Privacy Policy
Postfjord is a marketing service for small businesses: plan and publish social media posts (Social), answer and automate Instagram and Facebook messages (Chat), and send email (Mail). It is operated by Yogakollektivet Sverige AB, org. nr 556858-0699, Rallarvägen 10, 755 76 Vänge, Sweden ("Postfjord", "we", "us"). This policy explains what personal data we process at postfjord.com and app.postfjord.com, why, with whom we share it, how long we keep it and what rights you have under the EU General Data Protection Regulation (GDPR).
1. Two roles: controller and processor
We are the controller for data about our customers and their team members (accounts, billing, support), for visitors to our own websites postfjord.com and app.postfjord.com, and for the small amount of data we use to protect the service for everyone, such as the shared email suppression list described in section 4.
We are a processor for data that a business (a "workspace") handles about its own contacts through Postfjord: people who send a direct message to or comment on a connected Instagram or Facebook account, contacts the business adds, people who receive its emails, and visitors to the pages it publishes on postfjord.page. For that data the business is the controller. It decides why the data is processed, and we process it only on its instructions under our Data Processing Agreement. If you are one of those contacts, see section 9.
2. Data about our customers and their team members
Account
Name, email address, a password that Firebase Authentication stores only in scrambled (hashed) form. When you choose a new password through a reset link, it passes through our servers once on its way to Firebase and is never stored or logged by us. Or, if you sign in with Google, the name, email address and profile picture Google shares. We also store your language, email preferences, dashboard layout, the workspaces you belong to and your role in each.
Access requests and invitations
When you join the waitlist on postfjord.com we store your email address, which page you signed up on and your browser's language. When you request early access we store your name, email address, company, website and the reason you give, and who approved the request. When someone invites you to a workspace we store your email address, the role and who invited you. We also keep records of email verification and password reset requests (email address, time and a hashed token).
When you sign in to the Academy on postfjord.com we create or use your Postfjord account with your email address, and store which lessons you marked done, your answers to the quick questions, the result of the final exam (whether you passed, your score when you did, the number of attempts and when), and which lessons the app ticked off because it saw you do them. For sign-in we email you a 6-digit code and keep only a keyed hash of it (never the code itself) with the number of tries. The code works for 10 minutes; its hash is deleted when you use it, or automatically within about a day after it stops working. We also keep a hash of your address with the time and number of codes sent that day, and a hash of your IP address with the number of codes asked for and typed from it that day. A diploma or certificate you ask for stores the name you type, the course, the date and an ID. Its page on postfjord.com is public to anyone with the link, so you can share it; it shows no email address.
Where you came from and what you told us when you signed up
The first time you open the app, it keeps in your browser where the visit came from: the campaign tags in the link (utm_source, utm_medium and utm_campaign), the domain of the website that linked to us (never the full address) and the first page you opened. postfjord.com passes the same things on in its links to the app, and keeps them only in that browser tab (session storage, no cookie). Once you have an account, the app sends them to us once, with your browser's time zone (for example America/New_York), and then deletes its copy. We keep where you came from only for accounts made in the last 30 days. When you create your first workspace you can tell us what kind of business you run, what you want to do first, how big your audience is and where you first heard about Postfjord. Every question is optional. We use this to understand where our customers come from and what they need. We do not keep your IP address or work out your location for it. Our team may also keep short notes on an account, for example after a support conversation. Only Postfjord's own admins can see this, and it is deleted with your account.
Billing
Payments are handled by Stripe. When you choose a paid plan, Stripe collects your card details, name, billing address and, if you give one, your VAT number. Card details never reach us. We store your plan, subscription status, billing interval, renewal date and the Stripe customer and subscription identifiers.
Connected social accounts
When you connect a social account we store its identifiers, name, username and profile picture link, and the access tokens the platform issues. Tokens are encrypted (AES-256-GCM) and used only for the features you use: publishing, reading your own posts and insights, the inbox and automations, and keeping the connection alive. What else we store depends on the platform:
- Facebook Page or Instagram professional account connected through Facebook: also the Facebook user id of the person who connected it. Connected through Instagram only: the Instagram account alone.
- Threads profile: nothing more than the above.
- LinkedIn profile: your LinkedIn member id, name and profile picture from LinkedIn's sign-in. LinkedIn also shares your email address when you connect, and we do not store it. LinkedIn's access expires after 60 days, and we show the date you need to connect again.
- YouTube channel: see YouTube below.
- X account: your X user id, username, name and profile picture link. We ask X to read your profile, to read and write posts, to upload media and to keep the connection (offline access); we do not read your timeline, followers, likes or direct messages. For each post we store its X id and link, and we count how many posts each workspace makes to X each month, because posting to X is sold with a monthly number of posts. The access tokens are stored encrypted. Disconnecting the account deletes its tokens and its details at once. Your use of X through Postfjord is also subject to X's Terms of Service and Privacy Policy.
