Privacy Policy

If you sign up for an account, visit our marketing website, or contact our support or sales teams, we decide why and how your personal data is used. This Policy governs that relationship, and you should send your requests to us.

If you are a visitor, reader or commenter on a website that someone else built using Postlyo, then that site’s operator decides why and how your data is used. They are the controller; we act only on their instructions.

• The site operator’s own privacy policy governs your data — not this one.
• Requests to access, correct or delete your data should go to the site operator, whose contact details appear on their site.
• If you contact us instead and we can identify the site, we will forward your request to the operator and tell you we have done so. We generally cannot action it ourselves, because the data is not ours to decide about.

We do not use content or audience data from customer sites for our own marketing, and we do not sell it.

• Technical data — IP address, browser type and version, device and operating system, language, timezone, referring URL.
• Usage data — pages viewed in the dashboard, features used, actions taken, timestamps, and measurements used to apply your plan’s limits.
• Security and reliability data — authentication events, request logs, rate-limiting records and error diagnostics, used to detect abuse and keep the Service running.

When someone interacts with a customer’s site, we may process, on that customer’s instructions: comment content and the account that posted it; contact-form submissions (name, email, subject, message); reader accounts registered on that site; and technical data associated with page requests. See section 2.2.

We do not intentionally collect special category data — racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health data, or data about sex life or sexual orientation — and we ask you not to submit it. We do not collect government identifiers, precise location, or financial account data beyond what section 3.1 describes.

We use a small number of vendors to run the Service — for payments, transactional email, hosting and content delivery, storage, databases and internal operational alerting. Each is bound by contract to process data only on our instructions.

The complete, current list is published at Third-Party Services & Sub-processors. Please treat that page as part of this Policy.

You may connect optional third-party services to your site — web analytics, advertising, or search-console reporting. These are off by default. Enabling one instructs us to make that connection, and the third party’s own privacy policy then governs what they do with the data. You are responsible for disclosing these to your visitors and, where the law requires it, obtaining their consent first — see our Cookie Policy.

We may disclose personal data where we believe in good faith it is necessary to comply with a law or enforceable governmental request; enforce our terms; detect or address fraud or security issues; or protect against harm to the rights, property or safety of Postlyo, our users, or the public.

Where we are legally permitted to do so, we will notify you before disclosing your data in response to a legal demand, so you have an opportunity to challenge it.

Content you publish is public by design. Author names, biographies and profile pictures are displayed on your site, and comments are visible to anyone who can see the post. Do not put anything in these fields that you do not want the world to see.

If we are involved in a merger, acquisition, financing or sale of assets, personal data may be transferred as part of that transaction. We will give you notice before your data becomes subject to a materially different privacy policy, and you will be able to close your account.

Email privacy@postlyo.com with the subject line “Privacy Request”, telling us which right you wish to exercise. You may also use the controls in your account settings where available.

• We respond within 30 days, or the shorter period your local law requires. If a request is complex we may extend once, and will tell you why within the initial period.
• We verify your identity in proportion to the sensitivity of the request, and will not ask for more information than necessary.
• Exercising these rights is free. We may charge or decline only where a request is manifestly unfounded or excessive — and we will explain why.
• You may use an authorised agent where your local law provides for it; we will ask for proof of authorisation.

See section 2.2 — send your request to the site’s operator. If you cannot identify them, contact us and we will help route it.

• EEA: your national data protection authority (list at edpb.europa.eu)
• UK: the Information Commissioner’s Office (ico.org.uk)
• India: the Data Protection Board of India, once constituted under the DPDP Act, 2023
• California: the California Privacy Protection Agency, or the Attorney General

We would appreciate the chance to resolve your concern first, but you are not required to come to us before going to a regulator.

Our lawful bases are set out in section 3.1 and summarised here:

• Contract — providing the Service, managing your account, taking payment.
• Legal obligation — tax, accounting, and responding to lawful requests.
• Legitimate interests — securing the Service, preventing fraud, improving the product, and limited marketing to existing customers. You may object at any time.
• Consent — optional cookies, optional marketing, and any integration you enable. You may withdraw it at any time.

Providing account and billing data is necessary to enter into a contract with us; without it we cannot provide the Service.

In the twelve months before the date of this Policy we collected the categories described in section 3 — identifiers, commercial information, internet activity, and any profile details you supply. We collect them from you and from your use of the Service, for the purposes in section 4, and disclose them to the service providers in section 6.1.

We have not sold personal information, and have not shared it for cross-context behavioural advertising. We do not knowingly sell or share the personal information of consumers under 16.

You have the rights to know, delete, correct, and to opt out of sale or sharing (which does not arise for us). Exercise them per section 10.1. We will not discriminate against you for doing so, and we honour Global Privacy Control signals where transmitted.

• We act as a Data Fiduciary for our own customers, and as a Data Processor for data we handle on a customer's behalf.
• You may access, correct, complete, update and erase your personal data, and nominate another person to exercise your rights in the event of death or incapacity.
• Grievance Officer: To be completed by the website owner — name, designation, email and address must be published under the Act.
• If you are not satisfied with our response you may approach the Data Protection Board of India.