Privacy Policy

1. Our role under data-protection law

Your enquiry, application, and account data.For the information you give us when you apply, book a call, communicate with us, or set up billing, Postelist acts as an independent controller (or, under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”), the data user) and determines the purposes and means of processing.

Data we process to run your infrastructure. When we deliver the Service, we process the sending, domain, and contact data you provide or authorize strictly to operate your email infrastructure on your behalf. For that data you are the controller and Postelist acts as a processor on your documented instructions, as set out in our Terms and Data Processing Agreement. You are responsible for establishing a lawful basis for the personal data you route through the Service.

2. Information we collect

Application & booking details.Your name, company, work email, phone number, and the business details you choose to share — such as your sending volume, list size, current situation, timeline, and what you’re looking to achieve.

Communications, including recorded calls. The content of the emails, text messages, and calls you exchange with us. Our pre-call qualification calls may be placed and handled by an automated (AI) calling provider and, like our team calls, may be recorded and transcribed for quality, qualification, note-taking, and training; a written summary and analysis of the call is stored against your record.

Website & funnel activity.Your IP address, device and browser, approximate location and time zone, the pages you view, how much of our videos you watch, and engagement signals such as whether you open our emails or reply to our texts — which we use to gauge interest and improve the experience.

Advertising identifiers. Cookies and identifiers from advertising platforms (for example, Meta) and click identifiers such as fbp / fbc, used through browser pixels and server-side conversions to measure and attribute the ads that brought you here.

Payment information. When you pay for the Service, payment is handled by our payment processor (Stripe). We receive confirmation and limited billing details but do not store your full card number.

Service data. To deliver the Service we process the contact lists, sending domains, and deliverability telemetry you provide or authorize, only as needed to operate your infrastructure and on your instructions.

3. How we use information

We use personal data to assess whether we’re a fit and to contact you; to schedule, confirm, and remind you about your call, including the automated pre-call; to deliver, maintain, and improve the Service; to take payment; to measure and improve our advertising; to keep our systems secure and prevent fraud and abuse; and to meet our legal and accounting obligations.

4. Legal bases

Where a regime such as the EU/UK GDPR applies, we rely on: your consent (for SMS and marketing, which you can withdraw at any time); performance of a contract (to deliver the Service you engage us for); our legitimate interests (running, securing, and improving the business and measuring our advertising, balanced against your rights); and legal obligation. Under the PDPO we process personal data for the directly related purposes described here.

5. SMS & call communications

When you submit our form you agree to receive SMS appointment confirmations and reminders from Postelist at the number you provide. Message frequency varies, and message and data rates may apply. Reply STOPto opt out — we’ll send one confirmation and then stop — or HELPfor help. Opting out of SMS does not cancel your booking or stop email confirmations. Calls, including the automated pre-call, may be recorded and transcribed as described in Section 2; let us know on the call if you’d prefer not to be recorded.

Your mobile information stays with us.We do not sell, rent, or share your mobile phone number, your SMS opt-in, or your consent to be texted with any third parties or affiliates for their own marketing or promotional purposes. The providers listed in Section 7 receive this information only to deliver the messages you requested, on our behalf.

6. Advertising and analytics

We use the Meta Pixel and Conversions API to measure how our ads perform and to attribute bookings, and first-party analytics to understand how people move through our funnel. You can limit ad personalization in your advertising-platform settings and manage cookies through your browser. We do not use this data to make decisions that produce legal or similarly significant effects about you.

7. Sharing and sub-processors

We do not sell your personal data. We share it only with vetted service providers who process it on our behalf under contract, including:

• Twilio — sending and receiving SMS.
• Retell AI — placing, recording, and transcribing automated pre-call calls.
• Meta — advertising measurement and attribution.
• Stripe — payment processing.
• Google — hosting video calls (Google Meet) and calendar invites.
• Our email, hosting, and infrastructure providers — running the site, the Service, and our communications.

We may also disclose personal data where required by law, to enforce our agreements, or to protect the rights, property, or safety of Postelist, our clients, or others. If we’re involved in a merger or acquisition, data may transfer as part of that transaction under this Policy.

8. Where your data is held & international transfers

Postelist is based in Hong Kong and works with sub-processors that operate in multiple jurisdictions, so your information may be processed in other countries. Where personal data is transferred across borders, we rely on appropriate safeguards — such as the recipient’s adequacy status or contractual protections including standard contractual clauses.

9. Retention

We keep personal data only as long as needed for the purposes described here and to meet our legal, tax, and accounting obligations, after which it is deleted or anonymized. Call recordings and transcripts are retained for a limited period for quality and record-keeping. Service data is retained per your instructions and the Data Processing Agreement, and returned or deleted on termination.

10. Security

We protect personal data with encryption in transit, access controls, and least-privilege practices, and we review our providers’ safeguards. No system is perfectly secure, but we work to protect your information and to respond quickly to incidents. Please report any security concern to security@postelist.com.

11. Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or port your personal data, to object to or restrict certain processing, and to withdraw consent. These rights exist under regimes including the PDPO (Hong Kong), the EU and UK GDPR, the California Consumer Privacy Act, and the Australian Privacy Act. To exercise them, contact privacy@postelist.com. You may also lodge a complaint with your local supervisory authority, including the Hong Kong Office of the Privacy Commissioner for Personal Data.

12. Cookies and local storage

We use essential cookies and local storage to run the site, and analytics and advertising cookies to measure performance as described above. You can control or clear cookies through your browser; blocking essential cookies may affect how the site works.

13. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

14. Changes and contact

We may update this Policy from time to time; we’ll revise the date above and, for material changes, take reasonable steps to let you know. Privacy enquiries and requests to exercise your rights go to privacy@postelist.com; security reports to security@postelist.com; abuse reports to abuse@postelist.com. This Policy sits alongside our Terms and Data Processing Agreement.