- Pinterest account: your Pinterest account id, username and profile picture link, and the names, ids and privacy setting (public or protected) of your boards, so you can choose where each pin goes. We ask Pinterest only to read your account and boards, to create a public board when you press New board, to read the pins Postfjord creates and to create pins; we do not read secret boards, analytics or ads, and we never change or delete a board. For each pin we store its Pinterest id and link. Disconnecting the account deletes its tokens, its board list and its details at once; if the account moves to another workspace, the old workspace loses the tokens and the board list.
- Google Business Profile: for each business place you add, its Google location id and account id, name, street and town, Google Maps link, place id, language and whether Google lets it take posts. We ask Google for one permission, to manage your Business Profile, and use it only to list the places you manage and to create the posts you schedule; we never change your business details, hours, photos or reviews, and we do not read your reviews or insights. For each post we store its Google id and link. Disconnecting a place deletes its tokens and its details at once; if the place moves to another workspace, the old workspace loses the tokens. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
- Bluesky account: your Bluesky account id (DID), handle, display name, profile picture link and the address of the server that hosts your account. You sign in on Bluesky's own page and we never see your password. Bluesky's sign-in gives an app broad access to the account; we use it only to create the posts you schedule and to upload their images and videos, and we do not read your messages. For each post we store its Bluesky id and link, and each night we read your public follower count and the likes, replies, reposts and quotes of your recent public posts for Analytics. The access tokens and the key they are bound to are stored encrypted. Disconnecting the account deletes its tokens and its details at once.
- Mastodon account: your Mastodon account id, username, display name, profile picture link, default posting language and the address of the server that hosts your account, with the limits that server sets for posts. You sign in on your own server and we never see your password. We ask the server only to read your profile and your own posts, to write posts and to upload media; we do not read your messages or your timeline. To connect accounts on a server, Postfjord registers itself as an app there once; its secret is stored encrypted. For each post we store its Mastodon id and link, and each night we read your follower count and the favourites, replies and boosts of your recent public posts for Analytics. The access token is stored encrypted. Disconnecting the account deletes its token and its details at once.
- WordPress site: the address of the site, its name, how its REST API is reached, and the user id, user name, display name and profile picture link of the WordPress user you connect with. You connect with an Application Password that you make in WordPress; we store it encrypted, use it only to publish the articles you schedule (with their cover picture and tags) and never see your normal WordPress password. For each article we store its WordPress id and link. We read nothing else from the site. Disconnecting the site deletes the password and its details at once, and you can also delete the Application Password in WordPress at any time.
- Ghost site: the API address of the site, its name and public address, and the id of the custom integration you connect with. You connect with the integration's Admin API key; we store it encrypted, use it only to publish the articles you schedule (with their cover picture and tags) and never see your Ghost password. For each article we store its Ghost id and link. We read nothing else from the site and send no newsletters. Disconnecting the site deletes the key and its details at once, and you can also delete the integration in Ghost at any time.
- Wix site: the site's name, address and id, the id of the installation of Postfjord's Wix app on it, and the member id of the person who writes your blog posts (the author of your latest post). You connect by installing the app on the site you pick on Wix's own page; we never see your Wix password. The app may create blog posts, add their cover pictures to the site's Media Manager and read the site's members, to find the author. For each post we store its Wix id and link. Access tokens are made when a post goes out and last a few hours; we store them encrypted. Disconnecting the site deletes what we kept; removing the app in Wix ends the access completely.
- Shopify blog: for each blog of a connected Shopify store that you add as a channel, the blog's id, name and address, and the store's address and name. It has no key of its own: Postfjord publishes with the store's connection (see "Connected Shopify store" below), which needs Shopify's permission to write blog posts. Postfjord writes only the blog posts you send, with their cover picture and tags, and changes no product, order or customer. For each blog post we store its Shopify id and link. Removing the blog, or disconnecting the store, stops it at once.
- TikTok account: your TikTok user id for Postfjord (open id), display name, username and profile picture link. We ask TikTok only for your basic profile, to post videos and to send videos to your TikTok inbox; we do not read your other videos, followers, messages or statistics. Each time you open a post for TikTok we ask TikTok which privacy and interaction settings your account allows and show them, without storing them. With each post we store the settings you chose, TikTok's id for the post and, once TikTok gives one, its link. Disconnecting the account asks TikTok to end Postfjord's access and deletes its tokens and details at once. TikTok handles your data under the TikTok Privacy Policy and the TikTok Terms of Service.
YouTube
Postfjord uses YouTube API Services to upload videos to a YouTube channel you connect. By connecting a channel you also agree to the YouTube Terms of Service, and Google handles your data under the Google Privacy Policy.
What we access and store. When you connect, Google asks you to sign in and to let Postfjord upload videos to your channel. From the sign in we store your Google account id and the name on your Google account, which we show as the channel's name until your first video is uploaded. We do not ask for your email address and we do not keep your profile picture. We also store the access tokens Google issues (encrypted, as above), from the first upload on the channel id and title, and for each video you publish through Postfjord its YouTube id, link and status. We use this only to publish the videos you schedule and to show you where they went.
Public numbers under Analytics. Once a channel has its channel id, Postfjord reads the numbers anyone can see on youtube.com, with Postfjord's own API key and not with your sign in: the channel's subscriber count, video count and picture, and for its public videos the title, description, publish date, thumbnail, views, likes and comments. We show them under Analytics and keep them for 30 days, after which they are deleted. They are never sent to an AI model. Disconnecting the channel or removing Postfjord's access deletes them with the rest of its YouTube data, as described below. We do not read your private or unlisted videos, the comments themselves, who your subscribers are or your watch history.
We do not sell this data, use it for advertising or use it to train AI models, and we share it only with the providers in section 5 that host Postfjord.
How to remove access. Disconnect the channel under Channels in Postfjord, which at once deletes its tokens, its name, the channel id and title, the YouTube id, link and status of every video, and its numbers under Analytics. Your Google account id is part of the internal key Postfjord files the channel's posts and their publishing log under, so it stays there until you delete those posts or the workspace. You can also remove Postfjord's access in your Google Account at security.google.com/settings/security/permissions. Postfjord can then no longer upload, and within 7 days we delete the channel's tokens, name, channel id and title and the YouTube data we stored. The channel stays in your list as revoked with only your Google account id, so that Reconnect finds it again. Disconnect it to remove it from the list.
Postfjord's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. This also covers the name, email address and picture Google shares when you sign in with Google.
Content and settings
Posts, drafts, ideas, templates, schedules, uploaded images (the app removes location, time and camera data from a photo before it is uploaded, except from a file the browser cannot open), videos and fonts (including any metadata stored inside those files), your brand profile, automations, saved segments, and daily analytics for your connected accounts (follower counts, engagement totals and your top posts). If you import your brand voice from a website, we fetch the text of that website.
API keys and integrations
For API keys we store a hash of the key, its name, prefix and when it was last used. Keys for integrations you connect (Mailchimp, or your own AI provider) are stored encrypted.
Connected Shopify store
When a workspace connects its Shopify store, we store the store's myshopify.com address, its name, currency and main web address, who connected it and when, the ids of the four webhooks Postfjord adds to the store, and the access token and refresh token Shopify issues, encrypted as above. A store connected with an app of its own (the Advanced way) gives us that app's client id and secret, or its admin access token and API secret, instead; these are encrypted the same way. We ask Shopify to read products and orders and to write blog posts. Postfjord changes no product, order or customer. It writes only the blog posts you send to a blog of the store that you added as a channel. Products are read when someone in the workspace searches for them, and the results are kept in our servers' memory for 5 minutes. A product's picture, name, price and link are copied into the workspace only when someone adds that product to a post, a DM automation or a page. What we receive about the store's orders and buyers is described in section 3.
Usage, support and security
Which features each account uses: the name of the feature and the days it was used, for example that you scheduled a post on 3 November. We do not store what you wrote or made in it. Only Postfjord's admins can see this, and we use it to learn what is useful and what to fix.
The number of AI tokens each feature uses and their cost, so we can enforce your plan's budget (we do not store the prompts). Messages you send us. Technical logs of the service (time, errors and the ids of the workspace and user involved). IP addresses are used briefly to limit the number of requests and are not stored by our code, with one exception: when someone uses a signup form, we keep a hash of the IP address, mixed with a secret that changes every day, for up to 48 hours to count signups from one device. The address itself cannot be read back from it.
Emails we send you
Service emails such as email verification, password resets, invitations, access decisions and notifications about new or assigned conversations and collected email addresses. You can turn notifications off under Account. If we send product news, you can turn it off under Account and in every such email.
The iPhone and Android app
The Postfjord app is the same service in an app, and everything in this policy applies to it. The app asks for the microphone when you dictate, and for the camera and your photos when you add a picture or a video to a post. It reads nothing else from your phone: no contacts, no location and no advertising identifier. It contains no advertising and no tracking. Pictures, templates and sounds in the design tool are loaded from app.postfjord.com when you use them. You can delete your account in the app, under Account.
3. Data a workspace processes about its contacts (we are processor)
A workspace decides which of these features it uses. Only members of that workspace can see this data in the app. Postfjord staff can access a workspace when needed for support, security, abuse handling or a legal obligation.
Messages and comments
When someone sends a direct message to or comments on a connected account, Meta passes it to Postfjord and we store it so the business can read and answer it: the person's platform id, the name and username Meta shares for them, the text, buttons they tap, links to attachments, story replies and mentions, the link or ad that opened the conversation, and for comments the author's name or username. Replies the business or its automations send are stored the same way. If the person unsends a message on Instagram, we delete its text, attachments and links from Postfjord as well. When an automation needs to know whether the person follows the account, we ask Meta and use the answer without storing it.
A WhatsApp number connected while it stays in the WhatsApp Business app also brings, once and only if the business allows it on the phone, its one to one chats from the last six months and the names and numbers in its WhatsApp contacts. The chats are stored like other messages. The contact names are kept only so threads show the name the business uses; a contact removed in the app, a deleted contact and a disconnected number take them with them.
Contact details
Details the business adds or an automation collects: email address and where it came from, first and last name, birthday, phone number, other custom fields, tags, assignment and status, whether the person has opted out of automated messages, and which tracked links the person clicked and when.
Automations and AI replies
Automations send messages based on rules the business sets. If the business uses AI replies, the last messages of the conversation and the person's display name are sent to the AI provider the workspace uses (see section 5) to draft an answer.
