postcue

Privacy policy

Draft: will be legally reviewed before launch.

This English version is provided for convenience. The German version is legally binding.

1. Controller

The controller for data processing in Postcue within the meaning of Art. 4(7) GDPR is:

1ACE GmbH, Gabelsbergerstraße 30, 80333 München

Phone: 0176 55 776 994, Email: info@1ace.de

2. What this is about

Postcue is a web application that agencies and businesses use to plan social media posts, have them approved by their clients and publish them automatically on connected accounts (Instagram, TikTok, YouTube, Pinterest).

We are the controller for the data of your Postcue account (name, email address, login). The agency is the controller for the content it processes in Postcue on behalf of its clients (posts, media, approval comments); we process this data on its behalf pursuant to Art. 28 GDPR. We provide a data processing agreement to paying customers.

3. Account and sign-in

When you create an account, we process:

  • your name and email address
  • your password, exclusively as an encrypted hash, never in plain text
  • when signing in with Google: your name, email address and profile picture, which Google transmits to us with your consent
  • the time of sign-in and technical session data

The legal basis is Art. 6(1)(b) GDPR (contract for the use of Postcue). For signing in with Google, the privacy policy of Google Ireland Limited also applies.

4. Cookies

Postcue only uses technically necessary cookies that keep you signed in (§ 25 Abs. 2 TDDDG). In your browser, we also store settings such as light or dark mode and, on approval pages, the name you entered so you do not have to enter it again each time. We do not use analytics, tracking or advertising cookies.

5. Content, media and approvals

We store the posts, texts, images, videos, schedules and comments that you or your team create in Postcue in order to plan and publish them.

An agency's clients can view, approve or request changes to posts via an approval link without having their own account. In doing so, we store the name entered, the decision and the comment with the respective post.

6. Connected social media accounts

When you connect a social media account to Postcue, you sign in directly with the platform and grant Postcue permission. We never receive your platform password. We store the access tokens issued by the platform in encrypted form and use them exclusively to publish posts on your behalf, retrieve their status and display account details such as name and profile picture.

When publishing, we transmit content to the respective platform. The platform's privacy policy applies there:

  • Instagram and Facebook: Meta Platforms Ireland Limited
  • TikTok: TikTok Technology Limited (Ireland)
  • YouTube: Google Ireland Limited
  • Pinterest: Pinterest Europe Limited (Ireland)

You can disconnect at any time under “Channels” in Postcue. We will then delete the stored access tokens. You can also revoke the permission directly with the platform.

7. YouTube and Google API Services

For YouTube, Postcue uses the YouTube API Services. By connecting a YouTube account, you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms); the Google Privacy Policy applies (https://policies.google.com/privacy).

Postcue's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use this data only to provide the features you request, not for advertising, and do not transfer it to third parties except as necessary to provide these features or as required by law.

You can revoke Postcue's access to your Google account at any time at https://myaccount.google.com/permissions.

8. Service providers and storage location

Supabase Inc. operates the database, authentication, file storage and login emails for us. The data is stored in a data center in Frankfurt am Main (Amazon Web Services, region eu-central-1). We have concluded a data processing agreement with Supabase; insofar as Supabase or subprocessors in the USA may access data, the transfer is based on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

We will add further service providers (hosting of the web application, payment processing, email delivery) here before they are used.

9. Retention and deletion

We store your data for as long as your account exists. If you delete content, we remove it from the application immediately; it disappears from backups after 7 days at the latest. After your contract ends, we delete your account and all content within 30 days, unless statutory retention obligations (for example for invoices) apply.

Would you like your account or individual data deleted? Write to info@1ace.de. We will confirm the deletion within 30 days.

10. Your rights

You have the right at any time to:

  • access to your stored data (Art. 15 GDPR)
  • rectification of inaccurate data (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • object to processing based on legitimate interests (Art. 21 GDPR)

To exercise these rights, contact info@1ace.de.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

11. Changes

We will update this privacy policy if Postcue or the legal situation changes. The version published here applies. Last updated: October 2026.