Privacy Policy

1Overview and Scope

This Privacy Policy explains how Lunark Dynamics LLC collects, uses, discloses, stores, retains, protects, and deletes personal data in connection with Postaryx. Postaryx is operated by Lunark Dynamics LLC.

This Policy applies to visitors to our public websites, prospective and current customers, Account holders, Workspace members, people who communicate with us, and individuals whose information is processed through enabled Service features. It also explains how Postaryx handles data from Connected Platforms when a user authorizes an integration.

Connected Platforms have their own privacy notices, developer terms, and user controls. This Policy describes Postaryx’s processing; it does not replace the privacy policies of Facebook, Instagram, Threads, LinkedIn, TikTok, Google, YouTube, Pinterest, Reddit, X, or other third-party services.

2Data Controller

For personal data that Lunark Dynamics LLC determines the purposes and means of processing — such as Account registration, billing administration, website operations, security, direct communications, and legal compliance — Lunark Dynamics LLC generally acts as the data controller, business, or equivalent responsible entity under applicable privacy law.

Controller: Lunark Dynamics LLC

Registered address: 30 N Gould St Ste R, Sheridan, WY 82801

3Controller / Processor Roles for Customer Data

For User Content and other personal data that a customer or Workspace submits to Postaryx and instructs us to process through the Service, Lunark Dynamics LLC may act as a processor, service provider, contractor, or equivalent role under applicable privacy laws, depending on the nature of the processing and the applicable jurisdiction.

In such cases, the customer generally determines the purposes and means of processing and remains responsible for ensuring a lawful basis for processing, providing appropriate privacy notices, obtaining required consents or permissions, handling individual rights requests, and providing lawful instructions to Postaryx.

Where applicable, Postaryx may provide additional data processing terms, including a Data Processing Addendum (DPA), to business customers that require such arrangements. If a signed DPA or enterprise agreement conflicts with this Privacy Policy regarding processor obligations, the signed agreement will control for the specific processing activities covered by that agreement.

Connected Platforms may independently act as controllers or equivalent entities for data processed through their own services. Authorizing Postaryx to connect with a Connected Platform does not transfer responsibility for that platform’s independent processing activities to Lunark Dynamics LLC.

4Information We Collect

4.1Account and Identity Data

• Name, email address, password hash or authentication identifier, profile image, language, timezone, organization or company name, role, and Account preferences.
• Sign-up, login, password reset, verification, multi-factor authentication, session, and account-recovery information where those features are enabled.
• Information made available by a third-party sign-in provider if you choose a supported federated login method.

4.2Workspace and Team Data

• Workspace name, member list, invitations, team roles, administrator assignments, permissions, client/workspace relationships, approval activity, and configuration settings.
• Audit or activity records showing actions taken in a Workspace where those records are enabled.

4.3Connected Platform and OAuth Data

• OAuth access tokens, refresh tokens, authorization codes, scopes/permissions, token expiration or refresh information, revocation status, app/client connection identifiers, and related authorization metadata.
• Platform account, member, Page, profile, organization, business, channel, board, subreddit, workspace, server, site, or other identifiers returned by a Connected Platform.
• Usernames, display names, profile images, account types, Page/channel names, roles or administrative relationships, and other account metadata needed to present or validate a connection.
• Platform data described in the platform-specific sections below, including posts, media, publishing status, analytics, comments, replies, business/listing data, and other permitted fields if the corresponding feature is enabled.

4.4User Content and Media

• Drafts, captions, post text, hashtags, links, images, video, audio, thumbnails, alt text, notes, approval comments, content-calendar entries, publishing times, media metadata, files, and other content you upload or create.
• Processing derivatives needed to deliver content, such as resized images, transcoded media, thumbnails, public delivery URLs, previews, or temporary upload objects, where required by a Connected Platform.
• Published-post identifiers, status responses, error messages, retry data, and other records used to track the result of a requested action.

4.5Billing and Transaction Data

• Plan, subscription status, free-trial status and trial end date, invoice history, billing email, billing address, tax information, currency, payment status, and transaction or invoice identifiers.
• Limited payment-method metadata, such as card brand and last four digits, where our payment provider makes it available to us.

When billing features are enabled, payment processing may be handled by a third-party payment provider identified at checkout and in this Policy. Payment card details would be entered on that provider's own hosted checkout page and handled by that provider. Postaryx does not receive or store full payment card numbers, card security codes, or bank credentials. What would reach Postaryx is billing contact details, subscription and trial status, transaction and invoice identifiers, and the limited payment-method metadata described above.

4.6Usage, Device, Log, and Security Data

• IP address, browser type, operating system, device type, language, approximate location derived from IP where used, referring URL, request timestamps, and session identifiers.
• Pages and features used, API requests, publishing attempts, successes/failures, performance information, system errors, connection-health events, rate-limit events, and operational metrics.
• Authentication, password-reset, authorization, security, audit, abuse-prevention, and incident-investigation records to the extent logged in production.

4.7Support, Sales, and Communications

• Support requests, emails, chat messages, bug reports, feedback, survey responses, sales communications, attachments, and records of interactions with our team or service providers.
• Marketing communication preferences and engagement information where marketing messages are used and such tracking is permitted.

4.8Cookies and Similar Technologies

We use cookies and browser storage for authentication, for security, to remember your interface preferences, and to understand how you arrived at the Service, as described in the Cookie Policy. Postaryx does not currently enable analytics or advertising cookies.

4.9AI-Assisted Features

Postaryx offers optional AI-assisted features, which may include AI-assisted text generation, image generation, video generation, content transformation, and other AI-supported workflows. These features run only when you choose to use them, and they are never applied to your content automatically.

When you use one, the content you submit for that action — the draft text, the prompt, or other content you submit for that feature, together with the parameters needed to carry out the request — is sent to the third-party provider that powers that feature, which processes it in order to return the result.

The provider used depends on the AI-assisted feature. AI-assisted text features and prompt-to-image generation are provided by OpenAI. If Postaryx introduces AI video generation or another AI-assisted feature using a different provider, that provider will be identified in the Subprocessor section of this Privacy Policy before it begins processing personal data for that feature.

Postaryx does not use your content to train models and does not send your content to any AI provider for any purpose other than producing the result you asked for. The result returned to you is stored in your Workspace in the same way as the rest of your content and is covered by Section 14. You remain responsible for reviewing, editing and approving any AI output before you publish it. How long a provider keeps a request on its own systems is governed by that provider's terms rather than by Postaryx.

If you would prefer that no content be sent to an AI provider, do not use these features. They are not applied to your content automatically.

5Sources of Information

We collect information directly from you and other Workspace users, automatically through your use of the Service, from our payment/support/infrastructure providers, and from Connected Platforms when you authorize access. We may also receive business contact information from legitimate sales or support interactions, subject to applicable law.

For Connected Platform data, the categories available to Postaryx depend on the scopes you grant, the platform’s API, your account type, your role on the relevant asset, and the enabled Postaryx feature.

6How We Use Information

• Provide, authenticate, operate, and maintain Accounts and Workspaces.
• Connect authorized third-party accounts, validate permissions, refresh or check connection health, and display connected assets.
• Store drafts and media, schedule content, publish at your direction, retrieve publication status, retry permitted failures, and display results.
• Retrieve and display platform analytics, comments, replies, profile/Page/channel information, or other permitted data when those features are enabled.
• Manage roles, team collaboration, approval workflows, notifications, and account administration.
• Process subscriptions, invoices, taxes, refunds, failed payments, fraud prevention, and billing support.
• Protect the Service, users, Connected Platforms, and third parties by detecting abuse, account takeover, credential compromise, malicious traffic, rate-limit evasion, or policy violations.
• Provide optional AI-assisted features when you choose to use them, by sending the content you submit for that action to our AI subprocessor.
• Monitor, debug, test, measure, maintain, and improve the Service and integration reliability.
• Send transactional or service communications such as receipts, security alerts, failed-post notices, reconnect notices, policy notices, and support responses.
• Send marketing communications where permitted by law and subject to opt-out or consent requirements.
• Comply with legal obligations, enforce our agreements, respond to valid legal process, protect rights and safety, and establish or defend legal claims.
• Create aggregated or de-identified information where permitted by law, provided it is not reasonably capable of identifying an individual.

7Legal Bases Where GDPR, UK GDPR, or Similar Laws Apply

• Contract: processing needed to create Accounts, provide requested Service features, publish at your direction, manage subscriptions, and support customers.
• Legitimate interests: operating, securing, debugging, measuring, preventing abuse, communicating about the Service, and improving reliability, balanced against applicable individual rights.
• Consent: where required for non-essential cookies, certain marketing communications, optional integrations, or other processing for which consent is the appropriate legal basis.
• Legal obligation: tax/accounting records, regulatory obligations, lawful requests, sanctions compliance, and other duties imposed by law.
• Vital interests or public-interest grounds: only where applicable in exceptional circumstances.

OAuth authorization is a technical authorization mechanism by which a platform user grants Postaryx specified permissions. The appearance of an OAuth “consent” screen does not by itself determine the privacy-law legal basis for every processing activity.

8Platform-Specific Data Handling

Connected Platforms become available progressively. Several platforms require their operator to approve Postaryx before an integration can be offered, and a platform is not available to you until that approval is in place and the integration is enabled in the product.

The subsections below describe how Postaryx handles data for a given platform if and when you connect it. They are disclosures about our handling of platform data, not a statement that every platform listed is available today. A subsection applies to you only once you have connected that platform, and the permissions you are asked to grant are always the ones shown to you in that platform’s own authorization screen.

8.1Meta Platform Data — Facebook Pages

When you connect a Facebook Page through a Meta-authorized flow, Postaryx may receive and process OAuth Data and permitted Page data necessary to let you identify an eligible Page, connect it to a Workspace, publish content at your direction, and display related status or analytics if those features are enabled.

Data Postaryx may access: Meta user/account identifiers needed for authorization; Page IDs; Page names; profile or Page images; administrative or Page-selection relationships; Page metadata and content permitted by the granted scopes; User Content and media you direct us to publish; published-post IDs and status; and, only if enabled and approved, engagement, comments, replies, or insights/analytics.

Permissions: the specific permissions requested are displayed in Meta’s authorization flow, and Postaryx requests only those needed for the functions it provides. These may include permission to list Pages you administer, read Page metadata, and manage posts, and — only where the related feature is enabled — read insights or manage engagement.

Purpose: to let you select an authorized Facebook Page, render the connection in Postaryx, publish or manage posts at your direction, confirm delivery, provide historical publishing records, and display permitted analytics or engagement features that you choose to use.

Storage and retention: active OAuth Data is retained while the connection is active and is erased from live systems when you disconnect the Page, subject to limited backup cycles. Page identifiers, publishing records, and permitted analytics may be retained while the Account/Workspace is active when needed for the requested Service, unless a shorter platform rule applies or you delete them.

Deletion: you may disconnect the Page in Postaryx and/or revoke access from Meta. Account deletion follows Section 15 and the Data Deletion Instructions. When the Meta integration is enabled for production, Postaryx will provide and maintain the Meta Data Deletion Request Callback or other deletion mechanism required by Meta for the applicable integration.

Sharing: we disclose this data to Meta when carrying out your requested actions and to the subprocessors listed in Section 11. We do not sell Facebook Page data or provide it to ad networks or data brokers for their independent advertising or brokerage purposes.

8.2Meta Platform Data — Instagram

When you connect an eligible Instagram account, Postaryx may process OAuth Data and Instagram account information made available through the authorized integration path.

Data Postaryx may access: Instagram account or business identifiers, username/display name, profile image, account type or eligibility information, User Content and public-media delivery references, captions, publishing container/status identifiers, publication results, platform limits/status, and — only if enabled and approved — insights or other permitted analytics.

Authorization paths: Postaryx may support an Instagram Login path and/or a Facebook Login path depending on the production implementation, Meta approval, and user account setup. The scopes shown by Meta are the authoritative permissions requested for that connection.

Purpose: to identify the Instagram Professional account you chose, prepare and deliver User Content, monitor platform processing/publishing status, display publication history, and provide permitted analytics where enabled.

Media processing: where Instagram requires media to be retrievable from a public URL, Postaryx hosts a delivery copy on its own infrastructure. That copy exists so the platform can fetch the media you asked us to publish, and it is subject to the retention rules in Section 14.

Storage, retention, deletion, and sharing: OAuth tokens and connection metadata are retained while the connection is active; publishing records and content are retained as needed to provide the Service; disconnecting erases the stored authorization data from our live systems as described in Section 15; and data is shared only with Meta and necessary subprocessors for the requested Service, legal/security purposes, or other disclosures described in this Policy.

