Privacy Policy

Last updated: 4 November 2026

Version 3.1

1. Who we are

This policy explains how Vim Digital Oy (Business ID 3186318-3, Helsinki, Finland) processes personal data in the Postapop service at postapop.com and studio.postapop.com. Email: hello@postapop.com. Our Terms of Service and Cookie Policy also apply.

2. Our roles

We are the controller for data about you, your account and your workspaces. For messages and comments that other people send to a channel you connect (the Inbox), the business that owns the channel is the controller. We are its processor and act only on its instructions, given through its use of Postapop and our Terms of Service.

3. What we collect

3.1 Data you give us

Account. Email address, name, password (stored only as a hash), workspace memberships and roles, and settings.
Billing. Your Stripe customer ID, plan, price and currency, subscription and trial status and dates, and orders with their payment status. Stripe collects your card details. We do not store them.
Your content. Posts, drafts, captions, scripts, media, notes, brand details, documents, sources, ideas, schedules, and conversations with Rae, the assistant in Postapop.
Feedback. The ideas you keep or turn down, the ratings and reasons you give, and reports you send with “Send to development”, with a screenshot and technical details of the page.
Support. What you send us, and our replies.

3.2 Data we collect automatically

Usage and technical data. IP address, browser and device details, times, pages and features used, actions in Postapop, and errors.
Country for prices. We use your IP address to estimate your country, so we can show prices in your currency. We do not store the address for this.
Connection code. When you use the guided setup, AI features, Rae's chat, feedback or invitations, we make a code from your IP address and a secret key, with a one-way function. We store the code, not the address. We use the code to count requests from one internet connection, to apply usage limits and to stop abuse.
Service records. Publishing attempts and their results, delivery IDs and errors, AI usage counts, schedules, the emails we sent you, and when you last used Postapop.
Website visits (postapop.com only). When you visit postapop.com, Google Analytics collects the pages you visit, the site or link that sent you, your device and browser type, your approximate location (country and city, from your IP address), and an online identifier kept in the _ga cookie. Decline in the cookie banner stops this. Google Analytics does not store your IP address. The Postapop studio collects none of this.

3.3 Data from other sources

Your connected accounts. Access tokens, the permissions you granted, account and channel IDs, the names, handles and pictures of your channels, and the numbers the platform reports about your posts and channels (section 5).
Messages and comments from other people. When you connect a channel that works with the Postapop Inbox, we receive and store the messages and comments people send to it, including those from the 30 days before you connected it, the display name and platform handle of the person who wrote them, and when they were sent, and the identifiers the platform gives the person, the message and the conversation, and whether a message carried a photo or another attachment, which we need in order to reply. We do not store other people's profile pictures. Where Postapop shows one, it fetches it from the platform when you open the conversation. We hold this for the business that owns the channel, so it can reply. We do not use it for anything else, and we never use it to build profiles or to advertise.
Public web content. For Radar, Voices and Sources, Postapop reads the public pages, news, feeds and videos you choose. We store titles, links, short excerpts, summaries and author or channel names.
Your website. When you share a page or use “Pull from my website”, we read the page and store its text, pictures, logos, fonts and colours.
Invitations. Your email address, from the member who invites you to a workspace.
Stripe. The status of your payments and subscription.

3.4 Is the data required?

You must give account data to have an account, and billing data for a paid plan. Without them we cannot make the contract. Other data depends on the features you use.

4. Why we use data, and the legal basis

To run Postapop: your account and workspaces, your content, planning, writing, scheduling, publishing, results, Radar, Voices, Sources, Strategy, Canva features, Rae and AI suggestions. Basis: contract (GDPR Art. 6(1)(b)).
Inbox: on the instructions of the business that owns the channel (Art. 28). That business chooses its own legal basis.
Billing, trials and payments. Basis: contract; for bookkeeping, legal obligation (Art. 6(1)(c)).
Service emails: security alerts, trial and billing reminders, and notices of changes. Basis: contract. The Monday results email: legitimate interest (Art. 6(1)(f)) in telling you your results. One click stops it.
Setup emails. Two service emails always come: the reminder before your free week ends, and the warning before we clean up an unused workspace (contract). Setup tips go only to a confirmed address and stop with one click (legitimate interest: helping you start to use Postapop).
Security, usage limits and abuse prevention, using logs, usage data and connection codes. Basis: legitimate interest in a safe, working service and fair AI costs.
Improving Postapop from usage data and Feedback. Your Feedback also shapes the next ideas Rae suggests to your workspace. Basis: legitimate interest in a better product.
Website statistics on postapop.com with Google Analytics, to count visits and make the website better. Basis: legitimate interest (Art. 6(1)(f)) in knowing which pages help. You can object at any time: click Decline in the cookie banner, or use Cookie settings at the bottom of the page.
Support. Basis: contract, or legitimate interest in answering you.
Legal duties such as bookkeeping, tax and lawful requests from authorities. Basis: legal obligation.
Legal claims and enforcing our Terms. Basis: legitimate interest.

