Privacy

This service is operated by Forge Digital Services Ltd, which is the data controller for the information described here. It is a company registered in England and Wales, number 17421027, with its registered office at M20 Maidstone Studios, Vinters Business Park, New Cut Road, Maidstone, England, ME14 5NZ.

Forge Digital Services Ltd develops and publishes its own software: subscription web applications for small businesses, designed, built, hosted and supported in house rather than under contract to anybody else.

PostMinder is one of its products. Your data is held for running PostMinder and is not passed to anything else the company builds.

For anything on this page, including a request to see or delete your data, contact support@postminder.co.uk.

Registered with the Information Commissioner’s Office under ZC235082.

Everything the product stores about you, and why it needs it:

• Your email address and password

  To sign you in. The password is hashed by Supabase and is never visible to us or stored by this application.

• Your website address

  It is the one thing the product needs to work.

• The public pages we read from your website

  The text of pages our crawler fetched, kept so your content can be written from your own words rather than guesswork.

• A profile of your business

  What you sell, where you work, who you serve. Written by AI from your website, and editable by you at any time.

• The answers you typed, if you have no website

  The ten questions asked in setup instead of reading a website, kept in your own words. They are the equivalent of the pages we would have read, and they are stored for the same reason: so your profile can be rebuilt without asking you to type it all again. They are deleted with your account.

• The content we write for you

  Your posts and articles, their dates and their status.

• Photographs and videos you upload

  Stored privately so they can be attached to a post. They are not public, and the links PostMinder shows you stop working after a few hours. When you publish, the network you publish to is given a link that stops working after a day, so it can fetch the file. Once a post is published, the network keeps its own copy under its own terms.

• AI images made for your posts

  Kept with your photos and videos so they can be attached to a post, until you delete them or your account. Each is marked as an AI image.

• What you have said your AI images should show

  Sent with each AI image request, so the pictures suit your business.

• A connection to a social account, if you connect one

  When you connect an account we store the key that account gives us, its name, when the key expires, and what it allows. The key lets us post the pieces you have approved and nothing else. We never see your password for that network. Disconnect it in Settings and everything we hold for it is deleted straight away.

• Which advert or link you signed up from

  If the address you signed up from carried campaign tags, such as the ones on our adverts, we keep them with your account so we can tell which adverts are worth paying for. They are read from the address only, never from a cookie, and they are deleted with your account.

• Your phone, if you turn on reminders

  If you ask for reminders on your phone, we keep the address your browser gives us for sending them, and the name of the browser, so Settings can tell one phone from another. Turn reminders off, or delete your account, and it is deleted.

• Likes, comments and shares on your Facebook and Instagram posts

  For posts we publish to your Facebook Page or Instagram account, we read how many likes, comments and shares each one has, where Facebook or Instagram will tell us, once a day for 30 days, so we can show you what is working. We read the totals only. We never ask who liked, commented or shared, or what a comment says.

• A scrambled form of your internet and email address

  To stop people guessing passwords or flooding our forms, we count attempts against a scrambled form of your internet address and email address. It cannot be turned back into either, and it is deleted within two days.

• How much you have used

  A count of the pieces written and AI images made each month, so your plan limits can be applied.

• Your subscription

  A Stripe customer reference, your plan, and its status, and any AI image packs you have bought with the images left from them. Card details are handled by Stripe and never reach us.

• Your email address, if you registered before launch

  Kept so we can tell you when the product is ready, and so the free trial you were offered at the time can be honoured. It is not an account, and it is separate from everything above. We write twice: once to confirm the address, once when it launches. Ask us and it is deleted straight away; otherwise the whole list is deleted at the end of December 2026.

• Your email address, if you registered through a form on Facebook or Instagram

  Some of our adverts let you register without leaving Facebook or Instagram. Meta passes us the address you gave in that form, and from then on it is treated exactly like a registration on our site: we write once to confirm it, and if you never confirm, we never write again. What Meta itself keeps about the form is covered by Meta’s own privacy policy. The address is deleted at the end of December 2026, from our list and from the sheet the form fills in.

UK data protection law asks us to say why we are allowed to use your information. For each use it is one of these four.

To provide the service you signed up for (our contract with you): your account and sign-in, reading your website, your business profile and answers, writing your content, your photos and videos, posting to the accounts you connect, likes, comments and shares on your Facebook and Instagram posts, how much you have used, and your subscription.

Because the law requires it (a legal obligation): records of payments, invoices and refunds are kept for six years after the end of the financial year they relate to, because UK tax law requires it. They hold your name, email address, billing address, what you paid and when, but never your full card number. They are kept even if you delete your account.

Because we have a legitimate interest that does not override yours: keeping the service secure and stopping abuse, including the scrambled addresses used to limit attempts; knowing which advert or link you signed up from; account emails, such as a reminder to finish setting up or that your free month is ending, which you can switch off; and writing to businesses that are not customers, described below.

Because you agreed (consent): reminders on your phone, which you switch on and can switch off; and registering before launch, on our site or through a form on Facebook or Instagram. You can withdraw that at any time by asking us, or with the link in any of those emails.

There is no analytics on this site. No Google Analytics, no advertising pixels, no session recording, no third-party scripts of any kind. The only cookies are the ones the site needs to work, such as keeping you signed in, listed on the cookies page.

We do not sell your data, share it with advertisers, or use your business information to train anything of our own.

When you give us your website address, our crawler fetches pages that are publicly available on it, the same pages any visitor or search engine can see. It identifies itself as PostMinderBot, obeys your robots.txt, and waits between requests. It does not sign in, submit forms, or reach anything behind a login.

PostMinder uses YouTube API Services to upload the videos you approve to your YouTube channel. When you connect it, Google gives us a key with two permissions: to upload videos, and to read your channel. We use the second only to read your channel’s name and ID, and to check that each video we upload for you arrived and whether it is public, unlisted or private. We never see your Google password.

We store that key, your channel’s name and its ID, in our database in London, in a table that only our own server can read. No web browser can read it, including yours. We use them for nothing but uploading the videos you ask us to and showing you which channel is connected.

Nobody else receives information from your Google account, apart from Supabase and Vercel, which host the service and are listed under “Who else sees it” below. It is never used for advertising, never sold, never used to decide anyone’s credit, and never used to train any AI model, ours or anyone else’s. It is not sent to OpenAI. Our use of information received from Google APIs, and any transfer of it, follows the Google API Services User Data Policy, including its Limited Use requirements.

By connecting, you agree to be bound by the YouTube Terms of Service. What Google does with your information is covered by the Google Privacy Policy.

We keep it only while YouTube is connected, and check it with YouTube once a day: we update your channel’s name if it has changed, and if you have removed our access, or a video we uploaded is no longer on YouTube, we delete what we hold about it.

Disconnect YouTube in Settings and we take our access back at Google and delete everything we hold for it straight away. If you ask us to delete your account, everything we hold from YouTube is deleted within 7 days. Deleting what we hold does not delete anything on YouTube: videos we uploaded stay on your channel until you delete them there.

You can also remove our access yourself at any time in your Google security settings. For any question or complaint about how we handle information from YouTube, email support@postminder.co.uk.

PostMinder uses the Google Business Profile APIs to post the updates you approve to your business profile on Google. When you connect it, Google gives us a key with one permission, which Google describes as seeing, editing, creating and deleting your Google business listings. We use it for two things only: to find the business profiles your Google account manages, so we can connect the right one, and to post the updates you approve to it. We do not change your opening hours, address, phone number or any other details on your profile, we do not read or reply to your reviews, and we never delete anything on Google. We never see your Google password.

When you connect, we read the name, website address and Google reference of each profile your account manages, so we can work out which one is yours. We keep only the one we connect: its name and its Google reference. When an update includes a photograph, Google collects it from a private, time-limited link to our own storage.

We store that key, your profile’s name and its Google reference in our database in London, encrypted, in a table that only our own server can read. No web browser can read it, including yours. We use them for nothing but posting the updates you ask us to and showing you which profile is connected.

Nobody else receives information from your Google account, apart from Supabase and Vercel, which host the service and are listed under “Who else sees it” below. It is never used for advertising, never sold, never used to decide anyone’s credit, and never used to train any AI model, ours or anyone else’s. It is not sent to OpenAI. Our use of information received from Google APIs, and any transfer of it, follows the Google API Services User Data Policy, including its Limited Use requirements. What Google does with your information is covered by the Google Privacy Policy.

We keep it only while Google Business Profile is connected. Disconnect it in Settings and we take our access back at Google and delete what we hold for it straight away. If you ask us to delete your account, we take our access back at Google, and everything we hold from it is deleted within 7 days. Deleting what we hold does not delete anything on Google: updates we posted stay on your profile until you delete them there.

You can also remove our access yourself at any time in your Google security settings. For any question or complaint about how we handle information from Google Business Profile, email support@postminder.co.uk.

Some people reach this page from a link in an email we sent them without being asked. If that is you, this part is the part that applies, and the rest of this page is about people who signed up.

How we found you. We chose your business, visited your website, and read its public pages in the ordinary way a browser does, in line with that site’s robots.txt. We did not buy a list. Your name and email address were taken from what your own site publishes.

What we made. From those pages we wrote a sample month of marketing for your business and put it on a private page with an address only you were sent. That page stops working after 60 days.

What we hold, and for how long. Until that page expires: your website address, your business name, the name and email address we wrote to, the sample itself, and whether the page has been opened. After it expires, or straight away if you ask us to stop, we delete all of that. We keep only your website address and the date, so that a later batch cannot pick your business again and write to you a second time.

How to stop it. Every email we send carries an unsubscribe link, and it works without an account and without replying. Pressing it stops any further email immediately, takes the sample page down, and deletes everything described above.

You can also email support@postminder.co.uk and ask us to delete what we hold about your business, or to tell you what that is. You do not need an account and you do not need to give a reason.

To run the service we use the companies below. Each one only receives what it needs to do its job.

Some of these companies are in the United States. Where your information goes there, it is protected in one of the two ways UK law recognises. Stripe and Vercel are certified under the UK Extension to the EU-US Data Privacy Framework. For OpenAI, and for Resend when it sends outreach email from the United States, we rely on the UK’s approved contract terms: the Standard Contractual Clauses with the UK Addendum. So does Google, which runs our email and keeps our encrypted backups, through its Google Workspace data processing terms, and which makes our AI images through its Gemini API, under its data processing terms for that service. Supabase keeps your data in London.

The application itself runs on Vercel, in their London region, in the same country as the database. Vercel is a United States company, which is why it appears in the table above.

Your content is sent to OpenAI each time something is written. OpenAI states that data submitted through its API is not used to train its models. That is their policy rather than our guarantee, and it is worth knowing that this is one of only two points where your business information goes to an AI provider.

The other is AI images. When you ask for one, the post’s title, its first lines and its photo suggestion, with your type of business, where it is and anything you have told us your AI images should show, are sent to Google through its Gemini API to make the picture. Nothing else about you or your customers is sent. Google states that it does not use data sent through its paid API to improve its products. That is their policy rather than our guarantee. Google keeps these requests for a limited time to check for misuse.

The networks you connect, such as Facebook, Instagram, LinkedIn, TikTok, YouTube, Google Business Profile and X, receive the posts, photos and videos you approve for them. What they do with them is covered by their own terms and privacy policies.

Everything between your browser and PostMinder travels over an encrypted connection, and the site only loads over one.

Your data is stored by Supabase in London, which encrypts it on disk and in its backups (AES-256, their standard) and encrypts it again whenever it moves between their systems.

Each customer’s records are walled off from every other customer’s in the database itself, not only in our code. The keys for the accounts you connect, such as YouTube, Google Business Profile, Facebook, Instagram, TikTok and X, sit in a table that no web browser can read. Only our own server reads them, and only to do what you have asked it to.

Those keys are also encrypted by us before they are stored, with a separate key that is never kept in the database, so a copy of the database alone would not reveal them.

Access to the database is limited to the company’s own staff.

While your account exists. If you cancel, your content stays available to you unless you ask us to delete it.

If you have no plan and nobody signs in for 12 months, we email you, and delete the account 30 days after that unless you sign in.

When an account is deleted, everything goes: the business profile, the pages we read from your website, every piece of content, and every photograph you uploaded. It is deleted from the live service straight away, and from our backups within 60 days, as they are replaced. Deletion is permanent.

You have the right to:

• get a copy of the information we hold about you;
• have it corrected if it is wrong;
• have it deleted;
• ask us to stop using it for a while, for example while a complaint is looked into;
• have what you gave us in a form you can take to another service;
• object to any use that rests on our legitimate interests, and stop any marketing email at any time, which we always honour;
• withdraw your consent, where consent is what we rely on.

We do not make decisions about you by automated means that have legal or similarly significant effects on you.

Contact us at the address above and we will action it within one month, which is what the law allows us. A request to delete your data is done within 7 days. You can also delete your whole account yourself, straight away, in Settings, then Account, then Delete my account.

Most of it you can do yourself without asking: your business profile is editable in the app, and your content is yours to change or remove at any time.

The data deletion page sets out what we hold from each network you connect, and how to remove it.

If you think we have handled your data badly, you can complain to the Information Commissioner’s Office at ico.org.uk.

PostMinder is for people running a business, and you have to be 18 or over to have an account. It is not designed for children and we do not aim any of it at them.

We do not knowingly collect anything about a child. If you believe a child has given us their details, tell us at support@postminder.co.uk and we will delete what we hold.

When we change this page we change the date at the top of it, and the version you are reading is always the current one. There is no archive of old versions.

If a change is significant, because we start doing something new with your information or send it somewhere new, we will tell you by email before it applies to you rather than leaving you to notice.