Privacy Policy

1. Who we are

Postelix is a brand and service of Unfair Advantage Ltd, a company in Cyprus with its business address at Meleti 2C, 8570 Pegeyia, Cyprus. In this policy, "Postelix", "we", "us", and "our" refer to Unfair Advantage Ltd and the Postelix product.

Postelix provides B2B audience intelligence and customer-directed research, content, and workflow services. Depending on the features you enable, we process professional profile and company information, public professional activity, customer-provided lists and notes, and information from accounts or integrations you choose to connect. Features may include drafting and review, authorised communication workflows, CRM and calendar integrations, and other separately described options. The information we process and the providers that receive it depend on the features and integrations you enable. This Privacy Policy explains how we collect, use, store, and protect personal data when you use Postelix.

2. Scope of this policy

This policy applies to the Postelix website, dashboard, onboarding flow, browser extension, payment flows, support interactions, and any related Postelix services. It does not apply to third-party websites or platforms that we do not control, including LinkedIn, Google, Stripe, or AI providers.

Website capture on customer websites: when a customer installs the Postelix website capture script on its own website, the customer is the controller of its visitors' data and we process that data on the customer's behalf, under the customer's instructions and our Data Processing Agreement. The customer's own privacy notice applies to those visitors. We use the visitor's IP address only to identify the company network behind the visit; we do not identify the individual visitor.

3. Data we collect

We collect only the data needed to provide, secure, support, and improve Postelix. Depending on how you use the service, this may include:

• Account data: name, email address, authentication method, account identifiers, plan, credits, and basic profile settings.
• Onboarding and voice profile data: your positioning, offer, ideal customer profile, tone, writing preferences, saved examples, and other information you provide so Postelix can write in your style.
• LinkedIn and source content: posts, comments, profile snippets, lead notes, source documents, and other content you choose to import, save, analyse, or use as context.
• Read-only LinkedIn connections: if an account is connected read-only, engagement with that account's own posts and who viewed its profile, as LinkedIn shows it to the account holder.
• Connected CRM data: if you connect HubSpot, we read contacts, companies, deals, owners, lists, and sales activity records (type, time, owner, direction, subject or title, and outcome). We never read the body of an email, call, meeting, note, or task. We write contacts, our own "Postelix" contact fields, a static list, and a note.
• Generated content: drafts, comments, post ideas, messages, prompts, edits, and feedback created or saved in Postelix.
• Usage and product data: pages visited, actions taken, features used, generation counts, error logs, device information, browser type, approximate location, and company-level network information inferred from IP address.
• Billing data: plan, payment status, invoices, billing address, and subscription events. Full card details are processed by Stripe and are not stored by Postelix.
• Support data: messages you send to us, attachments, troubleshooting information, and records of our responses.

4. LinkedIn data and the people you contact

Information for professional contacts: our professional data notice explains our independent prospect research, public sources, relevance assessments, customer-specific email lookup, sharing, retention and how to exercise your rights.

Postelix helps you find and reach relevant people on LinkedIn. To do this, we process two kinds of LinkedIn data: content connected to your own account (your posts, profile, inbox, and material you save or import), and publicly available professional information about the people you may want to contact ("prospects").

You connect a LinkedIn account by signing in on a page hosted by our integration provider, Unipile. Postelix does not receive or store your LinkedIn password. Unipile holds the session that keeps the account connected.

A read-only connection captures engagement with the connected account's own posts and who viewed its profile. It does not send messages or connection requests, post, or import the inbox.

Where sending is enabled, messages, connection requests, and comments are sent through your own connected LinkedIn account via our integration provider. The sending and approval process depends on the enabled workflow. The interface and applicable service scope describe whether an action requires individual review or runs under an explicitly authorised automation policy. Connecting an account alone does not authorise every possible use. Permissions can be withdrawn through the available controls, and withdrawal may stop the related feature. Automated workflows remain subject to applicable law, platform rules, and agreed limits.

Prospect data. So that you can identify relevant B2B prospects, we process limited professional information from public professional sources and relevant providers. This can include name, headline or role, company, public profile URL, relevant public posts, comments and reactions, approximate location and business-relevance inferences. A work email can be obtained for a customer's requested lookup. Targeting based on sensitive personal characteristics is prohibited; please contact us if irrelevant or sensitive content appears in a record. Postelix is intended for professional business purposes.

