Draft for legal review. Highlighted details are still to be added.
Data Processing Addendum
Last updated October 27, 2026
This addendum is part of our Terms of Service and applies when Postbutter processes personal data on your behalf as a processor under the GDPR, UK GDPR or similar laws (for US state laws, as a “service provider”). You (“Customer”) are the controller; Aicha Ventures LLC (“Aicha Ventures”), which provides Postbutter, is the processor. Accepting the Terms accepts this addendum. If you need a signed copy, email [email protected].
1. What is processed
| Subject matter | Providing Postbutter: analytics, automations, inbox, contacts, scheduling and optional AI replies for your Instagram account. |
|---|---|
| Duration | While your account is open, plus the deletion period in section 8. |
| Data subjects | People who interact with your Instagram account (commenters, people who message you, people mentioned in your Stories) and your team members. |
| Personal data | Instagram usernames and IDs, profile pictures, follower status, comment and message content, anything people share in conversations (such as email addresses), tags and notes you add. |
| Special categories | None intended. Don’t use Postbutter to collect special category data. If people send it on their own, it is processed only as part of the conversation. |
| Nature and purpose | Collecting, storing, organising, displaying and sending, only to provide Postbutter to you. |
2. Your instructions
We process this data only on your documented instructions: the Terms, this addendum and how you set up and use Postbutter. We will tell you if we believe an instruction breaks the law. We don’t sell the data, use it for our own purposes, or combine it with other customers’ data.
3. Confidentiality
Everyone at Postbutter who can access the data is bound by confidentiality and has access only as needed to run and support the service.
4. Security
We keep appropriate technical and organisational measures, described on our Security page, including encryption in transit, access control, hashed passwords, keys kept only on our servers, logging and regular backups. We may improve them as long as protection doesn’t decrease.
5. Subprocessors
You authorise the subprocessors listed on our Subprocessors page. Each is bound by written terms that protect the data at least as much as this addendum, and we remain responsible for them. We give at least 30 days’ notice of a new subprocessor on that page and by email; you can object for reasonable data-protection reasons, and if we can’t resolve it you may cancel and receive a refund of any prepaid, unused period.
6. International transfers
Where data is transferred outside the EEA, UK or Switzerland, the transfer relies on an adequacy decision or the European Commission’s Standard Contractual Clauses (Module 2 or 3 as applicable) and the UK Addendum, which are incorporated by reference, with supplementary measures where needed.
7. Helping you
- People’s requests: Postbutter lets you find, export and delete a person’s data (contact profile, conversation, tags). If a request reaches us directly, we send it to you.
- Breaches: we tell you without undue delay, and within 48 hours of confirming a personal data breach affecting your data, with the information you need to meet your own duties.
- Assessments: we provide reasonable help with data protection impact assessments and consultations with authorities.
8. Return and deletion
You can export your data at any time in Settings. When you delete your account we delete your data at once, and backups are overwritten within 30 days. Data of a disconnected Instagram account is deleted after 30 days. We keep only what the law requires us to keep, such as billing records.
9. Audits
On request we provide the information reasonably needed to show we meet this addendum, such as a summary of our security measures and subprocessor terms. If that isn’t enough, or an authority requires it, you may audit us once a year with 30 days’ notice, at your cost, under confidentiality and without disrupting the service.
10. General
If this addendum conflicts with the Terms, this addendum wins for personal data. The limits of liability in the Terms apply. Contact: [email protected].