8.3Meta Platform Data — Threads

When you connect a Threads profile, Postaryx may process OAuth Data, account/profile identifiers, basic profile information, User Content, media, publishing status, and — if approved and enabled — replies or insights.

Permissions: the production app may request basic account access and content-publishing permission, plus reply-management or insight permissions only if those features are actually offered and approved. Users see requested scopes during the platform authorization flow.

Purpose: to connect the selected Threads profile, publish content at your direction, display status and history, and provide optional reply or analytics features where enabled.

Token lifecycle: Meta token lifetimes and refresh requirements may change. Postaryx monitors the health of a connection, refreshes authorization where the platform permits it, and notifies you when a connection needs to be re-established.

Deletion and sharing: disconnecting the integration erases the active authorization data and stops further access; data is shared with Meta and necessary subprocessors only for the purposes described in this Policy.

8.4Platform-Required Deletion Mechanisms

Some platforms require a service to expose a technical endpoint that the platform itself can call to request deletion of a user’s data, in addition to the deletion routes offered directly to users.

Postaryx will implement additional platform-required deletion mechanisms before enabling integrations that require them. Whether or not such a mechanism applies to a given platform, you can always request deletion of your data directly, as described in Section 15 and in the Data Deletion Instructions.

8.5LinkedIn Data

When you connect a LinkedIn member account or LinkedIn Page/organization, Postaryx may process OAuth Data and the minimum LinkedIn data needed for the enabled approved use case.

Member/account information: member/account identifier, name or display name, profile image, login/identity information returned through approved sign-in scopes, and personal-profile publishing data where that feature is supported.

Organization/Page information: organization/Page IDs, names, logos/images, administrative relationship information, content, publishing status, and other approved Page-management data.

Publishing and community data: User Content you direct us to publish, post identifiers/status, and — only where a declared and approved use case requires it — comments, comment content, and limited commenter/member fields displayed in Postaryx.

Purpose: authorized content scheduling and publishing, Page/profile management, permitted comment display or engagement workflows, and related analytics or status functions that are actually enabled.

Restricted use: Postaryx does not use LinkedIn data for prohibited scraping, lead extraction, unauthorized aggregation, resale, data enrichment, or automation-at-scale that conflicts with LinkedIn developer restrictions.

Storage and deletion: active OAuth Data is retained while connected and is erased from live systems when you disconnect the integration. Other LinkedIn-derived data is retained only as needed for approved functionality and the retention schedule in this Policy, subject to any stricter LinkedIn rule. Account deletion removes associated platform-derived data from active systems except lawful retention and backup cycles.

Sharing: data is shared with LinkedIn to carry out user-directed actions and with necessary subprocessors. We do not sell LinkedIn data or provide it to ad networks/data brokers for their independent use.

8.6TikTok Data

When you connect TikTok, Postaryx may process OAuth Data and data required for the TikTok Content Posting functionality you choose to use.

Account information: TikTok account identifier, creator nickname/display information and other basic account information returned through the approved login/account scopes, plus posting eligibility or creator information used to show which account is being targeted.

Publishing data: user-supplied photos/videos, title/caption, media delivery information, publishing status, privacy selection, available interaction settings such as comments/duet/stitch, commercial-content selection, and platform responses needed to complete or display the requested publish operation.

OAuth permissions: the authorization screen shows the actual scopes requested, which may include basic account information and direct publish/upload permissions appropriate to the media type and production feature.

Purpose and user control: to identify the connected creator, let you prepare and preview your own supplied content, present platform-required privacy and disclosure choices, obtain the user action required to publish, transmit the media, and show processing status. Postaryx does not preselect a privacy choice on your behalf and does not bypass platform-required disclosures.

Storage and deletion: OAuth Data and connection metadata are retained while connected; user media and publishing records are retained under the general content-retention schedule; disconnecting stops further access and erases the stored authorization data from our live systems, as described in Section 15.

Sharing: TikTok data is sent to TikTok for the publish flow and processed by necessary Postaryx subprocessors. We do not sell TikTok data or provide it to ad networks/data brokers for independent advertising or brokerage.

