GDPR & data protection
How PostDaily meets its obligations under the UK GDPR — your rights, our lawful bases, international transfers and subprocessors.
1. Data protection at PostDaily
PostDaily is operated by Galaxyway AI Ltd(registered in England and Wales, company number 15966090). We process personal data in line with the UK GDPR and the Data Protection Act 2018. This page summarises how we meet those obligations and how you can exercise your rights; it works alongside our Privacy Policy.
For the personal data of PostDaily account holders, Galaxyway AI Ltd is the data controller. Where you use PostDaily to process the personal data of your own audience or clients, you are the controller of that data and we act as your processor (see section 5).
2. Lawful bases for processing
We rely on the following lawful bases under the UK GDPR:
- Contract — to provide the Service you sign up for.
- Legitimate interests — to secure, support and improve the Service and prevent misuse.
- Legal obligation — to meet tax, accounting and other legal requirements.
- Consent — for optional marketing and non-essential cookies, which you can withdraw at any time.
3. Your rights & how to exercise them
Under the UK GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased ("right to be forgotten");
- restrict or object to certain processing;
- receive your data in a portable format (data portability);
- withdraw consent where processing is based on consent.
You can access, export or delete your data directly from your account settings, or email support@postdaily.app and we will respond within the statutory time limit. We may need to verify your identity first. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
4. International transfers
Some of our service providers operate outside the UK, including in the United States. Where we transfer personal data internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or an adequacy decision.
5. When we act as your processor
When you use PostDaily to schedule and publish content, we process the personal data contained in that content (and in your connected accounts) on your instructions, as your processor. We only process it to provide the Service, keep it secure and comply with the law. A Data Processing Agreement (DPA) covering this relationship is available to business and agency customers on request at support@postdaily.app.
6. Subprocessors
We use a small number of trusted subprocessors to run the Service:
- Cloudflare, Inc. — hosting, media storage, database connectivity, AI inference and transactional email.
- Amazon Web Services, Inc. — managed database hosting.
- Polar Software Inc. — billing and payment processing.
- Connected social networks — to publish the content you schedule.
A current, detailed list of subprocessors is available on request at support@postdaily.app.
7. Retention & deletion
We keep personal data only for as long as your account is active or as needed to provide the Service. When you delete your account we delete or anonymise your personal data within 30 days, except where we must retain certain records — such as billing and tax records — to meet legal obligations.
8. Contact us
For any data protection question or request, contact our team. The data controller is Galaxyway AI Ltd.