Privacy Notice
1. Who we are
PostGuard is currently operated as a pre-incorporation business in the United Kingdom. For UK data-protection purposes, PostGuard determines why and how personal information is used when providing the service.
Website: postguard.uk
Privacy and security contact: security@postguard.uk
2. Who can use PostGuard
You must be at least 16 years old to create a PostGuard account. PostGuard is not intended for accounts belonging to children under 16.
3. Information we process
Depending on use, we may process account and subscription information; authentication and security records; captions, text, images and metadata submitted for a check; and scan results including OCR text, risk scores, findings, recommendations, safer-post suggestions, landmark indicators, public-source/web-detection intelligence, matching-page references, alerts, cases and audit records. Technical security information may include a privacy-protective hash derived from an IP address and a limited user-agent record.
Passwords are not stored in readable form. Uploaded images are processed temporarily and are not designed to be retained as permanent media after a scan, although derived scan results may remain in Scan History under the retention policy.
4. Why we use information and lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Create/manage accounts and provide scanning, alerts, cases and account features. | Contract. |
| Protect accounts and systems, prevent fraud, investigate abuse and security incidents. | Legitimate interests, subject to your rights and interests. |
| Optional promotional marketing. | Consent. |
| Comply with applicable law. | Legal obligation. |
5. Automated analysis and risk scoring
PostGuard may automatically analyse submitted content using OCR, image analysis, metadata analysis, pattern detection and public-source/web-detection information. It may generate risk scores, findings, recommendations and publishing guidance. Results are decision-support only. A LOW RISK result is not a guarantee that content is safe, lawful or risk-free, and automated analysis may contain errors or false positives. The final publishing decision remains with the user.
PostGuard does not currently use these recommendations to make legal or similarly significant decisions about a person.
6. Images, AI processing and training
You retain your rights in submitted content. Content may be transmitted to approved cloud/AI service providers solely as reasonably necessary to perform the requested analysis. PostGuard does not use customer posts, images or scan content to train AI models under its current policy.
7. Service providers and sharing
| Provider | Purpose |
|---|---|
| Render | Hosting and database infrastructure. |
| Google Cloud Vision | OCR, image analysis and web-detection/image intelligence. |
| Stripe | Subscription billing and payment processing. |
| Resend | Verification and transactional account email. |
We limit sharing to what is reasonably necessary and expect appropriate contractual and security safeguards. Information may also be disclosed where required by law, to establish or defend legal claims, or where a lawful basis permits disclosure necessary to protect users or the service.
7A. Breach and password checks
When you deliberately run an authorised email-breach check, the email address being checked is sent to Have I Been Pwned (HIBP) so HIBP can return known breach records. Do not check an email address unless you own it or are authorised to check it. Password breach screening uses the Pwned Passwords k-anonymity/hash-range method: only a partial SHA-1 hash prefix is sent for comparison, not the full password. Passwords entered into PostGuard's password-strength or breach-check tools are not intended to be stored in readable form or written to the PostGuard database by those tools.
7B. Information about other people
Protection profiles, family notes, social-history imports, public-source results and submitted media may contain information about people other than the account holder. Only provide or analyse such information where you are authorised and have an appropriate lawful basis. Where PostGuard obtains personal data from another source, its transparency obligations may include explaining the categories and source of that information.
8. Public-source intelligence
Where available, PostGuard may use information returned by Google Cloud Vision web-detection capabilities to identify potential public matches or related context. Such results are OSINT leads, not proof of identity, ownership, current location, exact place or time, and should be independently assessed before reliance.
9. International transfers
Some providers may process information outside the UK. Where UK data-protection law requires a safeguard, PostGuard will use an applicable UK transfer mechanism or other lawful safeguard and provide further information on request.
10. Retention and deletion
Account/workspace data and derived scan results are retained as described in the Data Retention Policy. Security-event records are normally retained for up to 12 months. Account deletion removes customer-controlled active database records covered by the deletion workflow, while limited security records and protected backups may remain for their applicable retention periods.
11. Your rights
Depending on the circumstances and lawful basis, UK data-protection law may give you rights of access, correction, erasure, restriction, objection and portability, and the right to withdraw consent where consent applies. Contact security@postguard.uk to exercise applicable rights.
12. Marketing
Marketing is opt-in only. Creating an account does not itself subscribe you to promotional marketing. Essential verification, password-reset, billing, service and security communications are separate from marketing.
13. Third-party and sensitive information
Because PostGuard is designed to identify privacy and security risks, submitted material may incidentally contain information about family members, children, colleagues or members of the public. Users should avoid unnecessary sensitive information and must have an appropriate right or lawful basis to submit material. PostGuard processes incidental third-party information only as necessary to provide and secure the requested service, subject to applicable law.
14. Security
PostGuard uses safeguards including password hashing, secure sessions, CSRF protection, rate limiting, email verification, administrator multi-factor authentication and database recovery controls. No internet service can guarantee absolute security.
15. Complaints
Contact security@postguard.uk with privacy concerns. You also have the right to complain to the UK Information Commissioner's Office (ICO).
16. Changes
PostGuard may update this notice as the service changes. Material changes to how personal information is used will be brought to users' attention where required.
Return to PostGuard · Your Data · Privacy · Terms · Data retention · Cookies · Acceptable use