PostSir
Sign in
Privacy Policy
How PostSir handles your account, the social accounts you connect to it, and the posts you publish through it.
Last updated 4 September 2026
Who runs PostSir
PostSir is operated by WDS Creative PTY LTD, a company registered in South Africa. We are the responsible party for the personal information described here, as that term is used in the Protection of Personal Information Act (POPIA).
For anything in this policy, including access and deletion requests, contact the Information Officer at support@wdscreative.biz.
What PostSir does
PostSir publishes posts to social accounts you connect to it. You write a post once, choose which accounts it goes to, and PostSir sends it to each platform on your behalf. It can also schedule posts for later.
It is a tool you operate. It does not post anything you have not asked it to post.
What we collect
Only what is needed to do the above. There is no advertising, no profiling, and no analytics of any kind.
| What | Why we hold it |
|---|---|
| Your email address and password | To sign you in. The password is stored only as a hash, never as text we can read. |
| Access and refresh tokens for each connected account | To publish on your behalf without asking you to sign in to each platform every time. Encrypted at rest. |
| The account, page or channel identifier, its display name and profile picture | So you can tell your accounts apart when choosing where a post goes. |
| The permissions you granted | To know what PostSir is allowed to do, and to warn you when a permission is missing. |
| Post text, images and video you upload, and the times you schedule | This is the content you asked us to publish. |
| The result of each publish | The platform's post identifier, whether it succeeded, and the error if it did not, so you can see what happened. |
| Engagement figures, where a platform provides them | To show how a post performed. |
What we do not collect
- No analytics, tracking pixels or third party trackers. There are none in this product.
- No cookies beyond the one that keeps you signed in.
- No contact lists, follower lists or audience data.
- No payment details. PostSir does not take payments.
Google and YouTube data
If you connect a YouTube channel, PostSir uses YouTube API Services to do it. Everything in this section is about that.
What PostSir is allowed to do
| Permission requested | What it is used for |
|---|---|
youtube.upload | Uploading the video you composed, to the channel you chose, with the title, description and privacy setting you entered. |
youtube.readonly | Two things. Reading the list of channels your Google account manages, so PostSir can show you which channel a post will go to. And reading the view and like counts of videos PostSir itself uploaded, for up to 30 days after upload, so you can see how a post did. |
What PostSir stores, and for how long
| Data | Why | How long |
|---|---|---|
| Channel id, channel name and channel picture | To show you which channel is connected and which one a post will go to. | Until you disconnect the channel or revoke access, then erased. |
| Access and refresh tokens | To publish on your behalf without asking you to sign in every time. Stored encrypted. | Until you disconnect the channel or revoke access, then erased. |
| The id of each video PostSir uploaded | So your posting history can link to the video it created. | Until you delete that post or close your account. |
| View and like counts for those videos | To show you how a post performed. | Refreshed once a day for 30 days after the video is published, then deleted. |
How it is processed and who sees it
- Where it is processed. On one server that WDS Creative controls, described under "Where it is held" below. It is not sent anywhere else for processing.
- