Privacy Policy

1. Who we are

Eilon Udi, a sole proprietor, operating PostWide (“PostWide”, “we”, “us”), is the controller of the personal data described here, except where this policy says Paddle acts as an independent controller. You can reach us at eilon@devmod.co.

This policy covers the PostWide website at postwide.co and the PostWide app at app.postwide.co.

2. What we collect

Account data. Your name, email address and a password hash, or the identifier Google gives us if you sign in with Google. We also store your workspace settings and the invitations you send to teammates.

Your content. The photos, videos, captions, schedules, client and workspace names and notes you add to PostWide, and the results of each publish attempt.

Connected social accounts. When you connect an account (for example Instagram, Facebook Pages or X) the network gives us an access token plus basic profile details such as the account name and ID. Tokens are stored encrypted and are never shown in logs. We use them only to publish for you, check that the connection still works and show you its status.

Billing data. Payments are handled by Paddle, our merchant of record. Paddle collects your payment details and billing address. We receive your plan, subscription status, and transaction records such as amounts and dates. We never see your full card number.

Technical and security data. IP address, browser and device type, the time of requests, an audit log of actions taken in your workspace (who did what, and when), and error reports. These help us run the service, keep it secure and fix faults.

Cookies and local storage. We use a session cookie to keep you signed in and security cookies that protect against forged requests. Your browser also stores preferences such as light or dark theme. We do not use advertising cookies, and the marketing website does not run analytics or tracking scripts.

Messages to us. If you email us, we keep the message and our reply.

3. How and why we use it

We use personal data only for these purposes, each with a legal basis under the GDPR and UK GDPR:

• To provide PostWide: create your account, store your content, publish it on schedule and report the results. Basis: performance of our contract with you.
• To bill you and prevent fraud, including trial reminders and receipts. Basis: contract, and our legitimate interest in preventing abuse.
• To send service emails such as sign-in, invitations, publishing failures and security notices. These are not marketing. Basis: contract and legitimate interests.
• To secure and improve the service: monitoring, debugging, audit logs and abuse prevention. Basis: our legitimate interests in a reliable, secure product.
• To meet legal obligations such as tax and accounting records, and to respond to lawful requests. Basis: legal obligation.
• To send product news or marketing, only if you opt in. Basis: consent, which you can withdraw at any time.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

4. Data from connected networks

We request only the permissions a feature needs, such as publishing, reading basic profile details and checking publish results. We use data we receive from a network only to provide those features to you, we do not use it for advertising, and we do not sell it or transfer it to anyone except as needed to run the service or as the law requires. People at PostWide do not read it unless you ask for support, it is needed to investigate abuse or a security problem, or the law requires it.

PostWide’s use of information received from Google APIs, including YouTube, adheres to the Google API Services User Data Policy, including its Limited Use requirements. If you connect YouTube, the YouTube Terms of Service and the Google Privacy Policy also apply, and you can revoke PostWide’s access at any time in your Google security settings.

Data from Meta (Facebook, Instagram and Threads), TikTok, X, LinkedIn and other networks is handled under those networks’ platform terms and developer policies. You can remove PostWide’s access in each network’s settings, or by disconnecting the account in PostWide; if you remove it in the network, we treat the connection as ended and delete the stored tokens.

5. AI features

PostWide’s core is publishing content you already have. AI-assisted drafting is optional and off unless you turn it on. If you use it, the text you submit is sent to the AI provider to produce a result, and we will name that provider in this policy before the feature is available. We do not use your content to train AI models.

6. Who we share it with

We share personal data only with the following, and only as needed:

• Amazon Web Services: hosting, database and file storage, in the Stockholm region (eu-north-1), and Amazon SES, which sends our emails.
• Paddle: payments, tax and invoicing as merchant of record. Paddle is an independent controller of the billing data it collects and keeps transaction records as the law requires. See Paddle’s privacy notice.
• Sentry: error monitoring. Reports are meant to exclude your content and credentials.
• Google: only if you choose “Sign in with Google”.
• The social networks you connect: your posts and the content in them go to those networks because you asked us to publish there. Their own privacy policies then apply.
• Teammates in your workspace, who can see the content and activity you share with them.
• Authorities or advisers, where the law requires it or to protect rights, safety and our legal position, and a successor if PostWide is sold or merged (we would tell you first).

7. International transfers

Your data is stored in the European Union. Some providers named above, or their support staff, may process data in other countries including the United States. Where we transfer personal data out of the EEA or the UK, we rely on an adequacy decision (such as the EU–US Data Privacy Framework) or on Standard Contractual Clauses.

8. How long we keep it

We keep account and workspace data while your account is open.

When you delete your account we hold it for a 30-day grace period so you can change your mind, then permanently delete your workspaces, content, files and connection tokens, and remove your email from audit logs. Backups age out on their normal cycle.

When you disconnect a social account we delete its stored tokens straight away and ask the network to revoke them where it supports that.

Paddle keeps transaction records for as long as tax and accounting law requires, typically several years. Logs and error reports are kept for a limited time for security and debugging.

9. Security

Access tokens and secrets are encrypted, traffic is protected with TLS, and each customer’s data is isolated at the database level so one workspace cannot read another’s. No system is perfectly secure. If a breach affects your personal data we will notify you and the authorities as the law requires.

10. Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to processing, receive a portable copy, and withdraw consent. You can delete your account yourself in the app. For anything else, email us and we will respond within one month.

If you are in the EEA or the UK you can complain to your local data protection authority. California residents have the rights to know, delete, correct and opt out of sale or sharing; we do not sell or share personal data, and we will not treat you differently for using your rights.

If you work for a customer of PostWide (for example an agency’s client), we may handle your data on that customer’s behalf, and you should contact them first.

11. Children

PostWide is a business tool for adults. It is not directed to anyone under 18, and we do not knowingly collect their personal data. If you believe a child has given us data, email us and we will delete it.

12. Changes

If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect. The date at the top shows the latest version.

13. Contact

Questions or requests: eilon@devmod.co.