on training customer content is stated, and no opt-out is documented, so the stance is recorded as unclear. Content published to a connected network then falls under that network's own terms, which the customer is responsible for reviewing. Customers are also barred from using the AI output to build datasets for training competing models.

Data retention & training

Hosting summary

No hosting country or region is disclosed. The privacy policy states that information may be transferred to offices, personnel or third parties located throughout the world and may be viewed and hosted anywhere in the world, including countries without laws of general applicability regulating such transfers. The data processing agreement adds that customer data may be processed in any country where Postly, its affiliates, service providers or subprocessors operate, with appropriate safeguards used where the law requires them; no mechanism is named. Subprocessors are authorised by category — hosting, infrastructure, analytics, support, payment, email, storage, communications and integration — but never listed. The only observable technical detail is that the domain is served behind Cloudflare on an anycast address, which locates a CDN node rather than the data itself. Declared safeguards include access controls and authentication, encryption in transit where supported, role-based production access, monitoring and logging, vendor security review, and backup and recovery. An information security programme is published, effective 31 July 2026 and reviewed at least annually, but no independent certification is claimed. Jurisdiction is Delaware.