If you're a business with GDPR obligations, your legal team needs this. We wrote it the same way we wrote the privacy policy — plain English first, legal terms where they earn their keep. Version 2.1, last updated April 18, 2026.
A Data Processing Agreement is a contract between a company that decides what happens to personal data (you — the controller) and a company that handles it on your behalf (us — the processor). GDPR Art. 28 requires one. So do the UK GDPR, Swiss FADP, and a growing list of US state laws.
You need a DPA with Postkeet if you're based in the EU, UK, or Switzerland, if you serve customers there, or if your own enterprise buyers require one in their vendor reviews. If you're a solo creator posting your own stuff, you almost certainly don't need one — our Privacy Policy already covers you.
Plain terms: this document explains what we do with the personal data that your customers and team members trust you with. It's a legal companion to our Privacy Policy and Security page, not a replacement for them.
This DPA is entered into between:
Where you act as a processor yourself (e.g. an agency managing social for your own clients), Postkeet acts as a sub-processor. The terms below apply the same way, one layer down.
Subject matter: Postkeet's processing of personal data on your behalf, strictly to provide the Postkeet platform — scheduling, publishing, AI generation, analytics, brand voice, team collaboration — and related support.
Duration: from your first day on a paid plan, for as long as you have an active subscription, plus the 30-day deletion grace period that follows termination. After that, everything is cryptographically erased (see retention).
We process personal data only to:
The nature of processing is storage, transmission, transformation, and deletion — no profiling of data subjects, no automated decisions with legal effect, no advertising.
| Category | Typical fields |
|---|---|
| User account data | Email, name, avatar, password hash, role, MFA state, session metadata |
| Brand data | Brand name, logo, voice samples, style guidelines, connected social handles, OAuth tokens |
| Content | Drafts, scheduled posts, captions, images, videos, chat threads, approval history |
| Analytics | Post-level engagement metrics, follower counts, click events, A/B outcomes |
| Usage telemetry | Feature events, truncated IP, browser type, crash reports (PII scrubbed) |
We do not process special categories of data (Art. 9 GDPR) and ask you not to feed any in. If your content routinely includes health, political, biometric, or similar data, contact us first — some features will need to be restricted.
We apply technical and organizational measures appropriate to the risk, in line with GDPR Art. 32:
The complete measures are described on our Security page and in Annex II of the signed DPA.
We engage a small set of sub-processors, each under a signed DPA with equivalent protections. You authorize these on signup, and we'll give you 30 days' notice before adding a new one (object in writing and you can terminate without penalty).
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Primary database, auth, object storage | EU (Frankfurt) or US (N. Virginia), per workspace |
| Anthropic | AI inference (captions, brand voice, chat) under zero-retention API | US |
| Stripe | Payment processing, subscription billing, tax | US, EU (Ireland) |
| Cloudflare | CDN, WAF, DDoS protection, image optimization | Global edge (data at rest in EU / US) |
| Resend | Transactional email delivery (receipts, alerts, invites) | US, EU |
Up-to-date list, with contract links where public, on the Security page.
EU / UK / Swiss workspaces default to eu-central (Frankfurt) residency — your production data stays in the EU. Some sub-processors (Anthropic, Stripe, Resend) may process data in the US.
Those transfers rely on, in this order: adequacy decisions where available (e.g. the EU-US Data Privacy Framework for certified recipients), Standard Contractual Clauses (2021/914) with the UK Addendum and Swiss supplement, and additional safeguards — pseudonymization, encryption, contractual commitments to challenge overbroad government requests.
Once per year (more if a supervisory authority requires it), you can audit our compliance with this DPA. In practice, the default is:
If we suffer a personal data breach affecting your data, we notify you without undue delay and in any case within 72 hours of becoming aware, with what we know so far: the nature of the incident, categories and approximate number of data subjects affected, likely consequences, and the measures taken or proposed.
Follow-up updates go out as the investigation develops. We help you meet your own notification duties to supervisory authorities and data subjects where applicable.
This DPA is in force for the duration of your Postkeet subscription. On termination, we stop processing, return or delete your personal data at your choice within 30 days, and confirm deletion in writing if you ask. Backups roll off on the next cycle (max 35 days). Anything we're legally required to retain (tax records, fraud logs) stays isolated until its retention clock runs out.
Most customers don't need to sign anything — our online DPA (this page + the SCC module below) is pre-accepted when you accept the Terms. If your procurement team needs a countersigned PDF:
Enterprise customers on our Studio plan get a dedicated legal contact and can route requests through the contact page.
Where this DPA governs a restricted transfer, the parties incorporate the EU Commission's Standard Contractual Clauses (2021/914) by reference:
The applicable clauses apply in full, with Annex I (parties, data, transfers), Annex II (security measures), and Annex III (sub-processors) populated from the sections above. The supervisory authority is the Portuguese CNPD. Governing law and jurisdiction follow Clause 17/18 of the SCCs, with Portuguese courts as the agreed forum.
v2.1 · effective apr 18, 2026 · previous: v2.0 (jan 2026), v1.2 (aug 2025), v1.0 (mar 2025). Change log on request. Questions: dpa@postkeet.com. See also Privacy, Security, GDPR, Contact.