Privacy Policy

• Account details: your name, email address and a securely hashed password. If you sign in with Google, we receive your name, email address, profile picture and a Google account ID. We never see your Google password.
• Business profile: business name, category, description, city, WhatsApp number, delivery information, preferred tone and language, and posting times.
• Content you add: product photos and videos, product names, prices and notes, designed Status cards, captions, and post schedules.
• Customer contacts: names and phone numbers you add to your broadcast list, and whether each person opted in.
• Connections: if you connect the WhatsApp Cloud API, your phone number ID, template name and access token (stored encrypted). If you use Power mode, a linked WhatsApp session and the list of groups you belong to.
• Payments: plan, amount, date and a payment reference. Card and bank details are entered on Paystack and never reach our servers.
• Usage data: how many times each order link is tapped (a count only; we don't record who tapped), notification subscriptions for reminders, and standard technical logs from our hosting provider such as IP address, browser type and timestamps.

• To run your account and deliver the features you use: scheduling, captions, Status cards, reminders, broadcasts and Power mode.
• To write captions: when you ask for captions, the photo, product details and business profile for that post are sent to our AI provider to generate suggestions.
• To process payments and keep billing records.
• To keep the service secure, prevent abuse and fix problems.
• To contact you about your account, important changes and support requests.

Our legal bases are performing our contract with you, our legitimate interest in running a secure and reliable service, complying with the law, and your consent where we ask for it (for example, notification reminders, which you can switch off in your browser at any time).

We don't sell your data, we don't show ads, and we don't read your WhatsApp chats.

When you upload customer phone numbers or post to groups, you decide who is contacted and why, so you are the data controller for that information and Postam processes it on your behalf. You are responsible for having your customers' permission to message them, as WhatsApp's own policies also require. We only use those contacts to send the messages you schedule.

We use trusted service providers, each receiving only what it needs:

• Vercel: hosts the website and app.
• Neon: our database, which stores account, business, post and contact data.
• Cloudflare: stores uploaded media and serves it to WhatsApp, and provides our domain and DNS.
• Anthropic: generates captions from the post details you submit. Under its commercial terms, Anthropic does not use these inputs to train its models.
• Inngest: runs scheduled jobs (it sees post IDs and times, not your content).
• Paystack: processes payments.
• Google: provides “Continue with Google” sign-in.
• Meta (WhatsApp): receives the messages, media and recipient numbers you send through the WhatsApp Cloud API.
• Browser push services (for example Google, Apple and Mozilla): deliver reminder notifications to your device.

Some of these providers store or process data outside Nigeria, including in the European Union and the United States. We choose providers with strong security and contractual data-protection commitments so your data stays protected wherever it is processed.

We only use cookies that the service needs to work:

• A sign-in cookie that keeps you logged in (up to 30 days).
• A theme cookie that remembers your chosen appearance.
• Short-lived cookies (10 minutes) that protect Google sign-in from tampering.

We don't use advertising or third-party tracking cookies.

We keep your data while your account is open. If you ask us to delete your account, we delete your account, business profile, media, posts and contacts within 30 days, and copies in backups expire on their normal cycle. We keep payment records for as long as tax and accounting laws require. Expired sign-in sessions are discarded automatically.

All traffic is encrypted with HTTPS. Passwords are stored as one-way hashes, and WhatsApp access tokens are encrypted before they are saved. Access to production systems is restricted. No system is perfectly secure, but we work to protect your data and will notify you and the Nigeria Data Protection Commission as the law requires if a breach affects you.

Under the NDPA you can ask us to:

• give you a copy of your personal data;
• correct data that is wrong or incomplete;
• delete your data or your whole account;
• restrict or object to certain processing;
• send your data to you in a portable format;
• withdraw consent you have given, at any time.

Email hello@postamapp.com from your account email and we'll respond within 30 days. You can update most of your business details yourself in Settings. If you're unhappy with how we handle your data, you can complain to the Nigeria Data Protection Commission (NDPC).

Postam is a business tool for people aged 18 and over. We don't knowingly collect data from children.

If we make meaningful changes, we'll update the date at the top and let you know by email or in the app before they take effect.