8.7Google and YouTube Data

When you authorize a Google or YouTube connection, Postaryx may process OAuth Data and data from the Google APIs or YouTube API Services needed for the approved functionality.

Channel/account information: Google account identifiers returned to the app as permitted, YouTube channel ID, channel title/name, channel image or metadata, and other fields needed to display and manage the authorized channel.

Upload/publishing data: video files supplied by you, titles, descriptions, thumbnails, privacy/publishing settings, upload status, video IDs, playlist/upload references, and API responses needed to publish and track an upload.

Analytics: where the required API permissions are approved and the feature is enabled, Postaryx may retrieve channel or content analytics and display them in your Workspace.

OAuth permissions: YouTube publishing may require sensitive or restricted Google OAuth scopes. The Google consent screen displays the scopes actually requested. Postaryx requests only the scopes necessary for the features it offers, and maintains any verification or assessment Google requires for them.

Purpose: to let you select an authorized channel, upload/publish content, display upload status and identifiers, manage approved channel functions, and show analytics where enabled.

Storage and revocation: active OAuth Data is retained while the connection remains active; upload records and channel metadata are retained under the applicable schedule. You may disconnect the channel in Postaryx, which erases the stored credential and asks Google to revoke the authorization, or revoke access yourself from your Google Account permissions. Revocation stops future API access using the revoked credential.

YouTube-specific restriction: Postaryx operates through authorized publishing and management APIs and is not an unofficial YouTube downloading or circumvention service. Where the applicable YouTube terms require video to be displayed through official mechanisms, Postaryx uses them.

Sharing: data is shared with Google/YouTube for user-directed actions and with necessary subprocessors. We do not sell Google/YouTube API data or provide it to data brokers/ad networks for independent use.

8.8Google Business Profile Data

If Google Business Profile functionality is enabled and approved, Postaryx may process OAuth Data and user-owned business/location information such as account or location IDs, business name, address, categories, listing metadata, media, post/update content, publishing status, and permitted performance information.

We use this data to display locations the authorized user may manage, perform requested listing or post actions, and present permitted performance or status information. Active OAuth credentials are retained while the connection is active and are erased from our live systems when you disconnect, as described in Section 15. Business Profile data is shared with Google and necessary subprocessors only for the requested functionality and other purposes described in this Policy.

8.9Pinterest Data

When you connect Pinterest, Postaryx may process OAuth Data and the Pinterest account/board/Pin information necessary for approved publishing and account-selection features.

Data Postaryx may access: Pinterest user/account identifiers, board IDs/names and minimal board metadata, Pin IDs and permitted metadata, User Content to create Pins, destination URLs, publication status, and other fields permitted by the approved scopes.

Permissions: Postaryx requests a minimal scope set for the functions it offers, such as account read access and the board and Pin permissions required to publish.

Storage restriction: Pinterest restricts how long API-derived data may be cached or retained. Postaryx minimizes the Pinterest data it holds and applies a short retention period to platform-derived metadata, consistent with Pinterest’s current rules. Content you created and Postaryx’s own publishing records are treated separately where the platform’s rules permit.

Deletion: disconnecting the integration erases the active OAuth Data; cached platform-derived metadata expires or is deleted according to the applicable Pinterest retention rule and the account-deletion process.

Sharing: data is shared with Pinterest for authorized actions and with necessary subprocessors. We do not sell Pinterest API data or provide it to ad networks/data brokers for independent use.

8.10Reddit Data

When a Reddit integration is enabled and the required platform access conditions are satisfied, Postaryx may process OAuth Data, Reddit account identifiers/username, authorized subreddit/community information, subreddit rules or posting constraints made available through the API, User Content, flair or destination selections, post IDs/status, and comments or other data only if an enabled approved feature requires them.

We use this information to connect the authorized account, help you select a destination, surface relevant posting constraints where available, publish at your direction, and display status/history. Postaryx may apply rate limits or anti-spam controls to protect the shared API client and comply with platform rules.

Reddit commercial API use may require express written approval or another commercial arrangement. Postaryx may restrict the integration until that condition is met. The Service may identify itself to Reddit using a descriptive User-Agent or other platform-required client information.

