Your Data & Data Protection
Your data at a glance
This page is the plain-English PostGuard data-protection summary. It explains what information PostGuard may keep, why it is needed, who may receive it, how long it is normally kept and the choices available to you. More detail is provided in the Privacy Notice and Data Retention Policy.
1. Information PostGuard may keep
| Data | Why it may be kept | Typical handling |
|---|---|---|
| Account details | Provide and administer your account. | Email address, role, subscription/account status and account timestamps may remain while the account is active and for any justified period afterwards. |
| Authentication and security records | Protect accounts, detect abuse and investigate security events. | Passwords are stored as password hashes, not readable passwords. Security events may include a privacy-protective IP-derived hash and limited user-agent information. |
| Protection profile information | Provide authorised personal-exposure protection. | Information you choose to supply may include name, protected email, phone/contact number, approximate region, usernames, authorised social-profile URLs, family-protection notes and vehicle-protection notes. |
| Posts and scan inputs | Perform the security/reputation check you request. | May include captions, uploaded images/video, visible text/OCR and available metadata. Do not submit information you are not authorised to use. |
| Scan outputs | Show history, findings and remediation. | May include security/reputation scores, findings, recommendations, safer-post suggestions, image-analysis results and interpretation analysis. |
| Alert evidence | Allow review of serious findings. | Original media associated with HIGH/CRITICAL alerts may be retained for the configured evidence-retention period; the current default is 30 days unless configuration or a justified hold changes it. |
| Alerts, cases and audit records | Operate the protection and incident-management service and provide accountability. | May contain alert/case details, status, actions and timestamps. |
| Billing and transactional records | Manage subscriptions, payments and business administration. | PostGuard may keep relevant identifiers/status records; payment-card processing is handled by the payment provider rather than PostGuard storing full card details. |
| Authorised breach-check data | Run a breach lookup you request. | An email address entered for a Have I Been Pwned lookup is sent to that provider for the requested check. Password breach screening uses the Pwned Passwords hash-range/k-anonymity method; PostGuard does not need to send the full password. |
| Public-source / web-match intelligence | Identify possible exposure relevant to an authorised protection review. | Potential matches are treated as leads, not proof of identity, ownership, location or wrongdoing. |
2. Data PostGuard should not keep
PostGuard is designed not to store readable account passwords. Users should not enter authentication codes, private-message content, unnecessary identity documents, payment-card details or other information that is not needed for the requested protection purpose.
3. Why PostGuard processes personal data
PostGuard processes information only for stated purposes such as providing the contracted service, account and system security, authorised protection/scanning features, billing and administration, compliance with law, and optional marketing where the appropriate permission applies. Information should not be reused for an unrelated purpose without first assessing the lawful basis and transparency requirements.
4. Who information may be shared with
Depending on the feature used, information may be processed by approved infrastructure and service providers such as hosting/database providers, image-analysis providers, payment providers and transactional-email providers. An authorised HIBP email lookup necessarily sends the email address being checked to Have I Been Pwned. PostGuard should disclose new material processors or new uses before introducing them where required.
5. Retention
PostGuard follows storage limitation: personal data should not be kept longer than necessary for the purpose for which it is held. Different records therefore have different periods. Security-event records are normally retained for up to 12 months; serious-alert media uses the configured evidence-retention period; other account, scan, case, billing and legal records follow the Data Retention Policy and any justified legal or security hold. Data should be deleted or anonymised when no longer required.
6. Your data-protection rights
Depending on the circumstances and lawful basis, you may have rights to be informed, obtain access to your personal data, correct inaccurate information, request erasure, restrict processing, object to processing, receive portable data and withdraw consent where consent is the basis relied on. You can contact security@postguard.uk to make a data-rights request.
Your right to object: where PostGuard relies on legitimate interests, you may object to that processing. PostGuard must consider the objection in accordance with applicable data-protection law.
7. Automated analysis
PostGuard can use automated analysis and profiling-like risk scoring to provide security and reputation decision-support. Scores and findings may be wrong or incomplete and are not intended to make legal or similarly significant decisions about a person. The user remains responsible for the final publishing or remediation decision.
8. Information about other people
If you provide information about another person, only do so where you are authorised and have an appropriate lawful basis. PostGuard's privacy information must also cover personal data obtained from other sources, including the categories and source of that information where required.
9. International processing
Some service providers may process information outside the UK. Where UK data-protection law requires safeguards for a restricted transfer, PostGuard will use an applicable transfer mechanism or other lawful safeguard and provide further information on request.
10. Complaints
Please contact security@postguard.uk first if you have a privacy concern so it can be investigated. You also have the right to complain to the UK Information Commissioner's Office (ICO) about the handling of your personal information.
11. Data minimisation and security
PostGuard should collect only information that is adequate, relevant and necessary for the protection purpose, restrict access according to role, protect authenticated sessions, use appropriate encryption/security controls, and periodically review retained information.
12. Changes to data use
Privacy information must be reviewed as PostGuard changes. If PostGuard introduces a materially new use of personal information, new monitoring, new social-media integrations, new AI processing or a new data category, the relevant privacy information should be updated and users informed before the new processing begins where required.
More information
Full Privacy Notice · Data Retention Policy · Cookie Policy · Terms of Service · Acceptable Use Policy
Return to PostGuard · Your Data · Privacy · Terms · Data retention · Cookies · Acceptable use