Email (Mail)
For workspaces that use email: contact email addresses, signups through the workspace's signup forms (the address, the first name if the form asks for it, and which form was used), the consent status for each address (when confirmation was requested and given, how, and which team member confirmed a consent given in person), for addresses imported from another email service the proof that service kept (when and from which IP address the person signed up and confirmed, and how they were added), unsubscribe records (including whether the person used the button in their mail app or the link in the email), and delivery events from Amazon SES (delivered, bounced, complained, including the recipient address). Every email carries the sender's company name, postal address and an unsubscribe link. As email features are added, workspaces may also use list import and checks of email addresses before sending. We describe those here, and add any new provider to section 5, before they are used.
Clicks in campaign emails are counted per email, not per person. Links in a campaign email pass through Postfjord, which counts a click on that link and sends the reader on to the page. For each click we store which link it was and the hour, nothing about who clicked. Where Postfjord has switched on open tracking for a workspace, each copy of an email carries a small invisible image unique to that person. When it loads, the workspace can see that this person opened the email, when, and whether it looked automatic (Apple Mail loads images by itself when an email arrives). This is stored with the record of the email sent to that person. Members who may see contacts can read it. It is deleted with the contact, and otherwise after 13 months. We also count opens per email, as totals. So that one person opening a link or the email many times in the same clock hour counts once, our servers make a keyed hash from the network address (for IPv6 its first half), the campaign, the link and that hour. The hash is kept as a marker that expires two hours after it is made and is deleted after that, usually within a day. Nobody in the workspace can see it. Opens that come through a mail service's image proxy, such as Gmail's or Apple's, are not deduplicated this way, since many readers share one proxy address, and may count each time, up to 20 opens for each person the email reached. We keep running totals of opens, clicks and proxy loads per email to enforce these limits; they hold numbers only. Of clicks and these counts, the workspace sees only totals, and none until an email has reached 10 people. Click and open records are deleted after 13 months. Postfjord does not record who clicked a link, and does not do so until the law on that has been checked and the person has agreed. A reader who does not want an open recorded can turn off images in their mail app.
Bookings and sales
A workspace can connect its own booking system (for example Calendly or Acuity) or its own Stripe account, so Postfjord can count the bookings and sales that its posts, messages, emails and pages lead to. The booking system or Stripe sends each booking or payment to Postfjord. We keep the class or service, the time and the status of a booking, and the amount, currency and any refund of a sale, together with the contact and the automation, email or page it belongs to. The contact gets a count of bookings and purchases, the total they spent, and a Booked or Customer tag. In a payment, the person's email address and name are used only to find the matching contact and are not stored. In a booking they are used to find the matching contact, and when the person is not a contact yet, the workspace keeps them as a new contact with that name and email address (the workspace can turn this off). Such a contact has not agreed to receive email, so the workspace cannot send them newsletters or other marketing email until they say yes. The booking record itself never holds the name or email address. When a sale matches one of the workspace's email automations, the sale record keeps a one-way hash of the buyer's email address (never the address itself), so a refund can stop the emails that purchase starts. The hash is deleted when the contact is deleted. The incoming event is deleted as soon as it has been matched.
Orders from a connected Shopify store
When a workspace connects its Shopify store, Shopify sends Postfjord each order from that moment on, with only these fields: the order id, the amount, the currency, the payment status, whether it is a test order, the dates, the address of the page the buyer first landed on, and the buyer's email address. An order arrives with no names, postal addresses, phone numbers or products bought. Shopify also sends each refund with its id, its order's id, its date and its payment transactions, which can name the card brand and the last digits of the card; Postfjord keeps only the refund's and the order's ids and the refunded amount. When the store removes Postfjord's app, Shopify sends a notice with the store's own details, which can include the store owner's name, email address, phone number and address; Postfjord reads only which store it is. Nothing else in a refund or a notice is kept. Postfjord never asks Shopify for the store's older orders or its customer list. When an order is refunded, Postfjord asks Shopify only for that order's total refunded and whether it is a test order. The landing page address carries the tags Postfjord adds to its own links, which say which automation, email or page sent the buyer.
The buyer's email address is used once, when the order arrives, to find a matching contact the workspace already has. Postfjord never creates a contact from a Shopify order. The address is not stored: the incoming order that holds it is deleted as soon as it has been matched, and within about a week in any case. If the workspace has a purchase email automation that the order matches, and the address has confirmed email consent with the workspace, the order can start that automation, and a one-way hash of the address (never the address itself) is kept with the order so that a refund can stop those emails.
An order that one of the workspace's links sent, or whose buyer is a contact, is kept as a sale as described under Bookings and sales. Every other order of the store is kept for 400 days with only its store, amount, currency, refund, status, dates and, where it matched a purchase automation as above, the hash, so that a later refund can be taken off; then it is deleted automatically.