Where we rely on legitimate interest, you can object (section 10).

5. Connected platforms

5.1 Data from Facebook, Instagram and Threads

When you connect a Facebook Page, an Instagram account or a Threads profile, Meta gives us data about that channel. We use it only:

to show you a list of your own Pages and accounts, so you can choose which ones this workspace uses;
to publish the posts you have written and scheduled;
to read back how those posts performed, and show it to you;
to show you the messages and comments people send to your channel, so you can answer them.

We do not sell this data. We do not combine one customer's data with another customer's. We do not use it for advertising or to build profiles of people. We never use data from Facebook, Instagram or Threads to train AI models.

When a deletion request reaches us from Meta, we remove your Meta identity and every access token you granted, and we confirm with a code and a status page. Posts and statistics stay with the workspace that owns them.

5.2 Connecting YouTube

Postapop uses YouTube API Services to publish to, read numbers from, and read and answer comments on the YouTube channel you connect. By connecting YouTube, you agree to be bound by the YouTube Terms of Service.

When you connect a channel we store its channel ID, title, handle and picture, the permissions you granted, and access and refresh tokens. While it stays connected we store the videos' titles and thumbnails, the numbers YouTube reports for your channel and videos, and the comments on your videos with the name and channel of each person who wrote them.

We use YouTube data only to run Postapop for you: to publish your videos, to show your numbers and our own insights from them (“Rae's read”, including the AI weekly summary), and to show and answer comments in the Inbox. We do not sell it, use it for advertising or profiling, or use it to train AI models. Google's Privacy Policy applies to the data Google processes.

YouTube comments are kept no longer than 30 days after we last saw them. Your videos' titles and thumbnails and your channel's name, handle and picture are fetched again from YouTube at least every 30 days, and we delete any we could not get again within 30 days. Numbers from YouTube are kept while the channel stays connected, and we check every 30 days that you still allow it. If you disconnect the channel in Postapop, we keep its YouTube data for 6 days in case you connect it again, then delete it, always within 7 days of the disconnect. If your permission ends another way, for example on your Google account's security page, we keep the data for up to 7 days and delete it within 30 days of the permission ending. We keep no channel or video IDs, only a one-way scrambled code for each, so we can recognise the channel if you connect it again.

To take Postapop's access away on Google's side, see section 12.

5.3 Connecting TikTok

When you connect TikTok, we receive your TikTok account ID, username, display name and profile picture, access and refresh tokens, and the permissions you grant. Before direct publishing, we also read the account's privacy options, interaction settings and video length limit, to apply TikTok's rules.

When you publish, schedule or send a video to TikTok, we send the video and the details that delivery method supports, and store the delivery ID, status, times and errors. We use TikTok data only for the publishing you ask for. We do not read your TikTok inbox, comments, followers or analytics. We do not sell TikTok data, use it for advertising or profiling, or use it to train AI models. TikTok processes what it receives under its own Privacy Policy.

A disconnect deletes the TikTok connection and its tokens. Content on TikTok, your drafts and the publishing history stay. Publishing records stay with the workspace until it is deleted or you ask us to remove them. Temporary delivery copies are deleted after use. You can also revoke Postapop's access in your TikTok settings.

5.4 Pinterest

When you connect Pinterest, we store your Pinterest username and account type, the permissions you grant, and access and refresh tokens. We use them to list your boards, to publish the Pins you schedule, and to read the numbers Pinterest reports for Pins that Postapop published. We use Pinterest data only to run Postapop for your workspace, and as Pinterest's terms allow.

5.5 Canva and other networks

For Canva, we store the access tokens and permissions. At your request we list your designs and templates, import designs into your media, and send text for a template back to Canva. We publish to LinkedIn, X, Bluesky and some other networks through Outstand (Annex A).

6. AI providers

When you use an AI feature, we send the content that feature needs to an AI provider to make the result. This can include your content, numbers from your channels (for example for topic labels, the weekly summary and Rae's read), and your Feedback when it shapes ideas for your workspace. Our main AI provider is Anthropic. The pictures for your first posts are made by fal.ai. Google reads the YouTube videos that you add as sources, through its paid Gemini API, and does not use this content to improve its products. AI providers act as our processors (Annex A).

7. Who receives data

Our processors, listed in Annex A, on our instructions.
The platforms you connect, when you connect or publish. Their own privacy policies apply.
Stripe, which also acts as an independent controller, for example to prevent fraud.
Other members of your workspace: your content, Feedback, name and email address.
Advisers under confidentiality, and courts or authorities where the law requires it.
A buyer or investor in a sale or reorganisation of our business, under confidentiality.

8. Transfers outside the EEA

We host Postapop with Hetzner in Helsinki, Finland. Some providers are outside the European Economic Area, for example in the United States. These transfers rely on an EU adequacy decision (such as the EU–US Data Privacy Framework) or on the EU Standard Contractual Clauses. You can ask us for a copy of these safeguards.