Active OAuth Data is retained while connected and is erased from our live systems when you disconnect, as described in Section 15. Reddit data is shared with Reddit for requested actions and with necessary subprocessors; it is not sold or provided to ad networks/data brokers for independent use.

8.11X Data

When you connect X, Postaryx may process OAuth Data, X account identifier/username/profile metadata, User Content and media, post IDs/status, and permitted analytics or owned-account data if those features are enabled.

Depending on the production architecture, Postaryx may use platform credentials managed by Lunark Dynamics LLC or may permit you to supply your own developer credentials. Customer-supplied API keys, client secrets, or similar credentials are treated as sensitive authentication data. They are held only for the integration you requested, kept out of application logs, and deleted when that integration is removed.

We use X data to connect the authorized account, publish requested content, show delivery status/history, and provide any permitted analytics. We share it with X and necessary subprocessors only for the Service and other disclosures described in this Policy.

8.12Other Connected Platforms

Postaryx may support additional services such as Discord, Slack, Telegram, Bluesky, Mastodon, Nostr, Farcaster, Lemmy, Twitch, Kick, Dev.to, Hashnode, WordPress, Dribbble, Whop, Listmonk, MeWe, Skool, Moltbook, and other integrations that may be added or removed over time.

Depending on the connector, Postaryx may receive account or workspace identifiers, profile/site/server/channel information, content and media, publishing status, analytics, OAuth tokens, API keys, application passwords, bot tokens, per-instance credentials, or other authorization material that you provide or authorize.

For credentials with unusually high sensitivity — such as application passwords or cryptographic private-key material — Postaryx holds them only for as long as the connection you requested needs them, keeps them out of application logs, restricts access to them, and provides a route to remove them by deleting the connection.

Beta or experimental integrations may rely on evolving platform APIs. Their data practices remain subject to this Policy, but data categories and availability may change with the connector. Material new data uses will be reflected in an updated policy.

9Data Minimization; No Sale; No Data-Broker or Ad-Network Use

Postaryx is intended to request and retain only the platform permissions and data reasonably necessary for enabled features. Platform review requirements may further limit which fields can be cached or retained.

Lunark Dynamics LLC does not sell OAuth tokens, Connected Platform credentials, User Content, or Platform Data. We do not provide Connected Platform data to ad networks or data brokers for their independent behavioral advertising, audience enrichment, or data-broker purposes.

Postaryx does not currently enable advertising or third-party analytics technologies on its website or in the application. If Postaryx introduces technologies that constitute a “sale,” “sharing,” or “targeted advertising” under applicable privacy law, this Policy and the Cookie Policy will be updated and the opt-out mechanisms required by that law will be provided.

10How We Share Information

• Connected Platforms: when you authorize a connection or instruct us to publish, retrieve data, or perform another platform action.
• Subprocessors/service providers: the vendors listed in Section 11, which provide infrastructure, database hosting, website hosting and the optional AI-assisted features, together with any provider we add for an operational service and disclose in that section. Each is subject to contractual and privacy requirements appropriate to the service.
• Workspace members: according to the roles, sharing settings, and permissions configured by the customer.
• Professional advisers: accountants, lawyers, auditors, insurers, banks, and similar advisers under appropriate confidentiality obligations.
• Authorities and protective disclosures: where required by law, valid legal process, regulator request, or where reasonably necessary to investigate fraud, abuse, security threats, rights violations, or risks to users/platforms.
• Corporate transactions: to a buyer, investor, lender, successor, or professional adviser in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to applicable law.
• With your direction or consent: where you instruct us to make a disclosure or separately authorize it.

11Subprocessors

Postaryx relies on the service providers listed below to operate the Service. Each provider processes personal data only as necessary to deliver the function described and is subject to contractual and privacy requirements appropriate to that service.

Uploaded media and files are stored on the same infrastructure that runs the Service rather than with a separate object-storage or content-delivery provider. The exception is the AI-assisted features above: when you invoke one, the content for that request is sent to the provider that powers it, as described in Section 4.9.

No payment provider is listed above. When billing features are enabled, payment processing may be handled by a third-party payment provider identified at checkout and in this Policy, and that provider will be added to the list above before it begins processing personal data. Payment card details would be entered on that provider's own hosted checkout page; Postaryx does not receive or store full payment card numbers, card security codes, or bank credentials.

