This policy explains what Spofy LLC Limited, the company behind Spofylabs ("Spofylabs", "we"), collects when you visit spofylabs.com, contact us, or use our software products, Postly and PostQueue, and what we do with it.
Client projects are different. When we build or run software for a client, that client decides what the software collects, and their own privacy policy applies to its users.
On this website
- Project briefs. Your name, email, company (optional), project type, budget, timeline, and the details you write.
- Playbook downloads. Your name, email, company stage (optional), and which playbook you unlocked.
- Call bookings. The name, email, and notes you give Cal.com when you book a call.
- Emails. Anything you send to hello@spofylabs.com.
- Usage data. Pages visited, referrer, device and browser type, and approximate location, collected by our analytics tools.
In our software products
When you sign up for or use Postly or PostQueue, we collect:
- Account data. Your name, email, password (stored hashed), organisation name, and the team members you invite.
- Billing data. Your plan, invoices, and billing contact. Card payments are handled by our payment provider; we never see or store full card numbers.
- Usage and security logs. Sign-ins, IP addresses, device and browser type, actions taken in the app, and error reports. We use these to keep accounts secure, fix bugs, and stop abuse.
- Support messages. Anything you send us when you ask for help.
Postly (business email)
- Domains and mailboxes. Your domain names, DNS settings we need to verify and route mail, mailbox addresses, aliases, catch-alls, and filtering rules.
- Email content. The messages, attachments, and contacts stored in your mailboxes, plus delivery metadata such as sender, recipient, time, and size.
We store and transmit email only to deliver the service. We scan incoming and outgoing mail automatically for spam and malware. People at Spofylabs do not read your email, except when you ask us to for support, or when the law or a clear case of abuse (such as an outbound spam run) requires it.
PostQueue (social media scheduling)
- Connected accounts. When you connect X, LinkedIn, Facebook, Instagram, or Google Business Profile, we receive an access token and basic profile details (account name, ID, profile picture) from that platform.
- Your content. The posts, images, videos, captions, and schedules you create, and the calendar and queue settings you choose.
- Post analytics. Engagement figures the platforms return for posts published through PostQueue.
We use platform access only to do what you ask: publish and schedule your posts and show you their results. We don't post anything you didn't schedule, and we don't sell or share data from connected accounts. You can disconnect an account in PostQueue, or revoke access from the platform's own settings, at any time. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
Why we use it
- To reply to your enquiry, scope a project, and run the work if you hire us.
- To send you the playbook you asked for, and occasionally follow up about it.
- To run Postly and PostQueue: deliver email, publish posts, bill you, and support you.
- To keep our products secure and prevent spam and abuse.
- To understand which pages and features are useful so we can improve them.
We do not sell your data, use it for advertising, or use the content of your emails or posts to train AI models.
Who processes it
We rely on a few third-party services. Each handles data under its own privacy policy.
- FormSubmit delivers website form submissions to our inbox.
- Cal.com runs call scheduling.
- Google Analytics measures website traffic.
- Vercel hosts the website and keeps standard server logs.
- Supabase hosts PostQueue's database and media storage.
- Our payment provider processes subscription payments.
- The social platforms you connect receive the posts you publish through PostQueue.
Postly mail is stored on servers we operate ourselves.
Cookies and local storage
Google Analytics sets cookies to tell website visits apart. When you unlock a playbook, your browser stores your email and the time locally so you don't have to fill in the form again. That value stays on your device; clearing your browser storage removes it. Postly and PostQueue use essential cookies to keep you signed in.
How long we keep it
- Enquiries and playbook sign-ups for as long as they are useful to the conversation.
- Product data while your account is open. When you close it, we delete your mailboxes, posts, and connected-account tokens. Copies in backups are overwritten on their normal rotation.
- Billing records and client records for as long as tax and accounting law requires.
Ask us and we will delete anything we don't have to keep.
Security
We encrypt data in transit, store passwords hashed, limit staff access to what is needed to run the service, and keep platform access tokens out of logs. No system is perfectly secure; if a breach affects your data, we will tell you without undue delay.
Your rights
You can ask to see, export, correct, or delete the personal data we hold about you, or object to how we use it. Email hello@spofylabs.com and we will respond within 30 days. Postly and PostQueue account owners can also export or delete most of their data from inside the app.
Changes
If we change this policy we will update the date at the top of this page, and tell Postly and PostQueue account owners by email when a change materially affects them. For questions, email hello@spofylabs.com.