Privacy Policy

Who we are

Postcabin is a service that creates and organises social media content for small businesses. This policy explains what personal data we handle, why, and what rights you have under UK data protection law (UK GDPR and the Data Protection Act 2018).

For the information you upload about your own customers and contacts, you are the data controller and Postcabin acts as your processor. For your own account and billing details, Postcabin is the controller.

Information we collect

• Account and business information — your email address, password (stored only as a secure hash by our authentication provider), business name, description, services, tone of voice, location and any contact details you choose to add.
• Uploaded and generated content — photos, logos and other media you upload, together with the captions, hashtags, calls to action and images generated for you and any edits you make.
• WhatsApp contacts — the names and mobile numbers you add for WhatsApp campaigns, stored in international (E.164) format, plus a record of which campaigns were sent to which contacts and their delivery status.
• Integration data — where you connect a social media or WhatsApp account, the access tokens and account or page identifiers needed to publish or send on your behalf. Tokens are held on our servers and are never exposed to your browser.
• Payment information — subscription plan, status and billing history. Card details are entered directly with Stripe and are never stored by Postcabin.
• Service and security logs — technical records such as request timestamps, error messages and job outcomes, used to keep the service working and secure. Credentials and message tokens are masked in logs.

How we use your information

• To create your account, sign you in and keep your data separated from others.
• To generate draft posts and images using your business information and media, and to store your approvals and edits.
• To publish approved posts to connected social accounts, and to send approved WhatsApp campaigns to the contacts you select, at the times you schedule.
• To apply your plan's weekly post and message allowances.
• To take payment and manage subscriptions through Stripe.
• To keep the service secure, diagnose faults and prevent misuse.

Our lawful bases are contract (providing the service you subscribe to), legitimate interests (security, service improvement and fault diagnosis) and legal obligation (accounting records). Where you upload contacts for marketing, you are responsible for having the consent required for that marketing.

AI-generated content

To create drafts, the business details and media you provide are sent to AI model providers acting on our instructions. Content is sent only to produce your drafts. Please do not upload special category data, personal data about customers, or confidential information you do not want processed this way.

WhatsApp, Meta and social media integrations

If you connect a Facebook Page or other social account, we share the approved post content and media with that platform in order to publish it. If you use WhatsApp campaigns, the approved message, any attached image and the recipient's mobile number are sent to the official WhatsApp Business Platform (Meta) so the message can be delivered, and delivery receipts are returned to us.

Those platforms process that data under their own terms and privacy notices. Nothing is published or sent until you have approved it.

Payment processing

Subscriptions are processed by Stripe. Stripe receives your email address and payment details and acts as an independent controller for payment and fraud prevention. We receive only the subscription status and limited billing metadata.

Who else handles your data

We use trusted providers to run Postcabin: cloud hosting and database/file storage, authentication, AI model providers, Meta (Facebook and WhatsApp Business Platform) and Stripe. Some of these providers may process data outside the UK; where they do, appropriate safeguards such as the UK International Data Transfer Agreement or addendum apply.

We do not sell your data or your contacts' data.

Security

Access to your data is restricted at the database level so that only your account and its members can read your business's records. Integration tokens and secrets are held server-side and encrypted, connections use HTTPS, and administrative access is limited.

Retention and deletion

• Account, business, content and contact data is kept while your account is active.
• You can delete individual posts, media and WhatsApp contacts at any time inside the app; deletions remove the item from your workspace.
• If you ask us to close your account, we delete or anonymise your account, content and contact data within 30 days, except where we must keep records longer.
• Billing and accounting records are kept for six years as required by UK tax law.
• Security and service logs are kept for a short operational period only.
• Content already published to a social platform, or messages already delivered on WhatsApp, cannot be recalled by us — you must remove those with the platform.

Your rights

Under UK data protection law you can ask for access to your data, correction of inaccurate data, deletion, restriction of processing, portability, and you can object to processing based on legitimate interests. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.

If a contact you added asks to be removed or replies to stop hearing from you, remove them from your contacts in Cabin — we also stop future sends to numbers that opt out.

Contact us

For any privacy request, contact Postcabin using the support contact details published on this website. If you cannot find them, send your request from the email address registered to your Postcabin account and we will respond.