Privacy Policy

This Privacy Policy explains how Postia ("Postia", "we", "us", "our") collects, uses, and protects personal data when you visit our website, create an account, or use the Postia service (the "Service").

Postia is operated by My Viral Vault LTD ("we", the "data controller" for the purposes described below). If you have any questions about this policy or how we handle your data, contact us at support@getpostia.com.

This policy should be read alongside our Cookie Policy, Acceptable Use Policy, and, if you are a business customer, our Data Processing Addendum.

1. What This Policy Covers

This policy applies to personal data we process about:

• Visitors to our website
• People who sign up for a free trial or paid account ("Customers")
• People whose personal data appears within the content Customers upload or connect to Postia (for example, names or contact details that might appear in an Etsy listing export)

If you are a Customer, you remain responsible for the data in your own Etsy listings and Pinterest account — see our Data Processing Addendum for how that split of responsibility works.

2. What Data We Collect

2.1 Account and billing data

When you sign up, we collect your name, email address, and business/shop name. When you subscribe to a paid plan, billing is handled by Stripe, our payment processor — we do not store your full card details ourselves.

2.2 Pinterest account data

When you connect your Pinterest account, we access it via Pinterest's official API using OAuth. Depending on the permissions you grant, this may include your Pinterest username, boards, pin content, and basic account/profile information, solely so we can create and schedule pins on your behalf. We do not post anything to Pinterest without your prior approval of that specific pin.

2.3 Etsy listing data (customer-uploaded CSV)

To generate pins, you upload or import a CSV export of your Etsy listings (or, where available, connect via an approved integration). This typically contains listing titles, descriptions, prices, images, and URLs. This data may occasionally contain personal data if you've included it in a listing — you are responsible for ensuring you have the right to share any such data with us.

2.4 Usage and analytics data

We use Google Analytics to understand how visitors use our website and app (pages viewed, general location at country/city level, device and browser type, referral source). See our Cookie Policy for details on how this is collected and how to opt out.

2.5 Communications

If you email us, use in-app chat, or reply to our emails, we keep a record of that correspondence to provide support and improve the Service.

3. How We Use Your Data

We use personal data to:

• Create and manage your account and provide the Service (importing listings, generating pins, scheduling posts)
• Process payments and manage your subscription
• Send service-related communications (onboarding, billing, security, and support emails)
• Send marketing emails where you have opted in, or where permitted by law for existing customers about similar services (you can opt out at any time)
• Monitor, maintain, and improve the Service, including troubleshooting and analytics
• Detect and prevent fraud, abuse, or breaches of our Acceptable Use Policy
• Comply with our legal obligations

4. Our Legal Basis for Processing

Where UK GDPR / EU GDPR applies, we rely on:

• Contract — to provide the Service you've signed up for (account data, Pinterest connection, Etsy imports, billing)
• Legitimate interests — for product analytics, security, fraud prevention, and direct marketing to existing customers about similar features
• Consent — for non-essential cookies and marketing emails to new leads, which you can withdraw at any time
• Legal obligation — for tax, accounting, and regulatory record-keeping

5. Who We Share Data With

We don't sell personal data. We share data with:

• Sub-processors who help us run the Service, currently:
  • Replit — application hosting and infrastructure
  • Stripe — payment processing
  • Google Analytics (Google LLC) — website and product analytics
  • ConvertKit — sending account, billing, and marketing emails
  • Pinterest — solely to the extent needed to post content you've approved to your connected account
• Professional advisers (accountants, lawyers) where necessary
• Authorities, where required by law, to comply with legal process, or to protect our rights, users, or the public

A full sub-processor list is maintained in our Data Processing Addendum for business customers.

6. International Data Transfers

Some of our sub-processors (including Google and Stripe) may process data outside the UK/EEA, including in the United States. Where this happens, we rely on appropriate safeguards such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, or the recipient's participation in an approved data protection framework.

7. Data Retention

We retain personal data for as long as your account is active, and for a reasonable period afterward to comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. Etsy CSV data and generated pin content are retained for as long as needed to provide the Service and are deleted within a reasonable period after account closure, unless we're required to keep it longer by law.

8. Your Rights

If UK GDPR or EU GDPR applies to you, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Restrict or object to certain processing
• Request a portable copy of your data
• Withdraw consent at any time (where processing is based on consent)
• Complain to your local data protection authority — in the UK, the Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, contact us at support@getpostia.com.

9. Data Security

We use industry-standard technical and organisational measures to protect your data, including encryption in transit, access controls, and working with reputable infrastructure providers. No system is completely secure, and we can't guarantee absolute security, but we take reasonable steps to protect your information and to notify affected users and authorities if a breach occurs where we're legally required to.

10. Children's Privacy

Postia is a business tool intended for users aged 18 and over. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this policy from time to time. We'll update the "Effective date" above and, for material changes, notify active customers by email or in-app notice.

12. Contact Us

Questions, requests, or complaints about this policy or your data: