Data processing agreement (summary)
Last updated: October 2026. This is a starting draft; have it reviewed by counsel before launch.
For paid plans Postfree acts as processor for the personal data contained in your workspace content under GDPR art. 28. The full DPA including sub-processor list and standard contractual clauses is available on request and will be presented at checkout.
Processing takes place in the EU. Transfers outside the EU occur only when you instruct us to publish to a social network located outside the EU.
We implement encryption at rest and in transit, least-privilege access, audit logging and incident notification within 72 hours.