Skip to content
Postslot
Sign inCreate a form

Privacy policy

How Postslot collects, uses and protects personal data, and the rights you have over it.

Last updated

Who we are

Postslot is operated by BufferSol Technologies, {{registered address}}. This policy explains what personal data we handle when you visit postslot.buffersoltech.com, create an account or use the service.

For account and billing data we are the controller. For form submissions that your visitors send to your endpoints, you are the controller and we are your processor. The data processing addendum covers that second case.

Data we collect

We collect only what we need to run the service.

  • Account data: your email address, name if you give one, and sign in credentials such as passkeys or two factor settings.
  • Organization data: workspace name, members, roles, API keys (stored hashed) and the settings you configure.
  • Billing data: your plan and subscription status. Card details go straight to Stripe and never touch our servers.
  • Form submissions: the fields and files that visitors of your sites send to your endpoints, plus delivery receipts and spam verdicts. You receive this data and we store it for you.
  • Technical data: IP address, browser type and request logs, kept briefly for security, abuse prevention and debugging.

We do not sell personal data and we do not use submission content for advertising or to train models.

How we use it and our legal bases

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases under the GDPR and UK GDPR.

  • Contract: to create your account, deliver submissions and bill you.
  • Legitimate interests: to secure the service, prevent abuse and spam, and keep records that let us fix problems.
  • Legal obligation: to keep tax and accounting records.
  • Consent: for optional communications, which you can withdraw at any time.

Who we share data with

We share data only with the subprocessors listed on our subprocessors page, and only to provide the service. We may also disclose data if a valid legal request requires it, and we will tell you first unless the law forbids it.

Retention

  • Account and organization data is kept while your account is open.
  • Submissions and their delivery receipts are kept for the history period of your plan (90 days on Free, 6 months on Starter, 1 year on Pro), then deleted. Held submissions are kept until released or until that period ends.
  • After you delete your account we remove your data within 30 days, except billing records we must keep by law, which are kept for the period the law requires.
  • Server logs are kept for up to 30 days.
  • Backups roll off within 35 days after deletion.

Account deletion and data export

You can export or delete your data yourself. In the app, open Settings, then Profile. You can also use the API: GET /api/account/export returns a copy of your data, and DELETE /api/account permanently deletes your account and workspace.

Your rights under GDPR and UK GDPR

You can ask us to access, correct, delete, restrict or port your personal data, and you can object to processing based on legitimate interests. Most of these you can do from Settings. For anything else, email us. You also have the right to complain to your data protection authority.

California rights under CCPA and CPRA

If you live in California you can ask what personal information we hold, ask us to delete or correct it, and ask us to stop selling or sharing it. We do not sell or share personal information for cross context advertising. We will not discriminate against you for using these rights.

International transfers

Our subprocessors are mainly in the United States. When we transfer personal data from the EEA, UK or Switzerland, we rely on the EU Standard Contractual Clauses and the UK addendum, and on the EU US Data Privacy Framework where a provider is certified.

Security

We encrypt data in transit and at rest and limit access to people who need it. See the security page for details. No system is perfectly secure, and we will notify you of a breach that affects you as the law requires.

Children

Postslot is not directed at children under 16 and we do not knowingly collect their data.

Changes to this policy

If we make a material change we will email account owners at least 14 days before it takes effect.

Contact

Questions or requests: legal@buffersoltech.com. For general help, write to support@buffersoltech.com.