Postaryx may replace or add subprocessors as the Service evolves, including an object-storage, content-delivery, or transactional email provider. Where required by applicable law or contractual obligations, Postaryx will provide notice of material changes to subprocessors, and this list will be updated before a new subprocessor begins processing personal data.

12Hosting, Infrastructure, and International Transfers

Postaryx uses cloud infrastructure providers to operate the Service. The application, its supporting services, and the PostgreSQL database all run on Oracle Cloud infrastructure. The database is deployed and administered by Postaryx inside its own containers on that infrastructure rather than being obtained as a managed database service from a third party, and its data is stored on the same infrastructure.

The public marketing website at postaryx.com is hosted separately from the Service, by the provider listed in Section 11. It holds no Account, Workspace or Platform Data.

Uploaded media and static assets are served from the same infrastructure that runs the Service. Requests to a Connected Platform are sent to that platform's own infrastructure, which the platform operates under its own privacy policy.

Postaryx may maintain backups according to infrastructure configuration and operational requirements. Backup copies may retain deleted information until they are overwritten through normal backup processes.

Postaryx and its service providers may process personal data in countries other than the country where you reside or where your organization is established, because the cloud infrastructure and service providers we use may operate internationally.

Where personal data is transferred internationally, Lunark Dynamics LLC uses appropriate safeguards required by applicable data protection laws. Depending on the transfer, these may include adequacy decisions, Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, other approved transfer mechanisms, or additional contractual safeguards, where applicable.

We also require our service providers to process personal data only for authorized purposes and to maintain appropriate protections for that data.

13Security and Data Protection

Postaryx uses reasonable technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, and loss. The measures below are the ones in place today:

• Traffic between your browser and the Service is encrypted in transit using TLS.
• Account passwords are stored as salted hashes, never in a readable form, and cannot be recovered by us.
• Access to Workspace data inside the product is controlled by role and permission, so a member sees only what their role allows.
• When you disconnect a Connected Platform, the stored access and refresh credentials for that connection are erased from our live systems. Where a platform offers a revocation method that Postaryx supports, we also ask the platform to invalidate the authorization. Support for this varies by platform, so you may still need to revoke Postaryx from the platform’s own application-permissions settings.
• Customer-supplied API keys, application passwords, per-instance connection credentials, and the client secrets of applications registered against Postaryx are encrypted before they are stored.
• Credentials are excluded from application logs and error reports.
• Backups may be maintained according to our infrastructure configuration and operational requirements.

We review these measures as the Service develops, and we expect to strengthen them over time. Where a specific control is required by a contract or by a platform's developer terms, we will meet that requirement before enabling the relevant functionality. Our Security and Data Protection page sets out these measures in more detail, including the controls Postaryx does not currently offer.

No internet service is completely secure. We cannot guarantee that unauthorized third parties will never defeat our safeguards, and you are responsible for keeping your own account credentials confidential. If you believe you have found a security issue, contact support@postaryx.com.

14Retention

We retain personal data only as long as reasonably necessary for the purposes described in this Policy, subject to platform rules, legal obligations, security needs, and dispute preservation.

While your Account is open, Postaryx keeps your account information, Workspace data, connected-integration metadata, drafts, scheduled content, media, and publishing records for as long as the Account remains active, so that the Service continues to work as you expect. You can delete individual items at any time using the controls available in the product.

After a valid Account deletion request, Postaryx aims to delete or de-identify ordinary Account and Workspace data from active systems within up to 90 days, unless a shorter platform rule applies, deletion can reasonably be completed sooner, or longer retention is required for one of the exceptions described below. Account deletion is requested as described in the Data Deletion Instructions.

Some categories are governed by their own retention rules:

Information may remain after an Account is deleted where it is required or permitted for a specific purpose. These purposes include compliance with legal and regulatory obligations, tax and accounting records, fraud and abuse prevention, security and incident investigation, establishing or defending legal claims, and resolving billing disputes or chargebacks. Data retained under these exceptions is limited to what is necessary for that purpose and is protected from ordinary product use.

Postaryx may maintain backups according to infrastructure configuration and operational requirements. Backup copies may retain deleted information until they are overwritten through normal backup processes. Backups are not restored for ordinary product use, and where a disaster-recovery restoration reintroduces previously deleted data, Postaryx re-applies the applicable deletion.

