postly.media ← Back to Postly
Legal

Privacy Policy

We built Postly to help businesses do their marketing while keeping their business data and customer relationships private.

Last updated: October 14, 2026

The short versionWe use your information to run Postly for you. We do not sell personal information. Postly’s Google connection for Gmail can only send the emails you approve; it cannot read your Gmail. You can disconnect, or delete your account and data, yourself in Settings.

1. What this policy covers

This policy explains how Postly handles information when you visit postly.media, create an account, or use our AI marketing, CRM, team, calendar, and email tools.

2. Information we process

We process the information needed to provide the service: account details such as your name and email address; your business profile; the content you create or save in Postly; and the client, prospect, calendar, or team information that you choose to enter.

When you ask Postly to find potential customers, results are based on publicly available business pages or public requests. We do not attempt to obtain private contact details.

3. Connected email accounts

Two different ways to connect email. They work differently and have different permissions.

(a) Gmail with Google sign-in (OAuth). If you press “Connect Gmail”, Google asks you to approve one permission: sending email on your behalf. Postly cannot read, list, search, change or delete anything in your Gmail through this connection. Details are in section 4.

(b) Other mailboxes with IMAP and SMTP (app password). You can also connect a mailbox by typing its address and an app password. This can be a Gmail, Outlook, Zoho, or any other address; it does not use Google’s or Microsoft’s APIs and is not covered by Google sign-in permissions. Because IMAP is a mailbox-reading method, Postly does read these mailboxes, in these ways only:

For these mailboxes Postly stores the address, the server settings and the app password, which is encrypted before it is stored (AES-256-GCM) and is never shown in your browser. Disconnecting deletes the app password, the settings and the messages saved from that mailbox. Your email provider remains responsible for its own service and privacy practices.

4. Google user data (Gmail) and the Google API Services User Data Policy

What Postly asks for. If you connect Gmail, Postly asks for one Gmail permission: to send email on your behalf (https://www.googleapis.com/auth/gmail.send), and for your Google email address, so Postly can show which account is connected and use it as the sender. This permission lets Postly send email. It does not let Postly read, list, search, or delete any message in your Gmail account, and Postly does not do any of those things.

How Postly uses it. Postly sends an email through your Gmail account only (a) when you write or review an email in Postly (a new email, a reply, or a draft Postly prepared), confirm it, and press send — one email at a time, to one recipient — or (b) when you have switched on renewal or payment reminders for a specific client, in which case Postly sends the reminder text you set to that client on the dates you chose. The recipients are customers you added or selected in Postly.

What Postly stores. Your Google email address; your Gmail access and refresh tokens, which are encrypted before they are stored and are never shown in your browser; and a record of each email Postly sent for you (recipient, subject, time, and the message ID Gmail returned). The drafts Postly prepares for your customers stay in your private workspace like any other content you create; the text of an email you write in the Compose window is sent and is not kept by Postly. Postly does not store the contents of your Gmail mailbox, because it never receives them.

Limited Use. Postly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we use Google user data only to provide and improve the user-facing features described in this policy; we do not transfer it to others except as needed to provide those features, to comply with the law, or as part of a merger or sale with your notice; we do not use it to serve advertising; we do not sell it; and we do not use it to develop, improve, or train generalised AI or machine-learning models. People at Postly do not read Google user data unless you give your consent for specific data, it is necessary for security purposes such as investigating abuse, or it is required by law.

5. Google Ads data

What Postly asks for. If you connect Google Ads, Postly asks for the Google Ads permission (https://www.googleapis.com/auth/adwords) and for your Google email address. Google offers only this single permission for the Google Ads API, and it is broader than what Postly does with it.

How Postly uses it. For the Google Ads accounts you choose, Postly reads: the list of Google Ads accounts your Google login can open (including accounts under a manager account) with each account’s name, number, currency, time zone, and status; and, for your chosen accounts only, the names, status, type, and daily budget of your campaigns together with their performance numbers (cost, impressions, clicks, and conversions) for the dates you pick. Postly shows these in your Google Ads dashboard, compares them with the previous period, and works out simple ratios such as click-through rate and cost per conversion. Postly makes read-only requests. It does not create, edit, pause, or delete anything in Google Ads and it does not spend money. Postly does not read your keywords, search terms, individual ads, audiences, or billing details. If we add features that use more Google Ads data, we will update this policy before we use that data.

