Privacy Policy

Version 3 · Effective 28 October 2026

EasyPostFlow Last updated: 27 October 2026

1. Who we are and what this policy covers

EasyPostFlow is operated by LIST HOUZE PTY LTD, an Australian company. In this policy, "we", "us" and "our" mean LIST HOUZE PTY LTD.

This policy explains how we handle personal information through easypostflow.com, the EasyPostFlow web app at app.easypostflow.com, any mobile app we publish, and our related support and communications. The Service is available internationally. Your rights depend on the laws that apply to the particular processing, including the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply. Section 14 explains additional rights where the EU GDPR or UK GDPR applies.

Our privacy contact is privacy@easypostflow.com. Full contact details are in section 17.

2. Our role, and the content our users create

Information about our users. We decide how personal information is used to manage accounts, workspaces, subscriptions, support, security and our business. This covers individual subscribers, team members and people acting for a business. Where data protection law uses the term, we are the controller for these activities.

Information our users put into the Service. Businesses and creators enter brand details, ideas, captions, images, videos and scheduling instructions. Some of this content may include personal information about other people, such as a customer in a testimonial, a staff member in a photo or a person tagged in a caption. The workspace decides why that information is collected and how it is used, and we process it on the workspace's instructions to provide the Service. Where the law treats the workspace as controller and us as processor, section 5.1 of our Terms of Service sets out our processing obligations.

Workspaces must have the rights and any consent needed for the people and material in their content. If you appear in a post published through EasyPostFlow and want it changed or removed, please contact the business or creator that published it. If you contact us, we will help identify or pass on your request to the relevant workspace where appropriate, while meeting any obligations that apply directly to us.

3. Personal information we collect

Information you or your workspace provide

Account and contact details: name, email address, profile photo, default time zone, sign-in information and account preferences. Where you use a password, our authentication provider stores a protected password hash, not a readable password.
Security details: if you turn on two-factor authentication, a record of your authenticator factors (not your authenticator app's codes).
Brand and workspace details: business or creator name, logo, brand colours, tone-of-voice notes, website, industry, time zone and audience notes.
Content: ideas, drafts, captions, hashtags, images, videos, media files, scheduled posts, approval decisions and publishing history.
Team information: where team features are available, names, email addresses and roles of people you invite, and the invitations you send.
Subscription and payment information (where paid plans are offered): plan, billing contact details, subscription status and transaction records. Stripe handles card payments. We do not store full card numbers or security codes, but may receive limited details such as card brand, last four digits and payment status.
Agreement records: the date you accepted our Terms and Privacy Policy, the versions you accepted, and your confirmation that you are 18 or older.
Communications: support requests, feedback, privacy requests and other messages you send us.

If you sign in with Google, we receive the account information Google makes available through the permissions shown to you, such as your name, email address, profile picture and account identifier. We do not receive your Google password.

When you connect a social media account (see section 6), we receive the information the platform makes available through the permissions you approve. Depending on the platform, this may include:

the name, username, profile picture and platform identifier of the account, page or profile you connect;
the list of pages or professional accounts you are allowed to manage, so you can choose which to connect;
an access token and related credential data that lets us publish on your behalf;
the result of each publish request, including the platform's post identifier, status and any error message;
where you enable it and the platform provides it, basic performance information about posts published through EasyPostFlow, such as reach, impressions, likes and comments.

We never receive or store your social media passwords. We request only the permissions needed for the features you use, and you approve them on the platform's own authorisation screen.

Information collected when you use the Service

Sign-in and session records, IP addresses and approximate location derived from them.
Device, browser, operating system and app information.
Activity, error and diagnostic records used to operate, support and protect the Service, including publishing job logs.
Email delivery information, such as delivered, bounced and failed events.
Website usage measurement as described in section 10.

You do not have to provide optional information. Where information is needed to create an account, connect a social account, take a payment or deliver a feature you ask for, we may not be able to provide that feature without it.

Sensitive information. The Service is not designed for sensitive information. We do not ask for information about health, racial or ethnic origin, political or religious beliefs, sexual orientation or criminal history. Think carefully before including such information about yourself or anyone else in content you intend to publish. If it is submitted, it may be processed as part of that content; contact us if it needs to be removed from EasyPostFlow. Content already published to a platform is governed by that platform.

4. How we use personal information

We use personal information as needed to:

create and manage accounts, workspaces and team membership;
store, organise and schedule your content;
publish content to the social media accounts you connect, at the times you choose;
show you the status and, where enabled, the performance of published posts;
send the account, approval, publishing and security notifications you have not switched off;
process subscriptions and payments where paid plans are offered;
provide support and tell you about your account, security, billing and changes to the Service;
protect accounts and the Service, prevent fraud, spam and platform-policy abuse, investigate problems and enforce our terms;
understand how the Service is used and improve it, as described in section 10;
send product marketing only where you have opted in;
meet legal obligations, keep required business records and handle disputes.

We do not use your content, your audience or your connected accounts for our own marketing, and we do not post to your accounts without an instruction from your workspace. We do not sell personal information. Section 14 explains our legal bases where the EU GDPR or UK GDPR applies.

5. Published content

Content you publish through EasyPostFlow is published on a third-party platform under your account there. Once published, it is visible to that platform's audience under its rules and may be copied, shared or indexed by others. Deleting a post or your account in EasyPostFlow does not delete the post from the platform; use the platform's own tools for that.

Connecting a social media account is optional and happens only when you authorise it. When you connect, publish or request performance information, the platform receives the content and instructions involved, and we receive the information described in section 3. Each platform handles that information under its own terms and privacy policy.

Platform What the connection does Platform privacy policy Facebook Pages and Instagram professional accounts (Meta) Lists the pages and Instagram accounts you can manage; publishes posts you approve; returns publish status and, where enabled, post performance Meta Privacy Policy TikTok (when available) Publishes videos you approve to your TikTok account and returns publish status TikTok Privacy Policy

The Connections page in the app shows which platforms are currently available. Platforms process information in the United States and other countries.

We hold the access tokens that let us publish on your behalf. They are stored encrypted, used only to carry out your workspace's instructions, and deleted as described in section 12. We do not use a connected account for anything other than the features you use.

6.2 Removing EasyPostFlow from a platform

You can disconnect an account at any time on the Connections page in EasyPostFlow. You can also remove EasyPostFlow in the platform's own settings (for example, Facebook Settings → Business integrations, or TikTok Settings → Security → Apps and services). We recommend doing both. When you disconnect, or a platform tells us you removed the app, we stop using the token immediately and delete the connection data as described in section 12. To ask for confirmation that connection data has been deleted, email privacy@easypostflow.com with the platform and account name; we will respond within 30 days.

6.3 Service providers

We use the providers below to run the Service. We give them only the information relevant to their function and require appropriate privacy and security protections. Some also process information for their own legal, security or account purposes, as explained in their own notices.

Provider Purpose and information involved Location Supabase Database, authentication and file storage for accounts, content and media Primary database and storage in Sydney, Australia; provider support and related operations may involve other countries Vercel Web hosting, content delivery, scheduled jobs, request and diagnostic logs, and cookie-free website usage measurement Global infrastructure, including the United States Resend Sending account, approval, publishing and security emails, including recipient addresses, message content and delivery records United States Hostinger Our support mailboxes, including messages you send to our email addresses International operations Cloudflare Domain and DNS services, and Turnstile protection of sign-in, sign-up and password-reset forms against automated abuse using device, browser, network and interaction signals Global network, including the United States Google sign-in (if you use it) Authentication and the account information you authorise Global infrastructure, including the United States Stripe (where paid plans are offered) Subscription payments, billing and payment fraud prevention International operations, including the United States

More information: Supabase, Vercel, Resend, Hostinger, Cloudflare, Google and Stripe. Provider locations and subprocessors can change; contact us for details relevant to your account.

6.4 AI assistant connections

You may choose to connect your EasyPostFlow workspace to a supported third-party AI assistant, such as ChatGPT (OpenAI), Claude (Anthropic), Gemini (Google), Microsoft Copilot or Grok (xAI), where that assistant supports connecting to EasyPostFlow. Connecting is optional and gives the provider no access until you authorise it. Our AI Use Policy explains what a connected assistant can and cannot do.

Information shared through the connection. Depending on your request, results may include your brand profile, ideas, draft captions and hashtags, schedule dates and times, connected-account names and publishing status. We limit responses to what the task needs. We do not provide bulk exports, media files or full database records through the connection, and never return passwords, access tokens, authentication secrets or payment details. Text you type into captions and notes is returned as stored, so do not put sensitive information in those fields.

