Start free – 3 posts a month, no credit card.Start now
Postmina

Legal

Privacy policy

Last updated: November 8, 2026

This policy describes personal data processed by Postmina at postmina.com. Connecting a social account is optional and separate from signing in to Postmina. The available features depend on the permissions and integrations actually enabled for your workspace.

Who is responsible

Sellrock UG (haftungsbeschränkt), Kölner Str. 43a, 90425 Nürnberg, Germany, operates Postmina and is the controller for website visitors, account administration, security and support. Contact info@postmina.com or +49 176 61838332. When a business provides personal data for its own content workflows, it remains responsible for its purposes and instructions; any processing on its behalf requires the applicable data-processing arrangements.

Data we process

  • Account and workspace: name, email address, a one-way password hash, session information, workspace memberships, roles and settings. We do not store your password in readable or reversibly encrypted form.
  • Business and sources: submitted website URLs, permitted source material, brand information, project settings and the sources of business facts.
  • Content and activity: uploaded media, drafts, revisions, approvals, schedules, publication identifiers, job progress and operational usage records.
  • Optional social connections: provider/app identifiers, the authorizing account or business identity, selected Facebook Pages or Instagram Professional accounts, their names/profile metadata, granted permissions, token expiry and encrypted access credentials. We only request capabilities used by the selected integration.
  • Technical and contact data: IP address, request time, browser/request information, security and error logs, and the name, email and message you send when contacting us.

Purposes and legal bases

We process account and workflow data to provide the service you request and perform our contract (Article 6(1)(b) GDPR). We process necessary security, abuse-prevention and operational records for our legitimate interest in a reliable, secure service (Article 6(1)(f)). Required accounting and compliance records are processed to fulfil legal obligations (Article 6(1)(c)). Where an optional activity requires consent, its basis is Article 6(1)(a), and consent can be withdrawn for the future. Granting Meta permissions does not consent to unrelated processing.

AI processing is separate

AI features, when enabled, send the necessary parts of your briefing, instructions and content through our controlled gateway to the configured provider. No external AI provider is currently activated in this production deployment. Before an external provider is enabled for production personal data, its identity, purpose and relevant transfer information must be disclosed here. Social authorization alone does not permit sending Meta platform data to AI. AI output is a suggestion requiring the applicable review and approval; it is not a decision about your legal or similarly significant rights.

Trying Postmina without an account

When you enter a website or a description on postmina.com before creating an account, Postmina reads the public pages of that website (respecting robots.txt), derives a brand profile and, on request, writes one example post. The result of a website is kept for up to 90 days and shown again to anyone who enters the same website in the same language, so it is not read again; your own changes, a description you enter and an example written with your changes stay with your browser session only. A necessary cookie (postmina_guest) identifies that session for up to 90 days; we store only a hash of it. To prevent abuse we keep a keyed hash of your IP address with the session and use Cloudflare Turnstile to check that a person starts new work. When you save the result to an account, it is copied into your workspace; unsaved results and sessions are deleted after their 90 days.

Facebook and Instagram

If you authorize an available Meta connection, Postmina uses the granted access to identify eligible accounts, let you select the intended target and publish content approved or scheduled by your business. The publishing integration does not read private messages, manage advertisements or import your social history into AI. We do not sell Meta platform data or use it to train AI models. Disconnecting stops eligible future work and removes usable connection credentials; it does not retract a post already accepted by Meta. A validated provider deletion request removes matching connection identity, permission and profile data. Workspace drafts, approvals, publication history and evidence needed to resolve uncertain remote operations are separate records. See the deletion instructions and request-status page for all deletion options, including account and workspace requests.

Service providers and recipients

Our application and private storage run on Hetzner hosting. Cloudflare provides DNS, HTTPS traffic routing, caching and security and can process IP addresses and request metadata. Transactional and support email is handled through our Mailcow installation at mail.trafficlog.app and the relevant recipient mail servers. Authorized personnel may access data for support, security and operations. When you connect and publish to a social platform, that platform receives the authorized requests and content and processes data under its own terms. We disclose data to authorities only where legally required. We do not sell personal data.

Cookies and local storage

Postmina uses necessary login/session cookies and browser storage for functions such as language, appearance and workspace preferences. Cloudflare may use necessary security cookies. These functions are necessary to deliver a requested service or protect it; we do not deploy a Meta Pixel or optional advertising trackers on these pages. Any future nonessential tracking requires its own information and, where required, prior consent. A necessary cookie (postmina_guest) remembers a preview you started without an account for up to 90 days.

