Data Processing Agreement
This Data Processing Agreement ("DPA") is part of the Terms of Service between you, the customer who owns a Postfjord workspace ("you", the controller), and Yogakollektivet Sverige AB, org. nr 556858-0699, Sweden ("Postfjord", "we", the processor). It applies whenever we process personal data on your behalf while providing Postfjord, and it meets the requirements of article 28 of the EU General Data Protection Regulation (GDPR). If this DPA and the Terms of Service differ on data protection, this DPA applies. A signed copy is available on request from hello [at] postfjord.com.
1. Scope and roles
You are the controller for personal data about your contacts that you, your team or your automations handle in Postfjord, as described in Annex 1. We process that data only as your processor. Data about you and your team as our customers, and the shared email suppression list, are processed by us as controller and are covered by our Privacy Policy.
2. Your instructions
We process the data only on your documented instructions. Your instructions are these terms, the settings you choose and the actions you and your team take in Postfjord, including automations and API calls. We also process data when EU or Swedish law requires it, and then tell you first unless the law forbids it. If we believe an instruction breaks data protection law, we tell you.
3. Your responsibilities
You are responsible for having a lawful basis for the data and for sending messages and emails to your contacts, for informing your contacts about the processing, for the content of your instructions, and for handling your contacts' requests. You must not use custom fields or automations to collect special categories of personal data (such as health data) unless you have a lawful basis and appropriate safeguards.
4. Confidentiality and security
Everyone at Postfjord who can access the data is bound by confidentiality. We take the technical and organisational measures in Annex 2 and keep them appropriate to the risk. We may improve them over time but will not lower the overall level of protection.
5. Sub-processors
You give us general authorisation to use the sub-processors listed in Annex 3. We tell you at least 30 days before we add or replace a sub-processor that will process your data, by email to the workspace owner or in the app, and we update Annex 3 and the list at postfjord.com/subprocessors. If you have a reasonable data protection objection, tell us within that period; if we cannot resolve it, you may stop using the affected feature or end your subscription without penalty. We bind every sub-processor to data protection obligations that are at least as protective as this DPA and remain responsible for its work.
6. Transfers outside the EU and EEA
We transfer data outside the EU and EEA only to a sub-processor listed in Annex 3 and only with a valid safeguard: an EU adequacy decision, such as the EU-US Data Privacy Framework for certified companies, or the EU standard contractual clauses. Data you choose to send to services you connect yourself (for example Mailchimp or your own AI provider, or your Meta Pixel or Google Analytics for signups on your pages) is transferred on your instruction and under your own agreement with that provider.
7. Helping you
Taking into account the nature of the processing, we help you:
- answer requests from your contacts to access, correct, delete, restrict, object to or port their data, mainly through the tools in the app, and otherwise on request;
- meet your obligations on security, personal data breaches, data protection impact assessments and prior consultation with a supervisory authority, with the information we have.
If a contact sends a request about your data directly to us, we forward it to you and do not answer it ourselves unless you ask us to.
8. Personal data breaches
We notify you without undue delay, and where possible within 48 hours, after we become aware of a personal data breach affecting your data. We tell you what we know about its nature, the data and people affected, the likely consequences and the measures taken or proposed, and we add information as it becomes available.
9. Deletion and return
You can export your contacts at any time and delete a workspace in the app. When a workspace is deleted, or when your agreement ends and the workspace is deleted, we delete your data from our live database without undue delay. Restore points and daily database backups are kept for 7 days and weekly backups for 12 weeks, so the data is gone from all backups within 12 weeks. Short-lived copies in logs and in our providers' systems are deleted on their normal schedules (for example email delivery events after 30 days and technical logs after about 30 days). We keep data longer only where EU or Swedish law requires it.
10. Information and audits
We make available the information needed to show that we meet this DPA. If that is not enough, you may audit our compliance once a year, with at least 30 days' notice, during business hours, at your own cost, through an independent auditor bound by confidentiality, and without access to other customers' data. For our sub-processors we may rely on their own certifications and audit reports.
11. Term, liability and law
This DPA applies for as long as we process personal data on your behalf. The limits of liability in the Terms of Service apply, except where data protection law does not allow them. Swedish law applies, and disputes are handled as set out in the Terms of Service.