Our role. Unfair Advantage Ltd acts as a controller when we independently collect and maintain public professional profiles and activity, assess business relevance and supply that research to customers. We assess legitimate interests under Article 6(1)(f) GDPR for that processing, including necessity and the rights and expectations of the individuals concerned. Customer-requested work-email lookups are kept within the requesting customer's workspace. For those lookups, customer CRM records, connected accounts and instructed messaging, we act as a processor where the actual activity and agreement support that role. Customers determine the purpose and lawful basis of their own processing and outreach. Our professional-data notice explains this division and the related transparency duties.

Transparency and objection. If you are someone a Postelix customer has contacted or may contact, you can object to direct marketing, including related profiling, and ask to be removed from sourcing and outreach. Use our do-not-contact form at postelix.com/opt-out or contact help@postelix.com. We use suppression records to enforce objections within Postelix and handle relevant recipient notifications where required. See our professional-data notice and section 14 for your rights.

5. Google account data

If you sign in with Google, we receive basic account information such as your email address, name, profile image, and Google account identifier. We use this information to authenticate you, secure your account, and provide the service.

If you choose to connect a supported calendar or other account, we request the permissions shown in that connection flow. Calendar features may process event and attendee details and related meeting information to provide the functions you enable. Basic sign-in alone does not grant access to your calendar or mailbox. We explain the scope before connection and provide a disconnection route. We do not receive your Google or Microsoft password through ordinary OAuth sign-in.

Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. How we use data

We use personal data to:

• create and manage your account;
• provide the dashboard, extension, onboarding, post generation, comment generation, lead signals, and source library features;
• personalise outputs to your voice, offer, audience, and preferences;
• process subscriptions, trials, credits, invoices, and billing events;
• provide customer support and troubleshoot issues;
• detect abuse, fraud, security incidents, and violations of our Terms;
• measure feature performance and improve the product;
• send service emails, product updates, billing notices, and important legal notices.

7. AI processing, lead sourcing, and third-party services

To source leads, generate drafts, analyse context, send and sync messages, process payments, host the product, and understand product usage, we use trusted third-party service providers. Our principal sub-processors are:

• Supabase for authentication, database, storage, and backend infrastructure.
• Fly.io for background-job execution for audience and intelligence processing.
• Cloudflare for Turnstile abuse and automated-signup protection on signup and public forms.
• Unipile for connecting your LinkedIn account and sending and syncing the messages and invitations you authorise.
• Apify, including HarvestAPI actors, for collecting publicly available LinkedIn profile and activity data used for lead sourcing and enrichment.
• BetterContact for on-demand business email enrichment when an authorised user requests an address.
• Resend for account, verification, billing, build-status, and other transactional service emails.
• AgentMail for the dedicated event-partnership inbox used to communicate with event organisers and process their replies.
• Anthropic and OpenAI for draft generation, content analysis, and related AI tasks.
• OpenRouter for routing AI requests to selected model providers and providing bounded failover when a configured provider is unavailable.
• Stripe for checkout, subscription billing, invoices, and payment processing.
• Nango and HubSpot for the OAuth connection and CRM synchronisation, if you connect HubSpot.
• Instantly for customer-authorised email campaign delivery and reply synchronisation, if you use that integration.
• Slack for workspace notifications sent to a destination you choose, if you connect Slack.
• Google and Microsoft for optional account sign-in and calendar connections used for scheduling and meeting preparation.
• PostHog, Snitcher, and Vercel for product analytics, company-level website visitor identification, deployment, logs, and performance monitoring.
• People Data Labs and IPinfo for company-level identification of website visits: IPinfo for the network behind an IP address, People Data Labs for the company. This applies to visits to postelix.com and to websites where a customer uses Postelix website capture. Only the IP address is sent; no person data is requested.

The current list of providers, with the purpose of each and when it is used, is published at postelix.com/subprocessors. Business customers can request a Data Processing Agreement covering them. When we send content to an AI provider, we send the minimum context reasonably needed for the requested output. We do not permit service providers to use your data for their own marketing.

8. Cookies, local storage, and analytics

We use cookies, local storage, and similar technologies to keep you signed in, remember preferences, support attribution or referrals, protect the service, understand how the product is used, and identify the company network associated with a website visit. Company-network identification is session-only: it sets no cookies and keeps no identifier that links your browser sessions. To prevent abuse of company identification, we keep a count of identification requests per IP address for one day, under a one-way key that is used for nothing else, and delete it the next day. Where consent is required, other persistent analytics and marketing storage is enabled only after you make the relevant choice. You can control cookies through our cookie settings and your browser settings, but blocking some cookies may affect product functionality.

