Privacy Policy

1. Who this covers, and our role

If you apply to us, book a call with us, or work with us.For the information you give us as a prospective or current client, and for visitors to our website, Postelist decides how and why that data is used. We act as an independent controller (or, under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”), the data user).

If you are one of our clients’ subscribers, leads, or customers.When we run a client’s email list, website, forms, follow-up calls, or sales calls, we handle the personal data of that client’s audience on the client’s behalf. For that data the client is the controller and Postelist acts as a processor, following the client’s documented instructions under our Terms and Data Processing Agreement. If you are on a list we run for a business, that business’s own privacy policy applies to you and is the first place to send requests. We will help them respond, and you can also contact us directly.

2. Information we collect

Application and booking details. Your name, company, email, phone number, and the business details you choose to share, such as the type of business you run, how you use social media today, your approximate revenue, and what you want to achieve.

Communications, including recorded calls. The content of the emails, text messages, and calls you exchange with us. Calls with our team may be recorded and transcribed for quality, note-taking, and training, and some calls may be placed or handled with the help of an automated (AI) calling provider. A written summary of a call may be stored against your record.

Filming and content. When we film you, we collect video, audio, and photographs of you and of anyone else who appears on camera, including your voice and likeness, the location we film in, and the answers you give in your interview. We also keep the scripts, notes, and briefs we prepare from what you tell us about your business.

Account access. To publish and operate on your behalf, you may give us access to your social media accounts, website, domain, calendar, email sending, and other business tools. We use that access only to deliver the Service, and we store any credentials securely.

Your audience’s data (as your processor).When we run your systems, we process your subscribers’ and leads’ names, email addresses, phone numbers, how they signed up, how they engage with your emails and pages (such as opens, clicks, and video views), the details they submit on your forms, their bookings, their SMS consent, and the recordings, notes, and outcomes of calls our team has with them for you.

Reporting. The updates we share with you about your leads and calls, including through Slack.

Website and funnel activity. Your IP address, device and browser, approximate location and time zone, the pages you view, how much of our videos you watch, and engagement signals such as whether you open our emails or reply to our texts.

Advertising identifiers. Cookies and identifiers from advertising platforms (for example, Meta) and click identifiers such as fbp and fbc, used through browser pixels and server-side conversions to measure and attribute the ads that brought you to us.

Payment information. Payments are handled by our payment processor (Stripe). We receive confirmation and limited billing details but never store your full card number.

3. How we use information

We use personal data to:

• Assess whether we are a good fit, contact you, and schedule, confirm, and remind you about your call.
• Deliver the Service: plan, script, film, edit, and publish your content; build and run your email list, email and SMS flows, website, and booking page; follow up with and call your leads; run sales calls for you where you have engaged us to; and keep you informed of how each lead and call went.
• Take payment, measure and improve our own advertising, keep our systems secure, and prevent fraud and abuse.
• Meet our legal, tax, and accounting obligations.

We use your audience’s data only to run your systems. We do not use it for our own marketing, we do not use it for any other client, and we do not sell it.

4. Legal bases

Where a regime such as the EU or UK GDPR applies, we rely on your consent (for SMS and marketing, which you can withdraw at any time); performance of a contract (to deliver the Service you engage us for); our legitimate interests (running, securing, and improving the business and measuring our advertising, balanced against your rights); and legal obligation. Under the PDPO we process personal data for the directly related purposes described here. For data we process as a client’s processor, the client is responsible for having a lawful basis.

5. Content featuring you

The footage we film is made for your business. We use it to produce your content and publish it on your channels and website. Content published on social media is shared with those platforms and their users under the platforms’ own terms, and once public it can be viewed, shared, or saved by others. We will not use your footage in our own marketing without your permission. If other people appear on camera, such as staff or customers, you are responsible for having their agreement, as set out in our Terms.