AI insights. If you press “Analyze with AI” in the dashboard, Postly sends the account name, the campaign names, and the performance numbers shown on the page for that account and date range to our AI service provider (Anthropic), which writes a plain-language explanation of them. This happens only when you press the button. Postly does not send your tokens, email address, or any other Google data. The provider is used only to produce the explanation you asked for; it is not used to advertise to you or to train models, and under the provider’s commercial terms the data it receives is not used to train its models. Postly does not save the explanation.

What Postly stores. Your Google email address; your refresh token, encrypted before it is stored and never shown in your browser; the list of accounts described above and which ones you chose; and the time of the last refresh. Postly does not save your campaign or performance data in its database: it reads that data from Google when you open the dashboard and keeps it for up to one minute in the server’s memory, so repeated clicks do not overload Google’s limits. Short-lived access tokens are also kept only in the server’s memory. Only the owner of a Postly account can connect, change, view, or disconnect the Google Ads connection; team members cannot.

The Limited Use commitments in section 4 apply to Google Ads data in the same way.

5A. Meta data: WhatsApp Business and Meta Ads

WhatsApp Business (Cloud API). If you connect your WhatsApp Business Account (through Meta’s Embedded Signup, or with your own Meta app: you paste your number’s credentials, a System User access token and your app secret), Postly receives, through Meta, the messages your customers send to your business number (the sender’s phone number, the profile name WhatsApp provides, the message text and its time) and the delivery status of the messages you send. Postly stores these conversations, your message drafts and your message templates in your private workspace so you can read and manage them. Postly never sends a WhatsApp message by itself: every message is a draft until you approve it, and only then is it sent. A customer who writes STOP is never messaged again. Your WhatsApp access token is encrypted before it is stored (AES-256-GCM) and is never shown in your browser.

Meta Ads (Marketing API). If you connect Meta Ads (with Facebook Login, or by pasting a System User access token from your own Business Manager), Postly asks Meta for permission to read your ad accounts, campaigns, ad sets, ads and their results (ads_read), and, only if you choose to allow it, to create and change campaigns, ad sets, ads, budgets, audiences and creatives in the ad account you pick (ads_management). Postly never publishes an ad, changes a budget or spends money by itself: every campaign, ad set, ad and change is a draft until you review it and approve it, and Meta only receives it after your approval. You can disconnect at any time; Postly then deletes the stored token.

Messenger and Instagram Direct. If you connect your Facebook Page or Instagram professional account to the Social Inbox (with Facebook Login, or with your own Meta app by pasting a Page access token and your app secret), Postly receives, through Meta, the messages people send to that Page or account (the sender’s Meta-scoped id, the message text and time) and stores the conversations in your private workspace. Replies are drafts you approve unless you chose automatic replies and confirmed the authorisation described in the Social Inbox settings. The Page token and the app secret are encrypted before they are stored and are never shown in your browser.

What Postly stores from Meta. Your Meta user id and name; your access tokens, encrypted; the list of ad accounts and WhatsApp numbers you chose; your drafts and the approval records (who approved what and when); and, for WhatsApp, the conversations described above. Postly does not store campaign performance data beyond short-lived summaries used for your reports, and does not sell Meta data or use it for advertising to other people.

Deleting Meta data. You can disconnect WhatsApp or Meta Ads in Postly at any time (the token is deleted first; for WhatsApp you can also delete the stored conversations, messages and templates). You can also remove Postly in your Facebook settings (Settings → Business Integrations) or ask Facebook to delete the data Postly holds: Meta then calls Postly’s data-deletion endpoint, Postly deletes everything it received through that Facebook login and shows a confirmation code on a status page. See postly.media/data-deletion. You can also write to info@postly.media.

5B. Phone numbers

If you buy a phone number through Postly, we process the order details (the number, the country, the price, the time and what you said you will use it for), your prepaid balance and its history, and the confirmation you gave. We send the order to our telecommunications carrier partner, which provides the number and may require identity and address verification in some countries; if it does, you will be asked for that information directly and we will say so before you buy. We keep these records so we can show what you bought and paid, handle refunds, renew or release the number, and meet legal obligations. They are deleted with your account, except where the law requires us to keep accounting records.

