How PostFlow collects, uses, and protects your personal data. Last updated: June 2026.
Plain English summary: PostFlow helps you create and schedule social media content. To do that, we need your email, brand info, and access to your social accounts. We don't sell your data. We don't use it for ads. We store it securely and you can delete it any time.
PostFlow (“PostFlow”, “we”, “us”, “our”) is a social media content creation and scheduling platform operated by MindYourBodyPT B.V., registered in the Netherlands.
MindYourBodyPT B.V. is the data controller for personal data collected through postflowsocials.app.
KVK: 42003965 · BTW: NL869239909B01
Contact: support@mindyourbodypt.nl (subject: PostFlow – Privacy)
| Category | What we collect | Source |
|---|---|---|
| Account data | Email address, display name, profile picture | You, or Google/SSO on signup |
| Brand data | Business name, industry, niche, logo, colours, tone of voice, goals | You (during onboarding and brand setup) |
| Content data | Videos, images, and text you upload or generate via PostFlow | You |
| Social account tokens | OAuth access tokens for Instagram, Facebook, LinkedIn, TikTok, Buffer | Platform OAuth flows (you approve) |
| Analytics data | Post reach, impressions, likes, comments, shares — pulled from connected platforms | Buffer API / platform APIs |
| Usage data | Pages visited, features used, session duration | Automatically collected |
| Technical data | IP address, browser type, device type | Automatically collected |
| Billing data | Subscription plan, payment history (no card numbers — handled by Stripe) | Stripe (payment processor) |
We do not collect sensitive personal data (health, religion, ethnicity, political views, etc.).
We do not use your content or brand data to train AI models for other customers. Your brand intelligence tokens are private to your account.
We do not sell your personal data to third parties. We do not use your data for advertising.
PostFlow processes personal data under the following legal bases as defined in Article 6 of the GDPR:
| Processing activity | Legal basis |
|---|---|
| Creating and managing your account | Contract performance (Art. 6(1)(b)) |
| Generating content and scheduling posts | Contract performance (Art. 6(1)(b)) |
| Processing payments | Contract performance (Art. 6(1)(b)) |
| Sending transactional emails | Contract performance (Art. 6(1)(b)) |
| Fraud prevention and security | Legitimate interests (Art. 6(1)(f)) |
| Product analytics and improvement | Legitimate interests (Art. 6(1)(f)) |
| Marketing communications | Consent (Art. 6(1)(a)) — opt-in only |
PostFlow uses the following third-party services to operate. Each acts as a data processor under a Data Processing Agreement (DPA):
| Service | Purpose | Location |
|---|---|---|
| Supabase | Database and authentication | EU (Frankfurt) |
| Vercel | Application hosting | EU regions available |
| Anthropic (Claude API) | AI content generation | USA (SCCs apply) |
| Buffer | Social media scheduling | USA (SCCs apply) |
| Shotstack | Video rendering | Australia (SCCs apply) |
| Mollie | Payment processing (NL and supported countries) | Netherlands (EU) |
| Stripe | Payment processing (international) | EU/USA (SCCs apply) |
| Meta (Instagram/Facebook) | Publishing and analytics | USA (SCCs apply) |
| Publishing and analytics | USA (SCCs apply) |
Where data is transferred outside the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure adequate protection.
| Data type | Retention period |
|---|---|
| Account and brand data | Until you delete your account, then 30 days before permanent deletion |
| Published post content | Until you delete it, or account deletion |
| Analytics data | 24 months from collection |
| Social account OAuth tokens | Until you disconnect the platform or delete your account |
| Billing records | 7 years (Dutch tax law requirement) |
| Usage logs | 90 days |
When you delete your account, all personal data is permanently deleted within 30 days, except billing records which we are legally required to retain for 7 years.
As a resident of the EU/EEA, you have the following rights regarding your personal data:
Request a copy of all data we hold about you
Correct inaccurate or incomplete data
Request deletion of your personal data (“right to be forgotten”)
Ask us to limit how we use your data
Receive your data in a machine-readable format
Object to processing based on legitimate interests
Withdraw consent for marketing at any time
Not be subject to solely automated decisions with legal effects
To exercise any of these rights, email support@mindyourbodypt.nl?subject=PostFlow%20-%20Privacy. We will respond within 30 days. We may ask you to verify your identity before processing the request.
We take reasonable technical and organisational measures to protect your personal data, including:
In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours as required by GDPR Article 33.
PostFlow uses the following cookies:
| Cookie | Purpose | Duration |
|---|---|---|
sb-auth-token | Supabase authentication session | Session / 7 days |
pf_active_brand | Remembers your active brand selection | 1 year |
pf-weekly-ideas | Caches weekly content ideas locally | 7 days |
PostFlow does not use advertising cookies, tracking pixels, or third-party analytics cookies. We do not use Google Analytics.
For any questions about this privacy policy or your personal data:
📧 support@mindyourbodypt.nl (subject: PostFlow – Privacy)
🏢 MindYourBodyPT B.V. · KVK: 42003965 · BTW: NL869239909B01
We aim to respond to all privacy requests within 30 days.
If you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Dutch supervisory authority:
We may update this privacy policy from time to time. When we make material changes, we will notify you by email and update the “last updated” date at the top of this page. Continued use of PostFlow after changes constitutes acceptance of the updated policy.