Information we receive. We receive the details included in each request, such as search terms, caption text, scheduling instructions and draft references, which may contain text from your conversation with the assistant. We do not request or receive your full conversation history, assistant memory or unrelated files.

Records we keep. We keep limited records of connector use and security events: user and workspace identifiers, connection and provider identifiers, the action used, the related item, the time and the result. Security records may include an IP address and sign-in or error events. Connector logs do not include access tokens, passwords or full conversation text.

Assistant providers. The connection is made with your own account at the assistant provider and is governed by that provider's terms and privacy policy, for example OpenAI, Anthropic, Google, Microsoft and xAI. Information you share with an assistant may be processed outside Australia, including in the United States. We have no contract controlling how a provider handles information you share through your own account, and we cannot promise a provider will not use it for model training; check your assistant's settings before connecting. These providers are not our subprocessors merely because you connect your own account.

Your choices. You decide whether to connect an assistant and which one. You can revoke the connection in the app at any time. Revoking stops further access but does not undo completed actions or delete drafts already created. For information held by an assistant provider, use its own controls or contact it directly.

6.5 Other disclosures

We may also disclose information:

to members and administrators of your workspace, according to their roles;
to the platforms you connect, when you publish or request performance information;
to professional advisers, insurers and auditors where needed, under confidentiality;
as part of a proposed or completed sale or restructure of our business, with appropriate safeguards and any legally required notice;
where the law requires or permits it, to establish or defend legal claims, or where reasonably needed to address fraud, security threats or a serious threat to someone's safety.

7. International processing and transfers

EasyPostFlow is operated from Australia, and our main database is in Sydney. Hosting, email, payments, sign-in, social media platforms, AI assistant providers and support can involve the other countries described in section 6.

Privacy laws in other countries may differ from those where you live. Where Australian privacy law applies, we take the steps it requires for overseas disclosures. Using the Service does not waive your privacy rights or our obligations. Where the EU GDPR, UK GDPR or another law requires safeguards for a particular international transfer, those safeguards must be in place before the transfer. Contact privacy@easypostflow.com for information about the locations and safeguards relevant to your information.

8. Security and data breaches

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse and disclosure. These include encrypted connections, optional two-factor authentication (required for our administrators), encrypted storage of social media access tokens, private storage of your media and profile photo, role-based access controls, and restricted access to production systems.

During publishing, a platform may need to fetch a media file from us through a temporary link. Do not upload confidential material that you do not intend to publish. Protect your sign-in details and tell us promptly if you suspect unauthorised access or that a post was published that your workspace did not approve.

No online service can guarantee absolute security. We assess suspected breaches and notify affected people, workspace customers and regulators when the law requires. Where the Australian Notifiable Data Breaches scheme applies, we meet its assessment and notification requirements. Section 14 covers EU and UK notifications.

9. Teams and workspace roles

Where team features are available, a workspace owner can invite team members and assign roles that control who can create drafts, approve, publish and manage connections. Team members can see the workspace's content, calendar, connected-account names and other members' names and profile photos, according to their role. The owner is responsible for who they invite and for removing people who should no longer have access. We send invitation emails only to addresses the owner provides.

10. Cookies, browser storage and website usage measurement

We use cookies or similar browser storage that are needed for the Service to work, such as keeping you signed in, security, remembering your settings and keeping an unsaved draft on your device.

We measure how the website and app are used with Vercel Web Analytics, which does not use cookies and does not identify you personally. It records information such as pages viewed, referring site, browser, device type and approximate country.

We do not currently use advertising cookies or analytics tools that set cookies. If we add any in future, we will ask for your consent before they run where the law requires it, and you will be able to change your choice at any time.

Cloudflare Turnstile helps detect automated abuse when you sign in, create an account or reset a password, as described in section 6.3. We use it for security purposes only.

11. Marketing and service messages

We send EasyPostFlow marketing emails only if you have opted in, and you can unsubscribe using the link in any marketing email or by contacting us.

Messages about account access, security, team invitations, approvals, publishing results and failures, billing and important service changes are not marketing. You can switch off some notification types in your account settings; security, billing and account messages are still sent while they are relevant to your account.

12. Retention and deletion

We keep information only as long as needed for the purposes in this policy, taking account of the type of information, our relationship with you, security needs and legal requirements.

