Privacy policy

_Last updated: 17 October 2026. This is a template prepared for legal review; it has not yet been reviewed by counsel._

Who we are

Postwoo ("we", "us") provides a social media scheduling, review management and reporting service for agencies and businesses. This policy explains what data we process when you use Postwoo and how we protect it.

Data we process

• Account data: your name, email address and password hash; organization and team membership.
• Client data you enter: client names, settings, posts, media you upload and replies you write.
• Platform data accessed through official APIs, with your authorization: the list of Pages, channels, profiles and business locations you choose to connect; posts you publish through Postwoo; reviews and your replies; performance metrics the platform makes available. We access only the scopes you grant.
• OAuth tokens issued by Google, Meta, LinkedIn, YouTube and TikTok. Tokens are encrypted at rest and never shown in the interface or returned by our API.
• Usage and audit data: actions taken in Postwoo (who did what and when), IP addresses and technical logs needed to run and secure the service.

How we use data

To provide the service you asked for: publishing posts at the time you schedule, syncing reviews so you can reply, collecting metrics so you can report. We do not sell data, we do not use client data to train models, and we do not use platform data for advertising.

Google API Services

Postwoo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Business Profile data only to display it to you, publish the posts and replies you request, and compile the reports you ask for.

Sharing

We share data with the platforms you connect (to publish or reply), with infrastructure providers that host the service, and with third-party tools you explicitly connect through API credentials or webhooks you create. We may disclose data when required by law.

Retention and deletion

Posts, reviews and metrics are kept while your workspace is active so your history and reports remain accurate. Disconnecting a platform deletes its tokens immediately.

You can delete data yourself in Settings → Data & privacy (or a client's Data tab):

• A client (workspace admins and owners): the client's posts, media files, reviews and replies, metrics, locations, connected accounts and their tokens are deleted. Where the platform offers it, we revoke Postwoo's access at the platform first; where it does not (currently Pinterest and Threads), we delete the stored token and tell you to remove the app in that platform's settings.
• The whole workspace (owners only): everything in the workspace, including team memberships. Team members who belong to no other workspace have their accounts deleted. We do not delete your customer record or invoices at our payment processor (Stripe), which keeps them as required for tax and accounting; only our link to it is removed. Cancel any active subscription before the deletion runs.
• Your own account (anyone): your profile, login, memberships, notifications and devices are deleted. Records of actions you took (audit logs) and comments you wrote stay with the workspace, with your name and email replaced by "Deleted user". If you are the only owner of a workspace, make someone else an owner or delete the workspace first.

Before anything is scheduled you see exactly what will be deleted, anonymised or kept. Every deletion waits a 7-day grace period (an instance operator may set 0–30 days) during which workspace owners are emailed and can cancel; it then runs automatically and owners are emailed again. Data is removed from our active systems when the deletion runs — at the latest within 30 days of your request — and from backups as they rotate out (our backups are kept for a limited period and are not restored except for disaster recovery). We keep a deletion receipt containing only a one-way code for the deleted item and the number of records removed, so we can show the deletion happened without keeping the data. Posts already published to social platforms stay on those platforms until you delete them there.

Security

Encryption in transit and at rest for secrets, role-based access, scoped API credentials, audit logs and regular backups. See our security page.

Your rights

Depending on where you live you may have rights to access, correct, export or delete your data.

• Access and portability. "Download my data" in Settings → Data & privacy gives you, within minutes, a ZIP file with your profile, memberships, comments, notifications and the record of actions you took, as machine-readable JSON with a plain-language README. Workspace admins can export the whole workspace or a single client the same way, including uploaded media. Passwords, access tokens and other secrets are never included. Each export can be downloaded once, within 24 hours, after which we delete our copy.
• Correction. You can change your name and password in Settings → Profile; workspace admins can correct client details.
• Deletion. See "Retention and deletion" above.

If you work for one of our customers' clients, or are a reviewer whose review appears in Postwoo, the agency using Postwoo decides about that data; we will pass your request on to them. You can always contact us at privacy@postwoo.app; we answer within one month.

Changes

We will post changes here and, for material changes, notify workspace owners by email.