Subprocessors & Data Processing
When you put personal data of other people into PostRush (leads, outreach recipients, commenters), you are the controller and PostRush processes it for you. This page is our data processing addendum in short form, with the providers we use. It applies automatically to workspaces that use PostRush for business; email [email protected] if you need a signed copy.
1. Data processing terms
- Scope. We process personal data you submit or instruct us to collect (for example lead contacts and public posts) only to provide the service, on your documented instructions, which are the Terms and your use of the product’s features.
- Confidentiality and security. People with access are bound by confidentiality. We apply the measures described in the Privacy Policy: encryption in transit and at rest for credentials, access control, hashed passwords, rate limiting, and monitoring.
- Subprocessors. You authorise the providers below. We bind them to equivalent obligations and stay responsible for them. We will announce additions or replacements on this page (and by email to workspace owners who ask) at least 14 days before they process your data; you can object on reasonable grounds within that time or stop using the service.
- Data subject requests. We help you respond to requests from individuals (access, deletion, objection) by providing export and deletion tools, and by forwarding requests we receive about your data to you.
- Breach. We notify you without undue delay, and in any event within 72 hours of becoming aware, of a personal data breach affecting your data.
- Deletion and return. On deletion of your account or workspace we delete your data (see retention in the Privacy Policy); you can export it first from Settings → Account.
- Audits. We’ll provide reasonable information to show compliance and allow audits by you or your auditor on reasonable notice, no more than once a year unless a breach requires it.
- Transfers. Transfers out of the EEA/UK/Switzerland rely on the Standard Contractual Clauses (module 2, controller to processor, and module 3 for onward transfers) and the UK addendum, which are incorporated here by reference, or an adequacy decision.
2. Subprocessors
| Provider | Purpose | Data | Location |
|---|---|---|---|
| OpenRouter (and the model providers it routes to, such as Google, DeepSeek, Anthropic, OpenAI, ByteDance) | AI text, image, video, voice and music generation | Prompts you write, brand details, public research material, generated media | United States |
| OpenAI | Optional server-side voice (text-to-speech and transcription) | Text to speak, short voice recordings | United States |
| Polar | Payments, subscriptions, invoicing and sales tax as merchant of record | Name, email, billing details, payment status | European Union / United States |
| PostHog | Product analytics and consent-controlled browser session replay; server account and service usage analytics | Pages viewed, clicks, device and browser, approximate location, account id, name, email, workspace, plan, app version and service usage; replay text and media are masked | United States |
| Database and hosting provider | Runs the service and stores your account and content | Everything you store in PostRush | As stated in your order confirmation |
| Optional “Continue with Google” sign-in | Name, email address, profile picture | United States |
AI model providers used through OpenRouter change as we choose the best price and quality per task; they process prompts and generated media to return a result and, under the terms we use, don’t train on API inputs.
Contact
PostRush. Questions about this document: [email protected]. Privacy requests: [email protected].