Privacy requests from Shopify. Shopify passes three kinds of request to every app. Postfjord receives them for stores connected with Connect with Shopify. A store connected with an app of its own (the Advanced way) gets these requests in that app, which the store owner runs; the orders Postfjord holds from such a store follow the 400-day rule above and are deleted with the workspace. When a buyer asks what the app holds about them, we work out which of their orders and amounts we hold and send that to the store owner within 30 days. When a buyer asks to be forgotten, each of their orders keeps its amount in the workspace's totals but loses its link to the contact and the email hash; the contact's purchase count and total spent are taken back, and so is the Customer tag when no other sale is linked to the contact; and a purchase email automation the order started stops. The contact itself stays, because it came from the workspace's own messages, forms or imports, not from Shopify. When a store asks to be forgotten, which Shopify does 48 hours after the store removes Postfjord's app, every order of that store is unlinked the same way, the other store orders are deleted, the tokens and webhook address are deleted, and the store's name and addresses are removed from the workspace. We keep a record of each request for 3 years so we can show it was handled; the buyer's email address and phone number in it are deleted as soon as the request has been handled.
Disconnecting and removing the app. Disconnect Shopify in Postfjord asks Shopify to remove Postfjord's webhooks from the store and, when the store was connected with Connect with Shopify, to remove Postfjord's app, and deletes the tokens and the webhook address at once, even if Shopify cannot be reached. When the store removes Postfjord's app in Shopify, Shopify tells us and we delete the tokens and the webhook address the same way. Orders already counted stay in the workspace's numbers. The store's name and the stored orders stay until Shopify's request to forget the store (for a store connected with Connect with Shopify), until their 400 days run out, or until the workspace is deleted, whichever comes first.
Visitors to pages on postfjord.page
A workspace can publish a link in bio page and landing pages on its own address, such as name.postfjord.page. The business that publishes a page is the controller for data about the people who visit it, and we process that data for the business. The pages set no cookies and run no scripts. Each page counts its views and the taps on its links as daily totals, with nothing that recognises a visitor.
A business can connect its own Meta Pixel, its own Google Analytics, or both, to its pages. While one is connected, each signup form on its pages shows a box of its own, not ticked, that asks whether the business may tell Meta, Google or both (the box names which) about the signup, with a link to the business's own privacy policy. A visitor who leaves the box empty signs up as before. Only when a visitor ticks the box and signs up as a new contact do our servers send a record of that signup, on the business's behalf, and only to the services the box named.
To Meta we send one record (a Lead): the visitor's IP address and browser (user agent), the page address with only its utm tags, the time, and Meta's ad click id when the visit came from a Meta ad. Every record asks Meta to apply Limited Data Use. Meta receives the records under its Business Tools Terms with the business.
To Google Analytics we send one event (generate_lead): the visitor's IP address, which Google uses to work out the country and city, the browser (user agent), the page address with only its utm tags, the time, and an identifier we make at random for that one event and never use again, so Google cannot link it to any other event or visit. The event says that the visitor allowed their data to be used to measure ads and did not allow ad personalisation. Google receives the events under the business's own terms with Google for Google Analytics.
We never send the visitor's email address or name to Meta or Google, in plain text or hashed, and nothing is sent when the visitor's browser sends a Global Privacy Control signal. We do not keep the IP address for this: it is used to send the record and, as a keyed hash held only in our servers' memory for about 30 minutes, to stop the same signup being sent twice.
Instagram accounts a workspace watches
A workspace can choose to watch public Instagram business or creator accounts on its Analytics page. Postfjord then fetches each such account's public profile (username, name, profile picture, bio, website and follower, following and post counts) and its latest posts with their like and comment counts through Meta's Business Discovery, using the workspace's own connected Instagram account. We show this only to that workspace, fetch it again at most every few hours while the account is watched, and delete it when the account is removed from the watch list or the workspace is deleted. We do not build a profile of the people behind these accounts, and the watched account is not contacted.
Exports and integrations
A workspace can export its contacts as a file, which is created in the browser and not stored by us. If a workspace connects Mailchimp, contact email addresses, names, birthdays, phone numbers and tags are sent to its Mailchimp account, and when the workspace deletes a contact, the address is deleted from that Mailchimp audience as well.
