Privacy Policy & Data Protection
Your trust is our highest priority. Learn how POSTORA protects your personal information, encrypts social account authorization tokens, and complies with global data privacy regulations.
AES-256 Encryption
All OAuth access tokens and credentials are encrypted at rest.
Zero Data Selling
We never sell, rent, or monetize your personal or content data.
GDPR & CCPA Ready
Full rights to access, export, or permanently delete your account data.
Instant Deletion
Disconnect accounts anytime to trigger immediate token invalidation.
Table of Contents
1 Overview & Operational Scope
Welcome to POSTORA ("we", "us", "our"). POSTORA is a multi-account social media scheduling, automation, inbox management, and analytics platform. This Privacy Policy details how we handle personal data and social network credentials when you visit our website at https://seo.amfahs.com or use the POSTORA application.
By accessing or using POSTORA, you acknowledge that you have read, understood, and agreed to the practices described in this document. If you do not agree with our policies, please refrain from connecting your social media profiles or using our service.
2 Information We Collect
We collect only the minimum necessary data required to deliver seamless social media management across your authorized workspaces:
A. User Account Information
When you register an account, we store your full name, email address, password hash (hashed using bcrypt), company or workspace name, subscription plan choice, and billing record identifiers.
B. Connected Social Profile & OAuth Data
When you authorize POSTORA to manage your social media accounts via OAuth 2.0, we collect:
- Social Platform User/Page/Channel IDs, usernames, display names, and profile picture URLs.
- OAuth 2.0 Access Tokens and Refresh Tokens (encrypted with AES-256).
- Page/Account metrics necessary to render engagement analytics (follower counts, post reach, engagement rates).
C. Scheduled Posts, Media Assets & Text Snippets
To publish posts on your behalf, we temporarily store media files (images, videos), text captions, hashtag groups, text snippets, shortened links, and scheduled publication timestamps.
D. Technical Log Data & Analytics
We automatically collect standard server logs including your IP address, browser type, operating system version, page view timestamps, and error traces for performance monitoring and security auditing.
4 Data Protection & Security Controls
We maintain robust technical, organizational, and physical safeguards to defend your data against unauthorized access, loss, or disclosure:
-
Encryption at Rest & In Transit: All web traffic is forced over HTTPS using TLS 1.3 encryption. OAuth secret tokens and database credentials are encrypted at rest using AES-256-CBC cipher keys.
-
Multi-Tenant Isolation: Workspaces strictly isolate data so team members can only access social accounts, drafts, and analytics belonging to their designated workspace context.
-
Automated Security Scans: Our infrastructure runs continuous dependency checks, rate limiting, CSRF protection, and SQL injection prevention via prepared database queries.
5 Third-Party Sharing & Data Processors
POSTORA does not sell, rent, or trade your personal information or content data. We only share necessary data with trusted cloud service providers bound by strict data processing agreements:
| Processor Category | Purpose | Location & Compliance |
|---|---|---|
| Cloud Infrastructure | Application hosting, database storage & job queues | AWS / DigitalOcean (EU / US Data Centers) |
| Payment Gateways | Subscription billing processing | Stripe / PayPal (PCI-DSS Level 1 Compliant) |
| Transactional Email | Account notifications & password resets | SendGrid / Resend (GDPR Compliant) |
6 Data Retention & Erasure Policy
We retain your personal data and post logs only for as long as your POSTORA account remains active or as required by financial auditing laws:
- Social Tokens: Instantly destroyed upon account disconnect or user deletion request.
- Published Content Logs: Retained for 12 months for analytics dashboard rendering, after which historical records can be purged upon request.
- Media Attachments: Deleted from cloud storage buckets within 30 days of post publication or workspace termination.
7 Your Rights Under GDPR & CCPA
Depending on your location, you hold fundamental rights regarding your personal information:
Right to Access & Portability
You may request a copy of all personal data held in your account format in machine-readable JSON/CSV.
Right to Erasure ("To Be Forgotten")
You can request full, irreversible purging of your user record, connected accounts, and queued drafts.
Right to Rectification
You may update or correct inaccurate personal details at any time in your POSTORA account settings.
Right to Revoke API Consent
You can revoke POSTORA's access directly via Meta, Google, LinkedIn, X, or TikTok account security settings.
8 Social Data & Account Deletion Instructions
If you wish to remove connected social profiles or completely wipe your data from POSTORA, you have two simple options:
Option A: Instant Self-Service Deletion (In-App)
- Log into your POSTORA dashboard at app.postora.com.
- Navigate to Connected Accounts (`/app/accounts`).
- Click the "Disconnect / Remove Account" button next to any social profile. This immediately revokes and purges the OAuth token from our database.
- To delete your entire POSTORA account, go to Settings • Account Security and click "Delete POSTORA Workspace".
Option B: Meta (Facebook & Instagram) Automated Callback Protocol
In accordance with Meta Developer Data Policies, POSTORA supports Meta's official Data Deletion Request Callback protocol via our dedicated endpoint:
- You remove POSTORA access under Facebook Settings • Business Tools / Apps.
- Meta sends a signed callback request to POSTORA's endpoint.
- POSTORA verifies the payload, identifies the user, and revokes all stored Meta OAuth tokens.
- POSTORA purges cached Facebook Page and Instagram profile metrics from our servers.
- POSTORA returns a confirmation code and status URL (Check Status Page).
Option C: Submit Manual Data Erasure Request
If you no longer have access to your POSTORA account or Facebook credentials, email our Data Protection Officer at:
Please provide your registered account email. All manual erasure requests are fulfilled within 48 business hours.
10 Contact Information & Privacy Officer
If you have questions, feedback, or concerns regarding this Privacy Policy or our data protection practices, please contact our privacy compliance team:
POSTORA Data Protection Office
Email: privacy@postora.com
Support Helpdesk: Contact Support Page
Address: POSTORA HQ, Data Privacy Division, 100 Innovation Way, Suite 400
3 Social Media Platform API Compliance
POSTORA interacts directly with official Developer APIs provided by social networks. We adhere strictly to the terms of service and developer policies of each platform:
We use official Facebook Graph API and Instagram Graph API endpoints to publish posts, schedule Reels/Stories, read page metrics, and manage comments. POSTORA complies with Meta Data Use Policies and provides dedicated callback endpoints for Deauthorization and Data Deletion Callback.
We access LinkedIn's Community Management & Share APIs to publish updates on personal profiles and organization company pages. We store access tokens securely and strictly execute publishing jobs requested by workspace members.
We utilize the TikTok Developer API to upload, schedule, and publish video content directly to your TikTok account upon your authorization. We do not store raw TikTok user credentials.
POSTORA's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including Limited Use requirements.