9. How long we keep data

We keep data only as long as its purpose needs it. We may keep it longer where the law requires it, or for legal claims.

Account data: until you delete the account. Content, Feedback, reports and usage records: while the workspace exists, or until you delete the item.
Files: until you delete them (section 12). When a workspace or account is deleted, we also delete its files from storage, usually at once. A file that we cannot delete at once is deleted by a job that runs every hour. Files of workspaces deleted before 20 October 2026 are deleted on request.
Unused setup workspaces: if a workspace made through the guided setup has no free week, no connected channel, no scheduled or published post, and no member used Postapop for 30 days, we delete its content. We email the owner first, at least 6 days before. Your account and the empty workspace stay.
Website material you do not keep (“Are these yours?”): 7 days.
Feedback in a shared workspace stays with that workspace, without your name, if you leave it or delete your account.
Connection codes: daily counts 90 days; a code saved with a setup record goes with the workspace content.
Access tokens: until you disconnect, access is revoked, or you delete your account.
Messages and comments from other people: while the channel stays connected. We delete them when the channel is disconnected or the account is deleted, and sooner if the business asks us to remove a conversation.
Facebook, Instagram and Threads channel pictures: we keep a copy while the channel stays connected, and get it again from Meta once a day. We delete it when you disconnect, within about a day of a deletion request from Meta, and 30 days after the connection stops working if you do not reconnect.
YouTube data: see section 5.2. TikTok data: see section 5.3.
Billing and accounting records: as long as Finnish accounting and tax law requires.
Google Analytics data about website visits: 2 months, then Google deletes it. The _ga cookies last 2 years in your browser, unless you decline or delete them.
Support messages and logs: as long as needed.
Backups: deleted data can stay in backups for about 3 months.

10. Your rights

You have the right to access your data, to correct it, to have it erased, to restrict its use, to receive it in a portable format, and to withdraw consent at any time. To use a right, write to hello@postapop.com.

You can object at any time, on grounds relating to your situation, to processing based on our legitimate interests, including the use of your Feedback to improve Postapop. You can object to direct marketing at any time.

You can complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or to the authority in your own EU or EEA country.

11. People who do not use Postapop

Inbox senders. If you wrote to a channel that a business connected to Postapop, that business is the controller of the conversation. We process it only so the business can read and answer it. The source is the platform you used. To use your rights, ask the business first. You can also write to us, and we will pass the request on and help the business carry it out.

Authors of public content. If your public article, feed or video appears in a user's Radar, Voices or Sources, we process your name or channel name, the title, the link and short excerpts or summaries, so the user can research topics. The source is the public site or feed. Basis: legitimate interest in a research tool for public material. To object or ask for removal, write to hello@postapop.com.

12. Delete your data

You can remove what Postapop holds about you in these ways:

Disconnect a channel. In Connections, choose Disconnect next to a Facebook Page, Instagram account, Threads profile or other channel. Once the disconnect succeeds, we delete its stored access token, and the rules for each platform in section 5 apply. You can also take Postapop's access to your YouTube channel away on Google's own page, at https://security.google.com/settings/security/permissions.
Delete files. You can delete files you uploaded in Postapop at any time. This removes them from storage. A copy made to deliver a post to Facebook, Instagram or Threads stays with that post until you delete the post.
Delete your account. In Settings, delete your account. We delete your account and the workspaces you own, with their records and their files, also when other people are members. Backup copies, records the law makes us keep, and your Feedback in shared workspaces stay as section 9 says.
Write to us. Email hello@postapop.com and we handle the request by hand.

If you wrote to a business that uses Postapop and want that conversation removed, see section 11.

13. Cookies

We use the cookies and browser storage needed for sign-in, security and your preferences. On postapop.com only, we also use Google Analytics cookies, until you click Decline. The studio uses no analytics cookies. See the Cookie Policy.

14. Changes

When this policy changes, we update the date at the top. We tell you about material changes by email or in Postapop before they take effect.

Annex A: Processors

Hetzner (Helsinki, Finland): hosting, database, file storage and backups.
Anthropic: AI for writing, checking, Rae, summaries and ideas.
Google (Gemini API, paid service): reads the YouTube videos you add as sources.
fal.ai (Features & Labels, Inc., United States): makes the pictures for your first posts.
Perplexity: web research for Radar and research sources.
ElevenLabs: transcribes audio and video sources.
Outstand: publishing to LinkedIn, X, Bluesky and some other networks, and their numbers.
Resend: email delivery.
Stripe: payments. Also an independent controller.
Google Analytics (Google Ireland Limited, Ireland): visitor statistics for postapop.com, until you click Decline. Data may go to Google LLC in the United States, under the EU–US Data Privacy Framework.
Telegram: alerts to the Postapop team, including “Send to development” reports.