6. SMS and call communications

Messages from us. When you submit our form you agree to receive SMS appointment confirmations and reminders from Postelist at the number you provide. Message frequency varies, and message and data rates may apply. Reply STOP to opt out: we will stop texting you and cancel your upcoming call with us, and send one message confirming both. Reply HELP for help. Calls with our team may be recorded and transcribed as described in Section 2; tell us on the call if you would prefer not to be recorded.

Messages and calls we make for our clients.When we run a client’s flows, the texts and calls go to that client’s leads on the client’s behalf, and their consent is collected on the client’s own forms. The same STOP and HELP keywords apply, and a lead can ask not to be called or recorded at any time.

Your mobile information stays with us.We do not sell, rent, or share your mobile phone number, your SMS opt-in, or your consent to be texted with any third parties or affiliates for their own marketing or promotional purposes. The providers listed in Section 8 receive this information only to deliver the messages you requested, on our behalf.

7. Advertising and analytics

We use the Meta Pixel and Conversions API to measure how our ads perform and to attribute bookings, and first-party analytics to understand how people move through our pages. You can limit ad personalisation in your advertising-platform settings and manage cookies through your browser. We do not use this data to make decisions that have legal or similarly significant effects on you.

8. Sharing and sub-processors

We do not sell personal data. We share it only with our own team and contractors (such as editors and closers), who are bound by confidentiality, and with vetted service providers who process it on our behalf under contract, including:

• Social media platforms (such as Instagram, Facebook, TikTok, YouTube, LinkedIn, and X): publishing your content to your accounts.
• Google: video calls (Google Meet), calendars, and workspace tools.
• Twilio: sending and receiving SMS.
• Retell AI: placing, recording, and transcribing automated calls.
• Slack: sending you updates about your leads and calls.
• Meta: advertising measurement and attribution.
• Stripe: payment processing.
• Our email, website hosting, and infrastructure providers: running our site, your systems, and our communications.

We may also disclose personal data where the law requires it, to enforce our agreements, or to protect the rights, property, or safety of Postelist, our clients, or others. If Postelist is involved in a merger or acquisition, data may transfer as part of that transaction under this Policy.

9. Where your data is held and international transfers

Postelist is based in Hong Kong, and our team, clients, and providers work across several countries, so your information may be processed outside the country where you live. Where personal data moves across borders, we rely on appropriate safeguards, such as the recipient’s adequacy status or contractual protections including standard contractual clauses.

10. Retention

We keep personal data only for as long as we need it for the purposes in this Policy and to meet our legal, tax, and accounting obligations, then delete or anonymise it. Call recordings and transcripts are kept for a limited period. Raw footage and project files are kept while we work with you and for a reasonable period afterwards, unless your agreement with us says otherwise. Your audience’s data is kept on your instructions and, when our engagement ends, returned to you or deleted as set out in the Data Processing Agreement.

11. Security

We protect personal data with encryption in transit, access controls, and least-privilege practices, keep account credentials in secure storage limited to the people who need them, and review our providers’ safeguards. No system is perfectly secure, but we work to protect your information and to respond quickly if something goes wrong. Please report any security concern to security@postelist.com.

12. Your rights

Depending on where you live, you may have the right to access, correct, delete, or port your personal data, to object to or restrict some processing, and to withdraw consent. These rights exist under laws including the PDPO (Hong Kong), the EU and UK GDPR, the California Consumer Privacy Act, and the Australian Privacy Act. To exercise them, contact privacy@postelist.com. If your data is on a list we run for one of our clients, we will pass your request to that business and help them act on it. You may also complain to your local supervisory authority, including the Hong Kong Office of the Privacy Commissioner for Personal Data.

13. Cookies and local storage

We use essential cookies and local storage to run the site, and analytics and advertising cookies to measure performance as described above. You can control or clear cookies through your browser; blocking essential cookies may affect how the site works.

14. Children

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

15. Changes and contact

We may update this Policy from time to time. We will change the date above and, for material changes, take reasonable steps to let you know. Privacy questions and requests go to privacy@postelist.com, security reports to security@postelist.com, and abuse reports to abuse@postelist.com. This Policy sits alongside our Terms and Data Processing Agreement.