Retention and deletion

Account and workspace data is retained while needed to provide your requested service. When a purpose ends or a valid deletion request is fulfilled, we delete or anonymize the affected data unless a legal retention obligation or a necessary, proportionate legal claim requires retention. Connection credentials are removed on disconnect or validated revocation; deletion also removes matching provider identity and profile metadata. Minimal Meta deletion receipts expire after 90 days. Published content on Meta must be removed on that platform. Restricted encrypted backups may temporarily contain older records; they are used for recovery, and applicable deletions must be reapplied after restoration. Contact us for the retention criteria applying to your request.

International processing

Cloudflare operates an international network, and connected social platforms or recipient mail providers may process data outside the EEA. Where a transfer requires safeguards, the applicable basis must be an adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses, with additional measures where necessary. Cloudflare publishes its data-processing addendum and transfer arrangements at cloudflare.com/cloudflare-customer-dpa/. Contact us for information about the arrangements relevant to your data.

Your rights and how to contact us

Subject to the GDPR conditions, you can request access, correction, erasure, restriction and portability, object to legitimate-interest processing, and withdraw consent for the future. Send your request to info@postmina.com. We verify identity proportionately and normally respond within one month; statutory extensions will be explained. Never send passwords, access tokens or identity documents in an initial email. You may complain to a supervisory authority, including the Bavarian State Office for Data Protection Supervision (BayLDA), www.lda.bayern.de.

Changes to this policy

We update this notice when processing changes. The date above identifies this version. Material new purposes, recipients or optional tracking will be explained before the change is applied where required.

Terms of service

Last updated: November 8, 2026

These terms govern Postmina provided by Sellrock UG (haftungsbeschränkt), Kölner Str. 43a, 90425 Nürnberg, Germany. Postmina is offered to businesses and professional users acting for their organization. An individually agreed contract takes precedence.

The service

Postmina supports business briefings, drafts, reviews, scheduling and authorized social publishing where the relevant integration is available. You must have authority to act for your workspace and connected accounts. Keep credentials secure and permissions current. Features requiring provider approval, credentials or a separate order are available only when those requirements are met.

Your content

You retain rights in your submitted material and authorize us to process it only to provide the service. You are responsible for the necessary rights, lawful instructions and the accuracy of claims, offers and approvals. Do not submit unlawful material or use Postmina to evade platform restrictions. AI suggestions can be inaccurate and must be reviewed. Publication requires the applicable approval; editing a revision does not preserve approval of the old revision.

Trial and payment

Any trial limits, paid services, prices, taxes, billing intervals and renewal conditions are those expressly shown and accepted in the relevant offer or order. A trial does not itself authorize charging you. No purchase or payment obligation arises solely from connecting a social account. Where payment is due, the agreed invoice and order terms apply.

Ending the contract

You may request cancellation or account closure at info@postmina.com. Any agreed paid term and notice conditions remain governed by your order. Access may be restricted where necessary to address unlawful use, a concrete security risk or a material contractual breach. Data deletion follows our privacy policy; disconnecting a channel is not account closure and does not remove a post already published by a platform.

Platform dependencies and publication

Social platforms control access, review, quotas and delivery and can change or withdraw them. We do not guarantee a specific reach, engagement, uninterrupted availability or publication at an exact second. A timeout after submission may require reconciliation rather than an automatic retry. Do not assume a paused or disconnected connection retracts a request already accepted externally.

Liability

Statutory liability for intent, gross negligence, injury to life, body or health and other mandatory liability remains unlimited. For ordinary negligence, liability for breach of a material contractual obligation is limited to foreseeable damage typical for the contract, to the extent legally permitted. This does not restrict mandatory rights or an expressly assumed guarantee.

Applicable law and contact

German law applies, subject to mandatory applicable law. Where a jurisdiction agreement is legally permitted, the courts at our registered office have jurisdiction. Questions about these terms and service arrangements can be sent to info@postmina.com.

Imprint

Company
Sellrock UG (haftungsbeschränkt)
Address
Kölner Str. 43a, 90425 Nürnberg, Germany
Represented by
Ilayda Kundakcioglu
Email
info@postmina.com
Phone
+49 176 61838332
Register
Amtsgericht Nürnberg, HRB 44731
VAT ID
DE457575629
Responsible for content
Burhan Kundakcioglu, Kölner Str. 43a, 90425 Nürnberg, Germany

Photo credits

The illustrative pictures used on this website come from Wikimedia Commons under the following licences: