Privacy Policy

Last updated: 15 October 2026

Postozo is a service of TOTOSLOCAL ONE PRIVATE LIMITED, a company registered in India, with its office at Sky Privlion, 501, Nipania, Indore, Madhya Pradesh 452010, India ("Postozo", "we", "us"). You can reach us at support@postozo.com.

This policy explains what personal data we collect when you use postozo.com and app.postozo.com, why we use it, who we share it with, how long we keep it, and your rights. It also covers people whose data reaches us through our customers, such as clients who review posts, and visitors to link in bio pages. We follow the Digital Personal Data Protection Act, 2023 of India and, where they apply to you, other data protection laws such as the GDPR.

Data we collect

We do not ask for sensitive data like health or financial account details. Do not put such data, or anyone's health information, into the Service. We do not sell personal data.

How we use your data

• To run the Service: sign-in, scheduling, publishing, approvals, notifications and analytics.
• To send service emails, like invites, password resets, approval requests, failure alerts, reports and summaries. You can turn off summary and success emails in Settings.
• To keep the Service safe: rate limits, fraud and abuse checks, and security logs.
• To answer support requests and to improve the product, using usage patterns, not the content of your posts.
• To keep proof of our agreement, enforce our terms, and set up or defend legal claims.
• To meet legal duties, like tax records for payments and answers to lawful requests.

Legal basis. We use your data because you asked for the Service (contract), because we have a legitimate interest in keeping it safe, working and enforceable, because the law requires it, or with your consent. Under India's Digital Personal Data Protection Act, we use the data you give us to provide the Service you signed up for, which the Act allows, and with your consent where it is needed. You can withdraw consent at any time; this does not affect what was done before.

We do not make decisions about you based only on automated processing that have legal or similar effects.

AI features

When you use an AI feature, the text or image you send, your brand voice and, for "Explain my results", your statistics are sent to our AI provider (Anthropic or OpenAI) to create the answer. We send only what is needed for that request. We do not use your content to train AI models, and we choose provider settings that do not allow them to train on it.

Who we share data with

We share personal data only with service providers who help us run Postozo, and only what they need:

We may also share data with our professional advisers under a duty of confidence, when the law or a valid order from an authority requires it, to protect people's safety or our legal rights, or as part of a sale or merger of our business, in which case this policy continues to apply.

Google user data

When you connect YouTube or Google Business Profile, we receive data from Google APIs, such as your channel or business profile details, and the access needed to publish and read statistics. We use it only to provide the features you use in Postozo. Postozo's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not let people read it except with your permission, for security, or where the law requires, and we do not use it to train AI models.

Where your data is stored

Our servers are in the United States (DigitalOcean, New York). By using the Service, your data will be moved to and stored in the United States, and our providers may process it in the countries listed above. Where the law requires a safeguard for these transfers, such as for people in the European Economic Area, the United Kingdom or Switzerland, we rely on recognised safeguards such as standard contractual clauses. We protect your data as this policy describes wherever it is processed.

How long we keep data

• Account and content: while your account is open. When you ask us to delete your account, we delete it within 30 days.
• Backups: kept for up to 30 days, then deleted.
• Proof of accepting our terms: while your account is open, and for up to 3 years after it is closed, in case of a dispute.
• Logs: kept for a limited time for security and fixing problems, then deleted.
• Billing records: kept as long as tax law requires.

How we protect data

• All traffic uses HTTPS.
• Channel access tokens and secret settings are encrypted in our database (AES-256-GCM).
• Passwords are stored as a scrypt hash. API keys are stored as a hash and in encrypted form, and sign-in tokens as hashes.
• Access to our servers is limited to authorised staff.
• Client members only see the brands they are assigned to.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.

Your rights

Write to support@postozo.com to use any of these rights. We may ask you to confirm who you are first, and we will answer within 30 days. You can change most details yourself in Settings.

• Everyone: ask for a copy of your personal data and how we use it, have it corrected, completed or deleted, withdraw consent, and complain.
• In India: under the Digital Personal Data Protection Act, you can also name someone to use your rights if you die or cannot act. Please use our grievance process below first; if you are not satisfied, you can complain to the Data Protection Board of India.
• In the European Economic Area, the United Kingdom and Switzerland: you can also ask us to limit how we use your data, object to uses based on our legitimate interests, and receive your data in a machine readable form. You can complain to your local data protection authority.
• In California and other US states with privacy laws: you can ask to know, correct and delete your personal information, and use an authorised agent. We do not sell or share personal information for targeted advertising, and we will not treat you differently for using your rights.

Data you handle for others

If you manage channels for clients, you decide what personal data goes into your posts and workspace. For that data you are the controller and we act on your instructions, as set out in our Data processing addendum. If you are one of those people and want to use your rights, please contact the business that runs the channel; we will help them answer you.

Cookies

In the app we use only the cookies needed for it to work, like keeping you signed in. Our website uses Google Analytics to count visits and see which pages people read. We do not use advertising cookies and we do not sell what we collect. See the Cookie policy.

Children

The Service is not meant for anyone under 18. We do not knowingly collect data from children. If you think a child gave us data, write to support@postozo.com and we will delete it.

Changes to this policy

We may update this policy. If a change is important, we will tell you by email or in the app at least 15 days before it applies. The date at the top shows the current version.

Grievance Officer

For questions or complaints about your personal data, write to our Grievance Officer at support@postozo.com with the subject "Privacy", or by post to Grievance Officer, TOTOSLOCAL ONE PRIVATE LIMITED, Sky Privlion, 501, Nipania, Indore, Madhya Pradesh 452010, India. This is our contact under the Information Technology Act, 2000 and its rules, and the Digital Personal Data Protection Act, 2023. We acknowledge complaints within 24 hours and aim to resolve them within 15 days.