4. Why we process data and our legal basis
| Purpose (as controller) | Legal basis |
|---|---|
| Create and run your account and workspaces, publish and deliver what you ask for, provide support | Contract (GDPR art. 6.1 b) |
| Handle waitlist signups, early access requests and invitations | Steps before a contract, and legitimate interest in admitting customers carefully (6.1 b and f) |
| Payments, invoices and bookkeeping | Contract and legal obligation under the Swedish Bookkeeping Act (6.1 b and c) |
| Service emails and notifications | Contract (6.1 b) |
| Product news to customers | Legitimate interest, with an easy opt-out (6.1 f) |
| Knowing where new customers come from and what they need: the sign-up source, the browser's time zone and the answers given when the first workspace is made, and our own notes on an account | Legitimate interest in understanding our customers and improving the service (6.1 f). The questions are optional, and you can object by writing to us |
| Seeing which features each account uses, to improve the service | Legitimate interest in knowing what is useful and what to fix (6.1 f). You can object by writing to us, and we stop |
| Security, rate limits, abuse prevention and reviews of risky sending | Legitimate interest in a safe and reliable service (6.1 f) |
| Shared email suppression list: addresses that hard bounced or complained are stored only as a SHA-256 hash so that no workspace emails them again | Legitimate interest in protecting recipients and the deliverability of every customer (6.1 f) |
| Limits on confirmation emails: how many were sent to an address in the last 30 days and when, stored only against a SHA-256 hash of the address, so nobody can use Postfjord to flood an inbox | Legitimate interest in protecting recipients and preventing abuse (6.1 f) |
| When a workspace is deleted, a record of who had unsubscribed from its emails, stored only as SHA-256 hashes and kept for the workspace owner, so an import into a new workspace cannot email them again | Legitimate interest in respecting people's opt-outs (6.1 f) |
| Aggregated statistics about visits to postfjord.com | Legitimate interest (6.1 f) |
| Checking that requests to the app come from a person in a real browser and not a bot (Google reCAPTCHA Enterprise) | Legitimate interest in protecting accounts and the service from automated abuse (6.1 f) |
| Google Analytics on postfjord.com, only after you accept cookies | Consent (6.1 a), which you can withdraw at any time under Cookie settings |
| Meta data deletion requests and other legal requests | Legal obligation and our agreements with platforms (6.1 c and b) |
For contact data where we are processor, the workspace decides the purpose and needs its own legal basis, for example consent to email marketing or the rules for its existing customers under the Swedish Marketing Practices Act.
5. Who we share data with
We never sell personal data. We share it only with the providers below, under data processing terms, and with the platforms and services you choose to connect.
| Provider | What for | Where |
|---|---|---|
| Google Cloud and Firebase | Hosting, database, file storage, functions and sign-in | Database, files and functions in the EU (Belgium, europe-west1). Sign-in and the website delivery network are global Google services. |
| Anthropic (Claude) | Writing assistant, brand profile, weekly plan, help assistant, scoring the posts Mentions finds, reading the words in a picture and naming the things in it when someone uses Peel apart, and AI replies unless the workspace uses its own AI provider | USA (EU standard contractual clauses) |
| fal.ai | Making and changing AI pictures and videos: the pictures, painted areas and prompts a workspace sends for it. No contacts or messages | USA (EU standard contractual clauses) |
| OpenAI | Turning speech into text: a dictated brief, and the sound of a video when the workspace makes video pages, unless the workspace uses its own ChatGPT key. The recording is not stored by us | USA (EU standard contractual clauses) |
| Amazon Web Services (Amazon SES) | Sending email for workspaces that use Mail, and delivery, bounce and complaint events | EU (Stockholm, Sweden) |
| Stripe | Payments and subscriptions | EU and USA (EU-US Data Privacy Framework and standard contractual clauses) |
| Oderland | Sending our service and notification emails | Sweden |
| Cloudflare | Delivering landing pages and link in bio pages on postfjord.page; visitors' requests to those pages, with their IP address, pass through it | Global (EU-US Data Privacy Framework and standard contractual clauses) |
| Cloudflare R2 | A weekly, encrypted backup copy of the database, locked against changes and deleted after 82 days | EU (Cloudflare's EU jurisdiction) |
| Cloudflare (public DNS, 1.1.1.1) | The free SPF and DMARC checker on postfjord.com: your browser asks Cloudflare's public DNS for the records of the domain you type, so Cloudflare receives that domain name and your IP address | Global (EU-US Data Privacy Framework and standard contractual clauses) |
| Google (Google Analytics) | Visitor statistics on postfjord.com, only after consent to cookies | EU and USA (EU-US Data Privacy Framework and standard contractual clauses) |
| Google (reCAPTCHA Enterprise) | Bot protection in the app at app.postfjord.com: your browser sends Google signals such as your IP address, browser details and how the page is used, and Google tells us whether the request looks automated. You never solve a puzzle | Global (EU-US Data Privacy Framework) |
| Google Fonts | Fonts in the app at app.postfjord.com; your browser contacts Google, which receives your IP address; postfjord.com serves its own fonts. Also the web fonts in emails a workspace sends: when an email uses one, the reader's mail app fetches the font from Google, which receives the reader's IP address | Global (EU-US Data Privacy Framework) |
| Postmark (ActiveCampaign) | DMARC reports for postfjord.com: mail providers send Postmark daily reports about email sent in postfjord.com's name, with the addresses of the sending servers, counts and whether the checks passed, and no email content | USA (EU-US Data Privacy Framework and standard contractual clauses) |
Anthropic and OpenAI do not use data sent through their APIs to train their models, and no access tokens are ever sent to an AI provider.
The same providers, with which data each one receives and a link to its terms, are listed at postfjord.com/subprocessors. Those that handle a workspace's contacts for it are the sub-processors in our Data Processing Agreement.