15Deletion, Disconnection, and Revocation

To request deletion of your Postaryx Account and associated personal data, email support@postaryx.com with the subject “Account deletion request.” Include the Account email address and the Workspace name. We may verify your identity and, for a shared Workspace, your administrative authority before processing a request.

• Account deletion: initiates deletion or de-identification of Account and Workspace data associated with the request, subject to administrator ownership issues, other users’ rights, legal retention, dispute/security preservation, and backup cycles.
• Connected Platform disconnection: stops Postaryx from using the connection, removes the channel from your Workspace, and erases the stored credentials for that connection from our live systems. Whether the authorization is also canceled on the platform’s side depends on that platform’s capabilities and on whether Postaryx supports its revocation method, which is not the case for every platform. We therefore recommend that you also revoke Postaryx directly from the platform’s own account-security or application-permissions settings.
• OAuth token removal: when you disconnect a Connected Platform, the stored access token, refresh token, and expiry for that connection are erased from our live systems as part of the same operation, subject only to limited backup cycles.
• Stored content deletion: drafts, media, schedules, publication records, and platform-derived data are deleted or de-identified according to the deletion workflow and the retention schedule in Section 14. Deleting a media item also removes the underlying file from storage.
• Platform-side copies: deleting from Postaryx does not automatically delete posts or data already stored by a Connected Platform unless Postaryx sends a specific delete request and the platform accepts it. You may need to delete content directly on the platform.
• Backups: Postaryx may maintain backups according to infrastructure configuration and operational requirements. Backup copies may retain deleted information until they are overwritten through normal backup processes. Backup data is not restored for ordinary product use.

Detailed instructions are published at /data-deletion.

16Your Privacy Rights and Choices

Depending on where you live and subject to exceptions, you may have rights to request access, correction, deletion, restriction, objection, portability, information about disclosures, withdrawal of consent, or review of certain automated decisions. You may also have rights to opt out of certain sale/sharing/targeted advertising activities if such activities occur under applicable law.

• Account data: update your profile and preferences in your account settings.
• Connected Platforms: disconnect the channel in Postaryx, and revoke Postaryx from the platform’s own application-permissions page.
• Marketing: use the unsubscribe mechanism in marketing emails; necessary service messages may continue.
• Cookies: use the consent interface where provided and browser/device controls, subject to the Cookie Policy.
• Privacy requests: contact support@postaryx.com. We may verify identity and authority and may ask an authorized agent to provide proof of authorization where applicable.

We will respond within the time required by applicable law. If we deny or limit a request, we will explain the basis where legally required. You may have a right to appeal or complain to a data protection authority.

17Cookies and Similar Technologies

Our Cookie Policy describes the categories, purposes, providers, and controls applicable to cookies and similar technologies, and lists each cookie Postaryx sets. Postaryx does not currently enable analytics or advertising cookies. Where a payment provider is used on a billing or checkout page, that provider may set its own cookies, as described in the Cookie Policy.

18Children

Postaryx is intended for business users and is not directed to children. Users must be at least 18 years old. We do not knowingly collect personal data from children under 18. If you believe a child has provided personal data to Postaryx, contact support@postaryx.com and we will take appropriate steps to delete it.

19Business Transfers

If Lunark Dynamics LLC is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal data may be disclosed to advisers and counterparties and transferred as part of the transaction, subject to applicable law and appropriate confidentiality safeguards.

20Legal, Safety, and Rights Disclosures

We may preserve, access, or disclose information where we reasonably believe it is necessary to comply with law or valid legal process; protect users, the public, Connected Platforms, or the Service; investigate fraud, abuse, security incidents, or rights violations; enforce agreements; or establish, exercise, or defend legal claims. We will evaluate requests according to applicable law and the data actually available to us.

21Changes to This Privacy Policy

We may update this Policy as our Service, integrations, vendors, laws, or platform requirements change. We will change the “Last updated” date and provide additional notice for material changes where appropriate or required. We may update a platform-specific section when approved scopes or features materially change.

22Contact

Postaryx is operated by Lunark Dynamics LLC.

For privacy requests, account questions, and general support:

support@postaryx.com

For formal legal notices and company communications:

admin@postaryx.com

We may request additional information to verify your identity or authority before responding to certain requests.