5C. Waiting list

If you join the waiting list on our home page, we store the name, email address and (optional) phone number you type, the language of your browser page and the time you signed up. We use them only to tell you when Postly opens and to send launch updates. We do not sell them or share them with advertisers. To be removed, email info@postly.media and we delete your entry.

5D. Google Business Profile

If you connect your Google Business Profile, Postly asks Google for the permission to manage it (business.manage). Postly then reads the names and addresses of your business locations and the reviews customers left there (the reviewer’s public name, the stars, the text and the date), and shows them to you in your private workspace. Postly never publishes anything on your profile by itself: every reply to a review and every post is a draft until you approve it, and only then is it sent to Google. Postly uses this permission only for these functions. Your Google login is stored encrypted and is never shown in your browser. When you disconnect, Postly deletes the stored login, the list of locations and any unsent drafts, and asks Google to revoke the permission; you can also remove Postly at myaccount.google.com/permissions. Postly’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Disconnecting and deleting your data

Disconnect Gmail or Google Ads. In Settings, choose Disconnect. Postly first deletes the stored tokens from its database (and, for Google Ads, the saved list of accounts and your selection). Then Postly asks Google to revoke the permission and tells you exactly what Google answered: removed, already removed, or failed. If Google cannot be reached, the tokens are still deleted in Postly, you are told the permission may still exist at Google, and you can remove it yourself at myaccount.google.com/permissions. Gmail and Google Ads use the same Google app, so if the same Google account is connected for both, disconnecting only one of them deletes that connection in Postly but does not ask Google to revoke, to avoid breaking the other connection; Postly tells you this. Disconnecting the last one asks Google to revoke.

Delete your account. In Settings → Account → Delete my account, enter your password and type DELETE. Postly then permanently deletes your account and the workspace it owns: business profile, customers and leads, emails and drafts, Social Inbox conversations and messages, voice data and call recordings, campaigns, reports, calendar and team data, notifications, and every connection and stored token (Gmail, Google Ads, Meta, Microsoft, IMAP mailboxes). If Gmail or Google Ads was connected, Postly asks Google to revoke access and tells you the answer. This cannot be undone. Team members you invited keep their own sign-in accounts but lose access to your workspace. If you are a team member, deleting your account deletes only your own account: calendar events and team chat messages you made for your owner’s workspace stay with the owner, and your name on those messages is replaced by “Former team member”.

What remains after deletion. (1) A deletion record with no name, email, or user ID: the date, whether it was an owner or team member account, and what Google answered when asked to revoke. (2) Anonymous message IDs and times in our WhatsApp sending log, used for sending limits, with your account reference removed. (3) Anything already delivered to other people or services, such as emails sent to your customers, messages sent through WhatsApp, Instagram or Messenger, posts published to Meta, and text already processed by our AI providers under their own terms; Postly cannot recall these. (4) Information we are required by law to keep, if any.

If you cannot sign in. Email info@postly.media from the email address you registered with and we will delete your account the same way and confirm when it is done.

7. How we use information

We use information to operate and secure Postly, generate the marketing work you request, save your private workspace, send emails you approve or schedule, provide support, and improve the reliability of the service.

8. When information is shared

We do not sell personal information, and we do not use your client data for another Postly customer. We share information only with the services needed to run the features you use, and when required by law:

Each provider handles data under its own terms. Google user data received through Gmail or Google Ads is never sent to a provider other than as described in sections 4 and 5.

9. Your choices and access

You control the business, client, and team information in your account. You can edit or delete content in Postly, disconnect Gmail, Google Ads and other connections, switch off optional features, and delete your account yourself (section 6). You can also contact us to ask for access to your data or for help with deletion, subject to legitimate security and legal obligations.

10. Security and retention

Security measures in place.

No online service can guarantee absolute security.

How long we keep information.

11. Changes to this policy

We may update this policy as Postly changes. We will post the latest version on this page and update the date above.

12. Contact

For privacy questions or requests, email info@postly.media or call +961 81 985 904.

Postly.media is operated by Digicore Solutions S.A.R.L, Office 305, Tower 44, Dekweneh, Beirut, Lebanon.