GDPR Compliance

1. Overview

The General Data Protection Regulation (EU) 2016/679 gives people in the European Union and the European Economic Area control over their personal data. FoPost is built to honour those rights, and this page explains in plain terms what we process, why we are allowed to process it, who else touches it, and how you take back control of it.

This page supplements our Privacy Policy, which applies to everyone. Where the two differ for EU/EEA residents, this page governs.

2. Data Controller and Scope

FoPost is operated by Porter Bridge, LLC, a Delaware limited liability company, located at 131 Continental Dr, Suite 305, Newark, DE 19713, United States. Porter Bridge, LLC is the data controller for personal data processed through the FoPostwebsite (fopost.com), the Cloud dashboard (app.fopost.com), our API, and our SDK and MCP packages when used against our Cloud service.

This statement applies to individuals in the EU and EEA. If you self-host the open-source SDK, your content and social credentials stay on your own infrastructure, you are the controller for that data, and we process nothing on your behalf unless you connect to our Cloud API.

3. Legal Basis for Processing

We process personal data only where the GDPR gives us a lawful basis to do so. The basis depends on what the processing is for:

Where processing relies on consent, you can withdraw it at any time. Withdrawal does not affect processing that already took place while the consent was valid.

4. Personal Data We Process

• Identity and contact data: name, email address, organization name, profile details you choose to add
• Account credentials: hashed password, session tokens, and API keys, all stored in hashed form
• Connected account data: OAuth access and refresh tokens, platform account identifiers, handle, avatar, and profile information for each social account you connect
• Content data: posts, drafts, schedules, labels, brand voices, and media you upload
• Analytics data: engagement metrics returned by the platforms for the posts you publish through FoPost
• Connected view data: the replies, comments and mentions that reach your connected accounts, and the public posts of accounts you ask us to track, including item text, the author's public name, handle and avatar, a link, and a timestamp
• Billing data: subscription and plan status, invoices, and billing contact details. Card numbers are handled by our payment processor and never reach our servers
• Usage and technical data: IP address, browser and device information, pages and features used, API request logs, and error reports
• AI usage data: the prompts and content you submit to AI features, plus a per-call record of credits charged

We do not knowingly process special categories of personal data under Art. 9, and we ask that you do not submit any through the Service.

5. Your GDPR Rights

If you are in the EU or EEA, you have the following rights over your data:

Exercising these rights is free. We only charge a reasonable fee, or refuse, if a request is manifestly unfounded or excessive, and we tell you why if that happens.

6. How to Exercise Your Rights

Send your request through our contact form from the email address on your account, and tell us which right you are exercising. We may ask for additional information to confirm your identity before we act, so that nobody else can obtain or delete your data.

We respond within one month of receiving the request, and sooner where we can. If a request is complex, we may extend that by up to two further months under Art. 12(3), and we will tell you within the first month if we need to.

Two things you can do immediately without contacting us: disconnect any social account from the Accounts page in the dashboard, which revokes the token with the platform and deletes the stored credentials, and unsubscribe from marketing email using the link in the footer of any such email. Full instructions for erasure are on our Data Deletion page.

7. Subprocessors

We use a small set of vendors to run the Service. Each is bound by a data processing agreement, may process personal data only on our documented instructions, and is held to confidentiality and security obligations at least as strict as our own. These are the categories of recipient and what each one processes data for:

We maintain a current list naming each individual subprocessor. You can request it through our contact form, and it forms part of the Data Processing Agreement described in section 13. If you make an access request under Art. 15, we name the actual recipients of your data.

We do not sell personal data, and we do not share it with advertising networks or data brokers.

8. Connected Social Platforms

When you connect a social account, FoPost sends the content you schedule to that platform on your behalf. The platform is an independent controller for what it then does with that content, under its own terms and privacy policy, not ours. We only transmit what is needed to publish and to read back the analytics for your own posts.

A connected account also sees content that is not yours: replies, comments and mentions from other people, and the public posts of accounts you ask us to track. We read that through the platform's official interfaces under the authorisation you gave, and we may derive aggregate and derived signal from it. The contents themselves are never disclosed to another customer, in any form, and a statistic is only ever released outside your workspace once it covers enough distinct sources and customers that no single item or account can be recovered from it. Section 6 of our DPA puts the same commitments in contractual form.

Content already published to a platform is not removed when you delete your FoPostdata, because it lives on that platform. Delete it there, or revoke FoPost's access from the platform's own app settings.

9. International Data Transfers

Our servers are located in the United States, and several of our subprocessors are US-based, so personal data of EU/EEA users is transferred outside the EEA. We rely on the following safeguards under Chapter V of the GDPR:

• Standard Contractual Clauses: the European Commission's 2021 SCCs, incorporated into our agreements with each subprocessor
• EU-US Data Privacy Framework: relied on where a subprocessor is certified under it
• Supplementary measures: encryption in transit and at rest, data minimisation, and our documented process for reviewing and challenging government access requests, described in section 6 of the Privacy Policy

Product analytics are an exception: that data is processed on infrastructure located in the European Union and does not leave the EEA.

10. Data Retention

We keep personal data only as long as it serves the purpose it was collected for, or as long as the law requires:

• Account and content data: while your account is active, then deleted within 30 days of account deletion
• Social access tokens: revoked and deleted immediately when you disconnect an account or delete your account
• Billing and tax records: 7 years after the transaction, as required by tax and accounting law
• Application and API logs: up to 12 months
• Error reports: up to 90 days
• Aggregated, anonymised data: may be kept indefinitely, as it can no longer identify you

11. Security Measures

Under Art. 32 we maintain technical and organisational measures appropriate to the risk, including:

• Industry-standard encryption of data in transit and at rest
• Encrypted storage of OAuth tokens and API credentials
• Passwords and API keys stored hashed, never in plain text
• Scoped API keys, so a key can only reach the resources you grant it
• Role-based access control and authentication on all internal systems
• Regular dependency and vulnerability review

No system is perfectly secure, and we do not claim otherwise. What we commit to is keeping the attack surface small and responding quickly when something is wrong.

12. Breach Notification

If a personal data breach occurs, we notify the competent supervisory authority within 72 hours of becoming aware of it, as required by Art. 33, unless the breach is unlikely to result in a risk to your rights and freedoms. Where the breach is likely to result in a high risk to you, we notify you directly and without undue delay under Art. 34, describing what happened, what data was involved, and what we are doing about it.

13. Data Processing Agreement

If you use FoPost to process personal data for which you are the controller, for example content and audience data belonging to your own clients, you need a Data Processing Agreement with us under Art. 28. Ours is published in full on our DPA page, including what may be derived from a connected view and what is never disclosed to another customer. Request a signed counterpart, incorporating the Standard Contractual Clauses for transfers outside the EEA, through our contact form.

14. Complaints

If you think we have handled your data incorrectly, tell us first through our contact form. We would rather fix it directly and quickly.

You also have the right under Art. 77 to lodge a complaint with the supervisory authority in the EU/EEA member state where you live, work, or where the alleged infringement took place. The list of national authorities is published by the European Data Protection Board. Contacting us first does not limit that right in any way.

15. Contact

For any question about this page, a rights request, or a DPA, reach us through the contact form:

We may update this page as our processing or our subprocessors change. Material changes are reflected in the "Last updated" date above.