Privacy notice

Who we are

Postd Office (office.postd.uk) is a social inbox for businesses, run by dijitul, Mansfield, England. Contact us about anything in this notice at hello@dijitul.uk.

Two roles, depending on whose data it is

• Your account (businesses and their team members). dijitul is the data controller for the details we hold to run your account, such as your name, email address, business details and billing records.
• Your customers’ messages. When people message or comment on a business’s Facebook, Instagram or TikTok, that business is the controller of their personal data. dijitul processes it only on the business’s instructions, as its processor. If you sent a message to a business that uses Postd Office, contact that business first about your data. We will help them respond.

What we collect

For account holders:

• name, email address and password (stored only as a secure hash);
• business name and the social accounts you connect;
• the access tokens those platforms give us, stored encrypted;
• billing details handled by Stripe (we never see or store your full card number);
• an activity log of who in your team did what, such as sending or approving a reply.

For people who message a business:

• the content of messages and comments, and any attachments;
• the username, display name and account identifier the platform provides;
• when the message was sent, and the business’s replies.

We do not collect email addresses, phone numbers or locations from people who message a business, unless they include them in the message itself.

Why we use it

• To provide the service to businesses that have signed up: showing messages in one inbox, drafting and sending replies, translating, and flagging abuse, spam, scams and threats. Lawful basis: performance of our contract with the business, and the business’s own lawful basis for handling its customers’ messages.
• To bill and support you, and to keep records the law requires. Lawful basis: contract and legal obligation.
• To keep the service secure and prevent misuse. Lawful basis: legitimate interests.

We do not sell personal data or use it for advertising.

AI and automated processing

Messages are analysed by AI to translate them, flag harmful content and draft replies. This is done by Anthropic through its Claude API, acting as our sub-processor. Anthropic does not use this data to train its models. Drafts are based only on answers the business has approved. Replies are sent automatically only where a business has switched on autopilot for a specific approved answer. No decision with a legal or similarly significant effect is made about anyone automatically.

Who else handles data

• Meta and TikTok: the messages and comments already exist on their platforms, and we receive copies through their official APIs.
• Anthropic: AI analysis, translation and drafting.
• Stripe: payments and invoices.
• DigitalOcean: hosting, on servers in the UK and EU.
• Our email provider, to send account emails and urgent-message alerts to your team.

Where a provider processes data outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum to protect it.

How long we keep it

• Messages, comments and replies are kept for 12 months from the last message in a conversation, then deleted automatically.
• Account details are kept while your account is open. When you close it, we delete your account and your customers’ messages within 30 days.
• Billing records are kept for six years, as UK tax law requires.

Security

Data is encrypted in transit, the database is reachable only from our own server, passwords are hashed, and access within a business is limited by owner and agent roles. Only the dijitul team members who need to, for support or maintenance, can access the systems.

Your rights

Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, object to or restrict how it is used, and ask for it in a portable format. Email hello@dijitul.uk and we will respond within one month. If your data is in a business’s inbox, we will pass your request to that business, as they decide what happens to it.

If you are unhappy with how your data has been handled, you can complain to the Information Commissioner’s Office at ico.org.uk.

Deleting your data

Businesses can disconnect a social account at any time from Settings, which stops new messages arriving, and can ask us to close their account and delete its data by emailing us. Anyone else can email hello@dijitul.uk with the platform and username they messaged from, and the business they contacted, and we will arrange deletion. Removing the Postd Office app from your Facebook, Instagram or TikTok settings also stops us receiving new data from that account.

Cookies

We use only the cookies needed to keep you signed in and secure. There are no advertising or tracking cookies on this site.

Changes

If we change this notice in a way that matters, we will update the date above and let account holders know by email. See also our terms.