Annex 1: Details of the processing
| Subject matter and purpose | Providing Postfjord to you: an inbox for messages and comments, contacts, automations and AI replies, email to your contacts, counting the bookings and sales they lead to (including orders from a Shopify store you connect), finding public posts, comments and reviews that match the keywords you watch in Mentions, and related analytics, integrations and exports. |
|---|---|
| Nature of the processing | Receiving, storing, organising, displaying, searching, analysing, sending and deleting data; automated processing by rules you set and by AI features you choose. |
| Data subjects | People who send direct messages to or comment on your connected Instagram and Facebook accounts; contacts you or your automations add; recipients of your emails; people who confirm or unsubscribe from your emails; buyers in a Shopify store you connect; visitors to your pages on postfjord.page; authors of public posts, comments and reviews that match the keywords you watch in Mentions. |
| Categories of personal data | Platform identifiers, names and usernames; email addresses and phone numbers; content of messages and comments, including links to attachments; birthdays, tags and other fields you define; conversation status, assignment and opt-out records; link clicks; email consent and unsubscribe records; email delivery, bounce and complaint events; when available, email opens and clicks, and where open tracking is on, who opened an email; orders from a connected store (from Shopify: the order id, amount, currency, payment status, dates, the landing page address with its utm tags, and the buyer's email address, which is used only to match an existing contact and is not stored; a one-way hash of the address is kept only when the order matches a purchase email automation and the address has confirmed email consent; of a refund, whose payment transactions can name the card brand and last digits, only the refunded amount is kept), and purchase counts, totals and the Customer tag on your contacts; when you connect your Meta Pixel or Google Analytics to your pages and a visitor ticks the box on your signup form and signs up, that visitor's IP address and browser, the page address with its utm tags, the time, and Meta's ad click id or, for Google Analytics, an identifier made at random for that one event. |
| Mentions | For each post, comment or review that matches your keywords: the author's handle or id, display name and picture link, the text, its link and date, the source, and a one line AI summary and score. Nothing else about the author is collected, and one person's accounts on different sites are never joined. Mentions are kept for 12 months, or 7 days if never scored. Postfjord is the controller of the shared store of found posts it keeps for 30 days before they reach a workspace, as its Privacy Policy describes. |
| Special categories | Not intended. Messages that people choose to send may contain them. |
| Duration | For as long as you use Postfjord, then deleted as described in section 9. |
Annex 2: Technical and organisational measures
- Data stored in the EU (Google Cloud, Belgium) and email sent from the EU (Amazon SES, Stockholm).
- Encryption in transit (TLS) and at rest by our cloud providers; access tokens and integration keys additionally encrypted by us with AES-256-GCM; API keys stored only as hashes.
- Access to workspace data enforced by server-side security rules according to the roles the workspace owner sets; administrative access limited to named Postfjord staff and used only for support, security, abuse handling and legal obligations.
- Incoming webhooks from Meta, Amazon and Shopify are accepted only with a valid signature; email confirm and unsubscribe links use signed tokens.
- Data minimisation: profile lookups used for automations are not stored, and the email suppression list stores only hashes.
- Rate limits and abuse checks on public endpoints and sending.
- Automatic deletion of automation logs and email delivery events after 30 days.
- Point-in-time recovery and daily database backups, each kept for 7 days, and weekly backups kept for 12 weeks.
- Separation of customer data by workspace.
Annex 3: Sub-processors
The same list, with which data each sub-processor receives and a link to its terms, is at postfjord.com/subprocessors.
| Sub-processor | Processing | Location |
|---|---|---|
| Google Cloud and Firebase | Hosting, database, file storage and functions for all features, and checking links in your emails against Google Web Risk before they are sent | EU (Belgium) |
| Amazon Web Services (Amazon SES) | Sending your emails and returning delivery, bounce and complaint events | EU (Stockholm, Sweden) |
| Anthropic | AI replies and AI drafts that use conversation content, when your workspace uses Postfjord's AI rather than its own provider, and scoring the posts Mentions finds (the post text and your brand description, never the author's handle or picture), and reading the words in a picture and naming the things in it when someone uses Peel apart | USA (EU standard contractual clauses) |
| fal.ai | Making and changing AI pictures and videos: the pictures, painted areas and prompts your workspace sends for it and, for Peel apart, each object's name. No contacts or messages | USA (EU standard contractual clauses) |
| OpenAI | Turning speech into text: a brief you dictate, and the sound of a video when your workspace makes video pages, unless your workspace uses its own ChatGPT key. The recording is not stored by us | USA (EU standard contractual clauses) |
| Oderland | Notification emails to your team that can contain a contact's name, a message excerpt or a collected email address | Sweden |
| Cloudflare | Delivering your landing pages and link in bio pages on postfjord.page, including the signup forms on them, so a visitor's request and what they type in a form pass through it | Global (EU-US Data Privacy Framework and EU standard contractual clauses) |
| Cloudflare R2 | Storing a weekly, encrypted backup copy of the database, locked against changes and deleted after 82 days | EU (Cloudflare's EU jurisdiction) |
| Google Fonts | Serving the web fonts in your emails: when an email uses one, the reader's mail app fetches the font from Google, which receives the reader's IP address | Global (EU-US Data Privacy Framework) |
We also use Stripe for payments, Google reCAPTCHA Enterprise, Google Fonts and Firebase sign-in in the app, Google Analytics and Cloudflare's public DNS on postfjord.com, and Postmark for the DMARC reports about email sent in postfjord.com's name. They handle data about you as our customer, or about visitors to our own websites, for which we are controller under our Privacy Policy. They do not receive your contacts' data and are not sub-processors under this DPA. They are listed on the same page.
Meta is not our sub-processor: it runs the platforms your contacts use and is an independent controller. When you connect your Meta Pixel to your pages, we send Meta, on your instruction, a record of each new signup whose visitor ticked the box on your form, as described in Annex 1, and Meta receives them under its Business Tools Terms with you. When you connect Google Analytics to your pages, we send it, on your instruction, an event of each such signup, as described in Annex 1, and Google receives them under your own terms with Google for Google Analytics, not as our sub-processor. Services you connect yourself, such as Mailchimp or your own AI provider, or your Meta Pixel or Google Analytics, act under your own agreement with them.