Active accounts and content: kept while your account is open and the information is needed to provide the Service. Cancelling a paid plan does not delete your account or content; the account moves to the free plan.
Social media connections: access tokens and connection records are kept while the connection is active. When you disconnect, or a platform tells us you removed the app, we stop using the token immediately and delete the connection record within 30 days. Publishing history for posts already published stays with your content so you can see what was posted and when.
Account deletion: you can delete your account in the app (Account settings) or by emailing privacy@easypostflow.com. When you delete, we immediately block sign-in, sign out all your sessions, delete your social media access tokens and hide your content. For 30 days you can ask support to restore the account. After 30 days we permanently delete your posts, ideas, brand profile, media files, profile photo, connection data and your login from our live systems, except the records described below. If you ask us by email, we follow the same process after verifying that you own the account. Download a copy of your data from the app before deleting if you need it.
Required records: we keep limited billing and transaction records, together with the minimum identity details needed for them (such as name, email address, business details and invoices), and records of your acceptance of our terms, for as long as the law requires (generally 7 years for tax and transaction records under Australian law) or as reasonably needed to establish, exercise or defend legal claims. This does not justify keeping your content.
Backups: deleted information may remain in encrypted backups for up to 35 days until they are overwritten. Backups are not used for ordinary operations, and if we ever restore one we reapply deletions.
Logs: application, publishing-job and access logs are kept for up to 12 months for security, debugging and abuse prevention, then deleted or de-identified. AI connector technical and security logs are kept for up to 90 days, and connector action records for up to 12 months.

A post you have already published remains on the platform. Deleting your EasyPostFlow account does not remove it from Facebook, Instagram, TikTok or any other platform.

13. Access, correction, requests and complaints

You can ask us at privacy@easypostflow.com for access to or correction of your personal information, deletion of your account, or information about how we handle your data. You can also update much of your information and download your data in the app. Other rights depend on the law that applies, as explained in section 14.

We may need to verify your identity and your authority to act for a workspace. We aim to respond within 30 days and will meet any shorter legal time limit. If we cannot agree to all or part of a request, we will explain why where we are allowed to, and tell you how to complain. We do not charge for making a request or correcting your information.

Complaints. Email us with the issue, relevant dates and the outcome you want. We will acknowledge your complaint, investigate it and aim to give you a written response within 30 days. If we need more time, we will tell you why and when to expect a response.

If you are not satisfied, or we have not responded within a reasonable time, you can contact the Office of the Australian Information Commissioner on 1300 363 992, or a privacy regulator with authority over your complaint.

14. Additional information where EU or UK data protection law applies

This section applies to the extent the EU General Data Protection Regulation or the UK GDPR governs our processing of your personal information.

Legal bases. Where we act as controller, our legal bases are:

Activity Legal basis Providing an account, subscription, requested support and related messages to an individual who contracts with us Performing a contract, or steps you asked for before entering one Managing business workspaces and communicating with their team members Our legitimate interests in providing and running services for the business Security, abuse prevention, reliability, handling disputes and enforcing our terms Our legitimate interests in protecting the Service, our users and our legal rights Optional cookies, analytics and marketing emails Consent Meeting a legal duty Legal obligation

For personal information in content we process for a workspace, the workspace is responsible for its own legal basis.

Your rights. Subject to the conditions and exceptions in the law, you can ask for access, correction, erasure, restriction of processing and data portability. You can object to processing based on legitimate interests for reasons relating to your situation, and to direct marketing at any time. You can withdraw consent at any time without affecting earlier processing. We normally respond within one month and may extend this by up to two further months where the law allows, telling you why within the first month. You can complain to your local supervisory authority; in the UK, that is the Information Commissioner's Office.

Transfers, retention and breaches. Sections 7 and 12 explain international processing and retention. Where we are controller and notification is required, we will notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, and affected people without undue delay where there is a high risk to them. Where we act as processor, we will notify the relevant workspace without undue delay.

15. Children

Accounts are for adults using the Service for business, professional or creator purposes. You must be at least 18 to create an account, and we do not knowingly allow children to register.

Content can still include images or information about a child, for example a family business photo. The workspace publishing it is responsible for having a lawful reason and any consent required. If you believe a child has registered or that information about a child was submitted improperly, contact us so we can look into it.

16. Changes to this policy

We may update this policy to reflect changes to the Service, supported platforms, our practices or the law. The version and effective date at the top show the current version. We will give appropriate notice of material changes, by email or in the app where appropriate, before they take effect unless the law or an urgent security need requires otherwise. If a change requires your consent, we will ask for it.

17. Contact

LIST HOUZE PTY LTD