Privacy Policy

Who this applies to

It applies to everyone who uses publishly.now: the agencies who subscribe, the teammates they invite, and the clients who open a review link. Where we decide why and how data is processed — your account, your billing, our security — we are the data controller.

Where we process the content and contacts inside your workspace, we act as a processor on your instructions: you decide what goes in, and we handle it only to run the service for you. If your own customers ask you about their data, you are their point of contact and we will support you in answering.

What we collect

Account: your name, email address and profile picture from Google sign-in. Workspace: agency and company names, logos, timezones, team members and roles, post drafts, captions, schedules, approvals and internal notes. Connected accounts: the platform, account name, avatar and a provider account ID — never the platform password or access token.

Demo: when you open the demo we ask for your name and email, keep them, and send a welcome email plus at most two follow-ups (three and six weeks later) about our plans. Every follow-up has an unsubscribe link, and writing to hello@publishly.now removes your details.

Leads: contact details you type or confirm from conversations (name, phone, email, request). Billing: the plan, status and renewal date, plus an identifier from our payment provider — we never see or store your card number. Technical: server logs, IP address for rate limiting and security, and anonymous usage counts.

What we deliberately do not store

Media files are uploaded straight to our publishing provider (Zernio) and are not stored on Publishly’s servers.

Direct messages and comments are read live from the platforms when you open the inbox and are not stored. We keep only the handling metadata you need to work: the assigned teammate, done/unread state, the sender’s public name and picture, and ad attribution when a platform sends it.

We never store social platform passwords or access tokens. Connections are made through each platform’s own hosted authorisation, and can be revoked from the platform at any time.

Why we use it, and on what legal basis

To provide the service you subscribed to — publishing, scheduling, approvals, client review links, inbox replies and analytics — because it is necessary to perform our contract with you.

To send transactional email such as invitations, notification digests and service notices, on the same contractual basis. These are not marketing and cannot be unsubscribed from separately while your account is open, although you can turn off the notifications that generate them.

To keep the service secure, prevent abuse, and enforce plan limits, on the basis of our legitimate interest in running a safe and sustainable service.

To meet tax, accounting and legal obligations, where the law requires it. We do not use your content to train models, we do not show advertising, and we make no automated decisions that produce legal effects for you.

Who processes data for us

Zernio (publishing, media and inbox access to the platforms you connect), Supabase (database and authentication hosting), Vercel (application hosting), Paddle (payments, as Merchant of Record — Paddle receives your billing details directly), Resend (email delivery) and Google (sign-in).

Each is bound to process data only to provide its service to us. We review this list as our infrastructure changes and will update this page before a new processor starts handling personal data. We disclose data to anyone else only when the law requires it, and we will tell you unless we are forbidden from doing so.

Client review pages

Public review links show selected posts to the people you share them with. We log when a link is opened (time, IP address, browser) and the decisions made, so you have a record of who approved what.

Reviewers do not need an account and we do not build profiles of them. Review logs are deleted with the link’s company or agency.

How we protect it

Data is encrypted in transit (TLS) and at rest by our hosting providers. Access inside the product is enforced at the database level, per organisation, so one agency cannot read another’s data even if the application were at fault.

Administrative access is limited to what is needed to operate the service and is protected by two-factor authentication. If a breach affects your personal data we will notify you and any competent authority without undue delay, and in any event within 72 hours of becoming aware of it.

How long we keep it

Workspace data is kept while your agency exists. Deleting a company or an agency removes its data from our database; published posts remain on the social platforms, which we cannot delete for you.

Backups roll off within 30 days. Security and rate-limit logs are kept for up to 90 days. Billing records are kept for as long as tax and accounting law requires, which is typically seven years, and are held by our payment provider as Merchant of Record.

To delete your account, open Account in the website or the app and choose Delete my account, or write to hello@publishly.now from the email you sign in with. We delete your account and personal data within 7 days and confirm by email; billing records stay with our payment provider as the law requires.

Cookies

We use only strictly necessary cookies: your sign-in session and small preferences such as the sidebar state. There are no advertising, analytics or cross-site tracking cookies, which is why you are not asked to consent to any.

International transfers

Our providers process data in the European Union and the United States. Where data leaves the region it was collected in, the transfer is covered by the providers’ standard contractual clauses or an equivalent approved safeguard.

Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, receive a portable copy, restrict or object to processing, and withdraw consent where we relied on it. Write to hello@publishly.now and we will respond within 30 days, free of charge.

We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are used in United States state privacy laws. If you are in the European Economic Area or the United Kingdom and you are not satisfied with our answer, you may complain to your local data protection authority.

Children

Publishly is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, write to us and we will delete it.

Contact and changes

Publishly — hello@publishly.now, for any privacy question, request or complaint. This is also the address for data protection matters.

We will post updates to this policy here and change the date at the top. If a change materially affects how we use your data, we will tell you in the app or by email before it takes effect.