Platforms and services you connect. Meta, LinkedIn, Google (YouTube), Pinterest, X and TikTok receive the posts, videos, replies and messages you send through Postfjord and send us the data described in sections 2 and 3. Each is an independent controller for its platforms. Shopify sends us the orders, refunds and products of a store a workspace connects, as described in sections 2 and 3, and receives Postfjord's webhooks and, on disconnect, the removal of Postfjord's app; Shopify is an independent controller for its platform. A WordPress, Ghost or Wix site, or the blog of a connected Shopify store, receives the articles, pictures and tags sent to it; the site's owner is the controller for it, and Wix and Shopify also process them as the host of the site. If a workspace connects its Meta Pixel or Google Analytics to its pages, Meta or Google also receives a record of each new signup on them whose visitor ticked the box to allow it, as described in section 3. If a workspace connects Mailchimp, or chooses its own AI provider (Anthropic, OpenAI, Google Gemini, Mistral or DeepSeek), the data those features use is sent to that provider under the workspace's own agreement with it. DeepSeek processes data in China, which the EU has not found to offer adequate protection; a workspace that chooses it is responsible for that transfer.
When a provider processes data outside the EU and EEA, the transfer relies on an EU adequacy decision (such as the EU-US Data Privacy Framework for certified companies) or on the EU standard contractual clauses in that provider's data processing terms.
We may also disclose data when the law requires it, for example to a court or authority.
6. How long we keep data
| Data | Kept |
|---|---|
| Account and profile | Until you delete your account |
| Workspace content, contacts, messages, comments, consent records and analytics | Until the workspace deletes the contact or the whole workspace, or asks us to delete specific data |
| Automation send logs and comment triggers | 30 days |
| Finished scheduled automation steps | 30 days |
| The words and object names read from a picture with Peel apart | 30 days, then deleted automatically |
| Email delivery events from Amazon SES | 30 days, then deleted automatically |
| Shared email suppression list (hashes only) | As long as needed to stop emails to addresses that bounced or complained. An address our email provider holds back for its own reasons is paused for 14 or 90 days, then tried again. |
| Confirmation email counts per address (a hash and dates only) | 31 days, then deleted automatically |
| A confirmation email waiting because a daily limit was reached (the address and the workspace) | Up to 3 days, until it is sent or dropped |
| Unsubscribes from a deleted workspace (hashes only) | 24 months, then deleted automatically |
| Opt-out marker after a contact is deleted (a hash of the channel and the person's id, and when they opted out) | As long as the workspace exists, so a person who asked to stop automated messages is never messaged again |
| An incoming Shopify order with the buyer's email address | Deleted as soon as it has been matched to a contact, within about a week in any case |
| Shopify store orders that Postfjord did not send (store, amount, currency, refund, status, dates, and a hash of the email address if the order matched a purchase automation) | 400 days, then deleted automatically; at once when Shopify asks us to forget a store connected with Connect with Shopify |
| A Shopify approval waiting for you to sign in to Postfjord (the store address and its encrypted token) | Deleted when it is used; an unused one stops working after 30 minutes and is deleted automatically within about a day |
| Shopify tokens or app keys, and the webhook address | Until the store is disconnected, removes the app or asks to be forgotten |
| Record of a Shopify privacy request (the buyer's email address and phone number are deleted once it is handled) | 3 years |
| Billing records and invoices | 7 years, as the Swedish Bookkeeping Act requires |
| Technical logs | About 30 days |
| Which features an account used | 13 months, or until the account is deleted |
| Where an account came from (campaign tags, the linking domain and the first page), its time zone, its answers when it made its first workspace, and our notes on it | Until the account is deleted. The copy in your browser is deleted once it is sent, and after 30 days in any case |
| Database restore points and daily backups | 7 days |
| Weekly database backups | 12 weeks |
| Our queue of notification emails, sent or not | 7 days, then deleted automatically |
| Access requests, verification and password reset records, and the record of which address you confirmed | Until you delete your account |
| Academy progress, diplomas and certificates | Until you delete your account |
| Academy sign-in code (a keyed hash of the code, never the code, and the number of tries) | Deleted when it is used; an unused one stops working after 10 minutes and is deleted automatically within about a day |
| Academy sign-in code counts (a hash of the address or of the IP address, the time and the number of codes sent or typed that day) | 2 days, then deleted automatically |
| Waitlist signups | Until you ask us to remove it (email hello [at] postfjord.com) or delete an account with the same address |
| Invitations to a workspace | Until the workspace or the invited person's account is deleted |
Deleting a workspace (Settings → General, owner only) removes its posts, media, brand profile, members, contacts, conversations, consent records, automations, connected accounts including tokens, API keys, integration keys and queued notification emails. Deleting your account (Account → Delete my account, or Delete my account on postfjord.com/academy/me for an account that only uses the Academy) removes your profile and memberships, your access request, email verification and password reset records, the record of your confirmed address, your Academy progress, diplomas and certificate, notification emails to you, a waitlist signup and invitations to your address; workspaces you own must be deleted or transferred first. Access tokens you connected for a workspace stay with that workspace, which remains their controller. Disconnecting a channel deletes its tokens at once. We keep daily daily backups of the database for 7 days and weekly backups for 12 weeks, and can restore it to any moment in the last 7 days, so deleted data disappears from all backups within 12 weeks. We never restore deleted data back into the app. Meta deletion requests are handled as described at postfjord.com/data-deletion. For YouTube, see YouTube in section 2.
7. Security
Data is encrypted in transit and at rest. Access tokens and integration keys are also encrypted by us before they are stored, and API keys are stored only as hashes. Access within a workspace follows the roles its owner sets. Only a small number of Postfjord staff have administrative access, and they use it only for support, security, abuse handling and legal obligations. If a personal data breach occurs we notify the Swedish Authority for Privacy Protection (IMY), and affected customers and people when the law requires it.
8. Your rights
You have the right to access your personal data, to have it corrected or deleted, to restrict or object to processing, to data portability, and to withdraw consent at any time where processing is based on consent. Much of this you can do yourself in the app. For anything else, email hello [at] postfjord.com and we answer within one month. You can also complain to the Swedish Authority for Privacy Protection, IMY.
9. If you messaged, received email from or visited the pages of a business that uses Postfjord
The business you contacted is responsible for your data and decides how it is used. To access, correct or delete it, contact that business. You can also write to us and we pass the request on. To stop automated direct messages, reply STOP (or stopp, avsluta, unsubscribe). To stop emails, use the unsubscribe link in any email; the business cannot sign you up again, only you can.
If you visited a page on postfjord.page, the business that published it is responsible for your data. What a page records, and what it sends to Meta or Google if you tick the box on its signup form, is described under Visitors to pages on postfjord.page in section 3. To ask about it, contact that business, or write to us and we pass the request on.
If you wrote a public post that names a business that uses Postfjord
Postfjord has a feature called Mentions that shows a business public posts that name it. The business picks the words to watch. We then look for those words in public posts on Bluesky and Hacker News, in public posts on X for a business that has the X add-on (read through X's official API with the business's own connected X account), in news articles found through GDELT (the headline, the link and the publisher's website), and in posts, comments and reviews on accounts and apps the business has connected to Postfjord (Instagram, App Store and Google Play).
What we read and keep: the public post, its link and date, and the author's handle, display name and picture link. We do not collect anything else about the author, we do not look at their other posts, and we never join what we know about one person across sites.
Why: so the business that picked the words can see what is said about it and answer. The legal basis is our legitimate interest and the business's. We checked that this does not outweigh your rights because the posts are public, we keep them for a short time and we make removal easy.
How long: found posts sit in a shared store for 30 days. A mention in a workspace is kept for 12 months, or 7 days if it was never scored.
Who sees it: the workspace that watches the words. A short piece of the post text goes to Anthropic, our AI provider, which scores the post for us under a data processing agreement and may not use it for its own purposes.
If you wrote a post and want it gone, email hello [at] postfjord.com with your handle on the site. We remove your posts from every workspace and stop saving new ones. You can also ask to see what we hold, or object. You may complain to your data protection authority.
10. Automated decisions
Postfjord does not make decisions about people that have legal or similarly significant effects. Automations follow rules the business sets, AI features produce drafts and replies, and our email safety checks may pause a business's sending for review; none of these decide anything about the people who receive messages.
11. Cookies and local storage
postfjord.com sets cookies only if you accept them in the cookie box: then Google Analytics sets its cookies (named _ga and _ga_ followed by an id, kept up to 13 months) so we can see which pages are read and how people find them. Google Signals and ad personalisation are off, and nothing is used for advertising. You can change your choice at any time with Cookie settings at the bottom of every page; declining removes the cookies. Your choice itself is kept in your browser's local storage. Without a yes, no Google script loads at all. The Academy pages (postfjord.com/academy), where you may be signed in, never load Google Analytics, whatever you chose.
The language you pick in the footer, or the one the start page picks from your browser's language on your first visit, is kept in your browser's local storage too. The campaign tags of the link you arrived by, the domain of the website that sent you and the first page you opened are kept in that browser tab's session storage, which is cleared when the tab closes, and added to the links to the app (see section 2).
Besides that, postfjord.com sets no cookies and loads no other statistics script. The free SPF and DMARC checker sets no cookies: your browser looks up the domain you type with Cloudflare's public DNS (see section 5). If you sign in to the Academy, postfjord.com keeps your sign-in session in your browser (local storage and IndexedDB, no cookies), and the address you asked a sign-in code for until you sign in, sign out or 10 minutes pass, whichever comes first. The app stores only what it needs to work in your browser: your sign-in session, preferences such as language, an offline copy of the workspace data you have opened, so it loads quickly, and where your first visit came from until it is sent with your new account (at most 30 days). The offline copy is deleted when you sign out. In the app, reCAPTCHA Enterprise may also set a security cookie (_GRECAPTCHA) that it needs to tell people from bots. The pages we show when you confirm or unsubscribe from an email set no cookies and run no scripts. The signup form page sets no cookies either. It runs one small script in your browser that does a short calculation before the button can be pressed, which keeps automated signups out. The script sends nothing anywhere.
12. Children
Postfjord is a business tool and is not directed at children under 16.
13. Changes
We post changes here and update the date above. For material changes we notify customers by email or in the app before they take effect. Before we launch new platforms (such as WhatsApp), signup forms, native apps or new providers, we update this policy.
Contact
Yogakollektivet Sverige AB, org. nr 556858-0699, Rallarvägen 10, 755 76 Vänge, Sweden. hello [at] postfjord.com