Privacy notice

Who this notice covers

WhoPosts provides software for organizations to coordinate physical promotional displays. An organization that creates a workspace generally controls the business records, instructions, poster files and evidence its authorized people submit. WhoPosts processes that customer content to provide the service. WhoPosts separately controls account administration, security, support, billing and public-website information.

Information we collect

• Account and access data, such as name, email address, workspace membership, role, permitted stores, sessions and security events.
• Operational content, such as stores, display spots, offers, instructions, poster files, evidence photos, annotations, review decisions and reports.
• Service data, such as device and app version, bounded diagnostic events, audit records, delivery status, usage totals and security signals.
• Billing records, when paid plans are enabled, such as plan, provider identifiers, invoice status and entitlement dates. WhoPosts does not store full payment-card details.
• Website analytics only when a visitor opts in. Our public website then sends basic page-view information to Google Analytics. Enhanced measurement and advertising signals are disabled.

Why we use information

We use information to authenticate people, enforce permissions, deliver requested workflows, process and protect private files, send service messages, provide support, maintain audit history, prevent abuse, reconcile subscriptions, back up and restore the service, and comply with law. We do not sell personal data or use customer poster and evidence content for advertising.

Sharing and service providers

We share the minimum necessary information with infrastructure and service providers that help operate WhoPosts. Our current provider list and purposes are published on the subprocessors page. We may also disclose information when required by law, to protect people or the service, or during a business transaction subject to appropriate safeguards.

International processing

WhoPosts and its providers may process information outside the country where a user is located. Where required, the organization using WhoPosts and the relevant provider terms must establish an appropriate transfer mechanism. We do not promise a particular data-residency region unless it is stated in a signed order.

Retention and deletion

We retain account and customer data while needed to provide the service, maintain required business and security records, resolve disputes and meet legal obligations. Immutable versions and audit records may be retained longer than editable working data so decisions remain accountable. Backup copies expire through controlled rotation rather than immediate deletion. Because final jurisdiction-specific retention periods are still undergoing legal review, WhoPosts does not silently perform irreversible deletion based on a draft schedule. Workspace owners can submit access, export, correction or deletion requests from the product or by email.

Your choices and rights

Depending on location, a person may have rights to access, correct, delete, restrict or object to processing, receive a portable copy, or complain to a regulator. Some requests must be handled by the person’s organization as the data controller. Email support@whoposts.com with “Privacy request” in the subject. We may verify identity and authority before acting.

Security and children

We use tenant isolation, role and store scoping, private object storage, encryption in transit, restricted service credentials, immutable version history and bounded monitoring. More detail is available on our security page. WhoPosts is a business service and is not directed to children.

Changes and contact

We will post material updates here with a new effective date and provide additional notice when appropriate. Questions can be sent to support@whoposts.com.