Privacy Policy
Last updated 17 August 2026
PostMax helps you repurpose, schedule and publish content to social platforms you connect. This policy explains what we collect, what each platform connection gives us access to, who else processes your data, and how to get it deleted.
1. Who we are
PostMax (“PostMax”, “we”, “us”) provides a content repurposing, scheduling and publishing service. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, PostMax is the data controller for personal data described in this policy.
Data protection contact: hello@postmax.io
2. What we collect
Information you give us
- Account details — your email address, display name, and a cryptographic hash of your password. We never store your password itself.
- Workspace details — the name of any workspace you create, and the members you invite to it.
- Media you upload — video, image and audio files, along with their filenames, sizes and formats.
- Content you create — captions, post copy, schedules, clip selections, brand presets and any edits you make.
- Correspondence — anything you send us by email or through support.
Information from platforms you connect
When you connect a social account, that platform gives us an access credential and a limited amount of profile information. What we receive from each is set out in section 4.
Information we generate
- Derived media — transcripts of your audio, clips cut from your video, and generated caption suggestions.
- Publishing records — what was posted, where, when, whether it succeeded, and the platform’s identifier for the post.
- Performance data — view, engagement and follower metrics retrieved from platforms for content you published through us.
- Technical and security data — IP address, browser user agent, session records, and a security log of events such as sign-ins, failed sign-in attempts and password resets.
3. How we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Providing the service — storing your media, generating clips, scheduling and publishing posts | Performance of a contract with you |
| Publishing to a connected account | Performance of a contract, carried out on your explicit instruction each time |
| Retrieving performance metrics for your posts | Performance of a contract |
| Keeping accounts secure — rate limiting, abuse prevention, the security event log | Legitimate interests in protecting our users and service |
| Service emails — verification codes, password resets, publishing failures | Performance of a contract |
| Billing and fraud prevention | Performance of a contract; legal obligation |
| Improving the product through aggregated, non-identifying usage patterns | Legitimate interests |
We do not sell your personal data, and we do not use your media or content for advertising.
4. Connected platforms
Connecting a platform is always your choice, and always reversible. We request the narrowest set of permissions that lets the feature work. We never post anything you have not created or approved, and we never read your private messages on any platform.
YouTube
PostMax uses YouTube API Services. By connecting a YouTube account you also agree to the YouTube Terms of Service. Google’s handling of your data is governed by the Google Privacy Policy.
- What we access: your channel name, identifier and avatar; the ability to upload videos to your channel; and, where you enable analytics, view and engagement figures for videos published through PostMax.
- What we store: the access and refresh credentials (encrypted), your channel name and identifier, and the YouTube video identifiers for content we published on your behalf.
- Revoking access: disconnect the account inside PostMax, or revoke PostMax’s access directly at Google security settings. Revoking through Google immediately stops all further access. We delete the stored credentials when a connection is removed.
TikTok
- What we access: your basic profile (open ID, display name, avatar) and the ability to post or upload video to your account.
- What we store: encrypted credentials, your display name and avatar for showing which account is connected, and the identifiers of posts we published.
- Revoking access: disconnect in PostMax, or remove PostMax from the connected apps section of your TikTok settings.
Instagram and Facebook (Meta)
- What we access: the Instagram Business or Creator account and Facebook Page you select, its name and profile picture, the ability to publish content to it, and insights for content published through PostMax.
- What we store: encrypted credentials, the account and page identifiers and names, and identifiers of published posts.
- Revoking access: disconnect in PostMax, or remove PostMax under Settings → Apps and Websites on Facebook.
- What we access: your name and profile photo, and the ability to create and delete posts on your behalf.
- What we store: encrypted credentials, your name, photo and member identifier, and identifiers of published posts.
- Revoking access: disconnect in PostMax, or remove PostMax under Settings → Data privacy → Permitted services.
X
- What we access: your profile information and the ability to post on your behalf. We do not request access to direct messages.
- What we store: encrypted credentials, your handle and profile information, and identifiers of published posts.
- Revoking access: disconnect in PostMax, or revoke PostMax under Settings → Security and account access → Apps and sessions.
Disconnecting an account in PostMax deletes the stored credentials for it. It does not delete anything already published — that content lives on the platform and is yours to manage there.
5. Automated processing of your media
To generate clips, PostMax sends parts of your media to specialist third-party services:
- Transcription. We extract the audio track from a video you upload and send it to a transcription provider to produce a timestamped transcript.
- Analysis. We send that transcript — text, not video — to a large language model provider to identify which passages would work as short clips, and to suggest captions.
We contract with these providers on terms that prohibit them from using your content to train their models, and we send the minimum needed for the feature to work. These steps only run on media you upload and only when you use a feature that requires them. No decision with a legal or similarly significant effect on you is made by automated means.
6. Who else processes your data
We use a small number of vendors to run the service. Each acts as a processor under contract, may only act on our instructions, and may not use your data for their own purposes.
| Provider | Purpose |
|---|---|
| Cloudflare (R2) | Storing your uploaded media and generated clips |
| Resend | Sending service email — verification codes, password resets, notifications |
| Database and application hosting | Running the service and storing account, workspace and post records |
| Transcription provider | Producing transcripts from audio you upload |
| Language model provider | Identifying clip-worthy passages and suggesting captions |
| Payment provider | Taking subscription payments. Card details go to them directly and never reach us |
A current list of named sub-processors is available on request from hello@postmax.io.
7. International transfers
Some providers process data outside the UK and European Economic Area. Where that happens we rely on UK adequacy regulations, or on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with any additional safeguards the transfer requires.
8. How long we keep things
| Data | Retention |
|---|---|
| Account and workspace records | Until you delete the account, then removed within 30 days |
| Uploaded media and generated clips | Until you delete them, or the account is deleted |
| Connected account credentials | Deleted immediately when the connection is removed |
| Expired sessions and password reset tokens | Removed automatically 7 days after expiry |
| Security event log | 180 days |
| Billing records | 6 years, as required by UK tax law |
Backups are retained on a rolling basis and are overwritten in the normal course, so deleted data may persist in a backup for a short period after removal from the live service.
9. Security
- Passwords are hashed with Argon2id and are never stored or logged in readable form.
- Credentials for connected social accounts are encrypted before storage.
- All traffic is encrypted in transit with TLS.
- Media is stored in a private bucket and served only through short-lived signed links.
- Sessions are held in HttpOnly cookies that JavaScript cannot read, and requests carry cross-site request forgery protection.
- Sign-ins, failed attempts, password resets and similar events are logged so unusual activity can be investigated.
- Access to production systems is limited to the people who need it.
No service can promise perfect security. If a breach affects your rights and freedoms we will notify the Information Commissioner’s Office within 72 hours and tell you without undue delay where required.
10. Your rights
Under UK GDPR you have the right to:
- Ask what personal data we hold about you and get a copy of it
- Have inaccurate data corrected
- Have your data erased
- Restrict or object to how we process it
- Receive your data in a portable, machine-readable format
- Withdraw consent where we relied on it, without affecting past processing
Email hello@postmax.io and we will respond within one month. You can also delete your account, remove individual files, or disconnect a social account yourself at any time — see Delete your data for how, and section 8 for what is removed.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office. We would appreciate the chance to address it first.
11. Cookies
PostMax uses only the cookies it needs to function. We set no advertising cookies, no third-party tracking cookies, and no analytics cookies. Every cookie below is strictly necessary to deliver a service you asked for, which is why you are not shown a consent banner — there is nothing to consent to. If we ever introduce non-essential cookies we will ask first.
- Session cookie — keeps you signed in. HttpOnly and removed when you sign out.
- CSRF token cookie — protects against forged requests from other sites.
- Signup and OAuth cookies — short-lived, holding the state needed to complete a signup or connect an account.
- Interface preference cookie — remembers small choices such as whether the sidebar is collapsed.
12. Children
PostMax is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
13. Changes to this policy
We will update this page when our practices change and revise the date at the top. For material changes affecting how we use your data, we will notify you by email or in the product before they take effect.
14. Contact
hello@postmax.io for anything about this policy or your data.
hello@postmax.io for everything else.