Legal

Privacy Policy

Last updated: June 1, 2025 · Effective date: June 1, 2025

Plain summary: PostLayr stores your email, hashed password, Instagram tokens, and scheduled posts. We use this data only to run the service. We don't sell your data, serve you ads, or share it with third parties beyond what's needed to publish to Instagram.

1. Who we are

PostLayr is a social media scheduling service operated by LyfWis, India. Website: postlayr.com. Contact: privacy@postlayr.com

2. Information we collect

2.1 Account data

Email address — for login and support
Password — stored as a PBKDF2-SHA256 hash (100,000 iterations). We cannot read your password.
Name — for personalisation

2.2 Instagram data (via Meta's official API)

Instagram user ID, username, profile picture
Long-lived OAuth access token (expires ~60 days)
Follower count (display only)
Facebook Page ID linked to your account

We use these tokens only to publish the posts you schedule. We don't read DMs, stories, or any content you haven't asked us to publish.

2.3 Content you upload

Media files and captions you upload are stored to publish at your chosen time. Files are deleted when you delete the post or close your account.

2.4 Technical data

IP address (rate limiting and abuse prevention)
Browser user agent
Login timestamps and publish logs

No third-party analytics trackers (Google Analytics, Mixpanel, etc.) are used.

3. How we use your information

To authenticate your account and maintain your session
To publish your scheduled content to Instagram
To show you analytics about your own posting activity
To detect and prevent abuse and fraud
To comply with legal obligations

4. Legal basis for processing (GDPR)

For EEA/UK users: Contract performance (providing the service), Legitimate interests (security, abuse prevention), Legal compliance (where required by law).

5. Data sharing

Meta Platforms: When publishing, we transmit your media and caption to Instagram's Graph API. Meta's use is governed by their Privacy Policy.

Cloudflare: Infrastructure provider (Workers, D1, R2). Acts as a data processor. Cloudflare Privacy Policy.

Lemon Squeezy: Payment processing (Merchant of Record). PostLayr never receives your card details. Lemon Squeezy Privacy Policy.

Legal disclosures: We may share data if required by applicable law or to protect the safety of our users.

6. Data retention

Account data: retained while active. Deleted within 60 days of a deletion request (cancellable by logging back in).
Media files: deleted with the post or on account deletion.
Instagram tokens: deleted when you disconnect the account or close your account.
System logs: 90 days, then auto-purged.
Billing records: 7 years (Indian accounting law).

7. Your rights

You may request: access, correction, deletion, portability, or objection to processing. Email privacy@postlayr.com. We respond within 30 days. You can also delete your account directly from the Dashboard.

8. Security

All data over HTTPS with TLS 1.2+
Passwords hashed with PBKDF2-SHA256, 100,000 iterations
Session tokens are cryptographically random
Daily encrypted database backups

9. Children's privacy

PostLayr is not directed at children under 13 (or 16 in the EEA). If you believe a child has an account, contact us immediately.

10. Indian compliance (IT Act 2000 & DPDP Act 2023)

PostLayr complies with India's IT Act 2000, SPDI Rules, and the Digital Personal Data Protection Act 2023 to the extent applicable. We collect data only with your consent, for declared purposes, and provide rights as a Data Principal.

11. Changes

Material changes will be announced in-app with at least 14 days notice. Continued use after the effective date constitutes acceptance.

12. Contact

Email: privacy@postlayr.com · Website: postlayr.com