Privacy Policy

1. Who we are

Get Postd is a brand of SYOS, operated by SYOS by SS FZC, a company registered in the United Arab Emirates (trade licence number 4432672.01, issued by Sharjah Publishing City Free Zone Authority), with its registered address at Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates.

We are the controller of the personal data described in this policy. This means we decide how and why it is used. You can contact us about privacy at [Support email address]. [TO CONFIRM: whether a data protection officer, or an EU or UK representative, must be appointed and named here.]

This policy explains what personal data we collect when you visit our website or buy from us, how we use it, who we share it with, and the rights you have.

2. What we collect

When you buy a product

• Contact details: your email address and name, entered at checkout.
• Order details: which product you bought, the price, currency, date, payment status and order reference, and whether the order has been refunded.
• Payment details: entered directly into the secure checkout run by Paddle, our reseller. Paddle also collects billing details such as your country or postcode to calculate tax. We do not receive or store your full card number.

When you use the website

• Technical and security data: your IP address, browser and device type, pages requested and the time of the request. This is recorded by our hosting provider in server logs and is used for security, fraud prevention, rate limiting (for example on the access recovery form) and keeping the site working.
• Analytics data (only if enabled and only with your consent): how you use the website, such as pages viewed and buttons clicked, collected through the analytics and advertising tools described in our Cookie Policy.
• Campaign information: if you arrive from a link with campaign tags (UTM parameters), these are kept in your browser for the session so we can see which campaigns lead to purchases.

When you contact us

• Your email address, name and anything you choose to include in your message, such as screenshots.
• If you use the access recovery form, the email address you enter.
• If you use the plan request form, the industry you name, any details you add and, if you choose to give it, your email address. We use it to decide which plans to make and, if you left your email, to tell you when your plan is ready.

We do not intentionally collect sensitive personal data (such as health, religion or biometric data), and we ask you not to send it to us.

3. How we use your data, and our legal basis

The legal bases below are those used under the EU and UK GDPR. Equivalent bases apply under the UAE Personal Data Protection Law.

• To process your order and deliver your products, including sending your access email, letting you recover access, and handling refunds. Basis: performance of our contract with you.
• To provide customer support and reply to your messages. Basis: performance of a contract, or our legitimate interest in helping you.
• To prevent fraud, abuse and unauthorised sharing of our products, and to keep the website secure. Basis: our legitimate interests in protecting our business, customers and intellectual property.
• To keep business, accounting and tax records. Basis: compliance with legal obligations.
• To understand how the website is used and measure our marketing, only if analytics is enabled and you accept it. Basis: your consent, which you can withdraw at any time.
• To establish, exercise or defend legal claims. Basis: our legitimate interests.

Marketing emails. We only send transactional emails about your order. We do not send marketing emails unless you have separately agreed to receive them, and every marketing email would include a way to unsubscribe. [TO CONFIRM: whether a newsletter or marketing list will be offered.]

We do not sell your personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.

4. Who we share it with

We share personal data only with service providers that help us run the business, under contracts that require them to protect it and use it only on our instructions (or, where they act as independent controllers, under their own privacy policies):

• Paddle.com (our reseller and Merchant of Record). Paddle sells the product to you, takes payment, calculates and pays sales tax and VAT, runs fraud checks, handles refunds and keeps the record of your order. Paddle acts as an independent controller of the data it collects at checkout. See Paddle's privacy policy (paddle.com/legal/privacy).
• Resend (email delivery). Sends your order and access emails, so it processes your email address, name and the content of those emails.
• Vercel (website hosting). Hosts the website and processes technical data such as IP addresses in server logs.
• Analytics and advertising providers (only if enabled and only with your consent): Google (Google Analytics 4), Meta (Meta Pixel) and TikTok (TikTok Pixel). These providers may use the data for their own purposes as set out in their privacy policies. See our Cookie Policy.
• Professional advisers, such as accountants, auditors and lawyers, where needed.
• Authorities, such as regulators, courts or law enforcement, where we are required by law or need to protect our rights.
• A buyer or successor of our business, if it is sold or restructured, under equivalent privacy protections.

[TO CONFIRM: list of processors is current at launch, and any others (for example an email support tool or file storage service) are added.]

5. International transfers

We are based in the United Arab Emirates and our service providers operate globally, including in the United States and the European Union. Your personal data will therefore be transferred to, and stored in, countries outside the country where you live, including countries whose data protection laws may differ from yours.

Where the law requires, we rely on appropriate safeguards for these transfers, such as adequacy decisions, standard contractual clauses approved by the European Commission (with the UK addendum where relevant), or the safeguards permitted under the UAE Personal Data Protection Law. You can contact us for more information about the safeguards used. [TO CONFIRM: transfer mechanisms in each provider's data processing terms.]

6. How long we keep it

• Order and payment records: for as long as needed to provide access to your products and support, and then for the period required by UAE commercial and tax law and the rules that apply to our payment processor. [TO CONFIRM: retention period.]
• Support emails: for as long as needed to resolve your query and for a reasonable period afterwards. [TO CONFIRM: retention period.]
• Server and security logs: for the limited period set by our hosting provider. [TO CONFIRM: retention period.]
• Analytics data: for the period set in each analytics tool, if enabled. [TO CONFIRM: retention settings.]

When data is no longer needed, we delete it or make it anonymous.

7. How we protect it

We use reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS), payment processing through Paddle so we never handle full card details, and signed access links. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please keep your access link private.

8. Your rights

Depending on where you live, you may have some or all of the following rights over your personal data:

• to be told how your data is used, and to get a copy of it (access);
• to have inaccurate data corrected;
• to have your data deleted (erasure);
• to restrict or object to certain uses, including use based on our legitimate interests, and to object at any time to direct marketing;
• to receive your data in a portable format, or have it sent to another organisation;
• to withdraw consent at any time, where we rely on consent (this does not affect anything done before you withdraw); and
• to complain to a data protection authority.

UAE

If you are in the UAE, you have rights under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), including rights to obtain information, to request correction, erasure, restriction and transfer of your data, and to object to processing. You may be able to complain to the UAE Data Office. [TO CONFIRM: whether the company is registered in a free zone with its own data protection law (for example DIFC or ADGM), in which case that law and regulator apply instead.]

European Economic Area and United Kingdom

If you are in the EEA or the UK, you have the rights listed above under the EU GDPR or UK GDPR. You can complain to the data protection authority in the country where you live or work (in the UK, the Information Commissioner's Office), although we would appreciate the chance to deal with your concerns first.

Other countries

If you live elsewhere, you may have similar rights under local law. Contact us and we will respond in line with the law that applies to you.

How to use your rights

Email us at [Support email address]. We may need to confirm your identity before acting on a request, for example by asking you to write from the email address used for your order. We will respond within the time required by the law that applies to you. Some rights have exceptions, such as where we must keep records by law.

9. Cookies and analytics

Analytics and advertising tools only run if they have been enabled on the website and you accept them. If none are enabled, no analytics or advertising cookies are used. Full details are in our Cookie Policy.

10. Children

Our products are intended for adults running a business or personal brand. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.

11. Links to other sites

Our website and products link to other services, including Paddle and Canva. Those services have their own privacy policies, and we are not responsible for how they handle your data. When you open a Canva template, Canva processes your data under its own privacy policy.

12. Changes to this policy

We may update this policy from time to time. The date at the top of the page shows when it was last changed. If we make significant changes, we will take reasonable steps to let you know.