Privacy Policy

Who is responsible for your data

PostMint (postmint.nl) is the controller for personal data we process about visitors, account holders and people who contact us. Where we process personal data on behalf of a business customer — for example the data inside content they create — we act as a processor and our Data Processing Agreement applies.

Personal data we may collect

• Account information: your name, email address, business name, phone number if you provide it, and your language preference.
• Login and authentication information: your password in hashed form, session and token information, and — if you sign in with Google — the account identifier and profile details Google shares with us.
• Billing information: your plan, billing frequency, invoices and payment status. Card and payment details are entered with and processed by our payment provider, not stored by PostMint.
• Business information you enter into PostMint: your Brand Profile, tone of voice, services, opening hours, offers and anything else you type into the product.
• Social media account information: the account name and the access tokens issued by a platform when you choose to connect it, so scheduled content can be published on your instruction.
• Content: text, captions, prompts, uploaded photos, generated visuals, calendars, approvals and publishing history.
• Technical information: IP address, browser and device information, server and security logs, and error diagnostics.
• Website and product usage information, where analytics is used and you have consented to it.
• Support communications: the messages, tickets and attachments you send us.

Why we process it, and the lawful basis

• Creating and managing your account — performance of a contract.
• Providing the PostMint service, including AI-assisted content generation, scheduling and publishing content you have approved — performance of a contract.
• Processing subscriptions, payments, invoices and trials — performance of a contract and legal obligation.
• Providing customer support — performance of a contract.
• Security, fraud prevention, abuse prevention and troubleshooting — legitimate interests.
• Improving and debugging the product — legitimate interests.
• Complying with legal, tax and accounting obligations — legal obligation.
• Sending marketing email, and setting analytics or marketing cookies — only with your consent, which you can withdraw at any time.

AI-assisted content

When you ask PostMint to generate or review content, the relevant prompt, Brand Profile context and any photo you select are sent to our AI provider so the output can be produced. Generated content may contain errors and is presented to you as a draft for review — you decide whether it is approved or published.

Retention

We keep account and content data for as long as your account exists. When you delete your account, account data and content are deleted from our live systems, except where we must keep records to meet legal obligations (for example invoices for tax purposes) or to resolve a dispute. Backups and logs are removed on their own rolling cycle.

Confirm before publishing. Set your exact retention periods here (live data, backups, logs, invoices) once your hosting and backup configuration is final.

Who we share personal data with

• Hosting and cloud infrastructure providers that run the PostMint application and database.
• Our payment provider, which processes subscription payments and card details.
• Our email provider, which delivers account and support email.
• Our AI provider(s), which process prompts and selected photos to generate content.
• Analytics providers, only where analytics is in use and you have consented.
• The social media platforms you choose to connect, for the content you approve.
• Professional advisers, and public authorities where we are legally required to disclose information.

Confirm before publishing. Name each provider and its role in the Subprocessor List on the Data Processing Agreement page before launch. Do not publish provider names that have not been confirmed.

International transfers

Some providers may process data outside the European Economic Area. Where that is the case, we rely on an appropriate GDPR transfer mechanism — such as an adequacy decision or the European Commission's Standard Contractual Clauses — together with any additional measures required.

Confirm before publishing. List which providers process data outside the EEA and which transfer mechanism applies to each, once your provider set is confirmed.

Security

We use technical and organisational measures to protect personal data, including encrypted connections to the application, hashed passwords and access controls. See the Trust & Security page for what is currently in place.

Your rights

• Access — ask for a copy of the personal data we hold about you.
• Rectification — have inaccurate data corrected.
• Erasure — ask us to delete your data, and delete your account yourself from Settings → Privacy & Data.
• Restriction — ask us to limit how we process your data.
• Objection — object to processing based on legitimate interests, and to direct marketing at any time.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting processing that already took place.
• Complain — lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in your country.

Cookies

Our use of cookies and similar technologies is described in the Cookie Policy. Non-essential cookies are only set after you consent, and you can change your choice at any time via 'Cookie settings' in the footer.

Children

PostMint is a business tool and is not intended for children. We do not knowingly collect personal data from children.

Contact

Privacy questions and data-rights requests: mint@postmint.nl.

Review and updates

We may update this document when the service, the law or our providers change. The version on this page is always the current one. Where a change materially affects you, we will inform you by email or in the app.

Confirm before publishing. Legal review pending: have this document checked by a qualified Dutch/EU adviser before launch, and set the 'last reviewed' date in /app/frontend/src/data/legal.js.