1. What we collect
You give us
- Account details: your name, email address and password (stored only as a secure hash).
- Company details: company or brand name, timezone, plan and billing contact.
- Content: post captions, images and videos, schedules, review notes and the instructions you give the AI writing assistant.
- Team details: the names and emails of people you invite, and their roles.
Collected when you connect social accounts
- From Meta and Threads: the names, IDs and usernames of the Facebook Pages, Instagram accounts and Threads profiles you choose, and access tokens that let PostJe publish for you. Tokens are encrypted at rest.
- After publishing: the post IDs, links and any error messages the networks return.
Collected automatically
- An audit log of important actions (sign-ins, approvals, edits, setting changes), with the time and IP address.
- When you last signed in, and technical logs needed to keep the service running and secure.
Payments
Card payments are handled by Stripe. We never see or store your full card number; we keep only the card brand, last four digits and subscription status that Stripe sends us.
2. Why we use it
- To run PostJe: let your team draft, approve, schedule and publish posts to the networks you connect.
- To rewrite captions with AI when someone on your team asks for it.
- To bill your subscription, send receipts and handle refunds.
- To send service emails such as invitations, approval requests and password resets.
- To keep accounts secure, investigate misuse and meet our legal obligations.
- To provide support. With your request, PostJe staff may sign in to your workspace to help; every such session is recorded in your audit log.
We do not sell your personal data, and we do not use your posts or content to advertise to you or to train AI models.
3. Who we share it with
Only with the services PostJe needs to work, and only what they need:
- Meta (Facebook, Instagram) and Threads — the posts and media you publish, through their official APIs and under their own policies.
- OpenRouter — the caption text and instruction you send when you use AI rewriting, passed to the AI model your company selected.
- Stripe — billing details needed to take payments and issue refunds.
- Our hosting, storage and email providers, who process data on our behalf to run the service.
- Authorities, where Malaysian law requires it.
Some of these providers process data outside Malaysia. We choose providers with appropriate safeguards and only transfer what is needed to provide PostJe.
4. How long we keep it
- Account and content data: for as long as your company uses PostJe. Deleted posts and disconnected accounts are removed from active use straight away.
- After a company closes its account, we delete or anonymise its data within 90 days, except what we must keep for tax and accounting records (usually 7 years) or to resolve disputes.
- Audit logs: kept while the company account exists, so owners can see who did what.
5. How we protect it
Connections are encrypted with HTTPS, social account tokens are encrypted at rest, passwords are hashed, and access inside a company is limited by roles. No system is perfectly secure, but we work to protect your data and will tell affected customers promptly if a breach affects them.
6. Your choices and rights
Under the PDPA you can:
- ask for a copy of the personal data we hold about you;
- ask us to correct data that is wrong or out of date (you can also edit your profile yourself);
- withdraw consent or ask us to stop processing your data, which may mean we can no longer provide the service;
- disconnect any social account at any time in PostJe, and revoke PostJe's access in your Meta or Threads settings.
Email [email protected] to make a request. We may need to confirm your identity and will respond within 21 days.
To delete the data PostJe keeps from your Facebook, Instagram or Threads accounts, see Data deletion.
7. Cookies
PostJe uses only the cookies needed to keep you signed in, remember your session and protect forms against forgery. We do not use advertising or cross-site tracking cookies.
8. Children
PostJe is a business tool and is not meant for anyone under 18.
9. Changes
If we change this policy in a meaningful way, we will update the date at the top and tell company owners by email or in PostJe before the change takes effect.
10. Language
This policy is written in English. If we provide a Bahasa Melayu version and the two differ, you may rely on either.