9. Legal bases for processing

Where the GDPR or similar laws apply, we process personal data on the following legal bases:

• Contract: to provide Postelix and manage your account or subscription.
• Legitimate interests: to improve the product, prevent abuse, secure the service, and communicate with users.
• Legitimate interests (prospect data): to source, enrich, and score publicly available professional profiles so our customers can identify and reach relevant B2B prospects. We balance this against the rights of the individuals concerned and honour the right to object (see sections 4 and 14).
• Consent: where we ask for optional permissions, marketing consent, or access to specific integrations.
• Legal obligation: to comply with tax, accounting, consumer protection, and legal requirements.

10. Sharing and disclosure

We share personal data only when necessary for the purposes described in this policy. This may include sharing with service providers, payment processors, professional advisers, authorities where legally required, or a successor if Postelix or Unfair Advantage Ltd is involved in a merger, acquisition, financing, restructuring, or sale of assets.

Our paid research service supplies independently sourced professional information to business customers as described in our professional-data notice. Customers' private CRM records, messages, private relationship information and customer-requested email results are not supplied to other customers as shared research.

11. International transfers

Unfair Advantage Ltd is based in Cyprus. Our primary production database is hosted in the European Union (Ireland). Some of our service providers may process data in the European Economic Area, the United Kingdom, the United States, or other countries where they operate. The providers are listed at postelix.com/subprocessors. Where required, we rely on appropriate safeguards such as contractual commitments and standard contractual clauses.

12. Retention and deletion

We keep personal data for as long as needed to provide Postelix, comply with legal obligations, resolve disputes, enforce agreements, and maintain security. You may request deletion of your account and personal data by contacting us.

Audience Engine trials: if a card-gated Audience Engine trial closes without converting to a paid plan, we permanently erase the trial workspace and its login account 30 days after the trial closes. This includes the saved market preview and account content. We retain only the minimum non-content receipts needed for billing and tax obligations, legal compliance, fraud and repeat-trial prevention, and do-not-contact enforcement.

For independent professional research, continued need is assessed by the business-research purpose, relevance, accuracy, changes in role or employer, the age and usefulness of supporting activity and any objection or deletion request. See the professional-data retention information. Minimum suppression identifiers may be retained to prevent re-collection or re-contact after an objection.

Connected CRM data: if you connect HubSpot, CRM activity records older than 365 days are deleted, and disconnecting HubSpot deletes the contacts, companies, activities, and owners we read from it.

Website capture: raw IP addresses are not stored. A visit record (the pages visited and the identified company) is kept for the retention period the customer sets, 90 days by default, after which the pages and the identified company are removed. The company answer for an IP address is cached for that browser session only and deleted after the calendar month, and abuse-prevention counts are deleted the next day.

Some information may be retained for a limited period in backups, logs, billing records, fraud prevention records, or where retention is required by law.

13. Security

We use technical and organisational measures designed to protect your data, including:

• connections between your browser and the service use TLS;
• our database provider encrypts stored data at rest;
• each workspace's data is separated by database access rules, and backend credentials stay on the server;
• staff access to the admin area requires multi-factor authentication;
• the HubSpot OAuth credential is held by Nango, and the LinkedIn session is held by Unipile;
• if a personal data breach affects a customer's data, we notify that customer without undue delay.

Security reports can be sent to help@postelix.com. No online service can guarantee perfect security, so you should use a strong password and protect your account credentials.

14. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or export your personal data. You may also have the right to withdraw consent and lodge a complaint with a data protection authority.

To exercise these rights, contact us at help@postelix.com. We may need to verify your identity before responding.

If you are not a Postelix user but believe a Postelix customer has used the service to process your data or contact you, you can exercise your rights without an account. Use postelix.com/opt-out for an objection or email us for access, correction, removal or other requests. We respond without undue delay and normally within one month; if a lawful extension is necessary, we explain it within that first month.

15. Children's privacy

Postelix is not intended for children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us so we can take appropriate action.

16. Changes to this policy

We may update this Privacy Policy as Postelix evolves or as legal requirements change. The "Last updated" date shows when this policy was most recently revised. If changes are material, we will take reasonable steps to notify users.

17. Contact

For privacy questions or requests, contact: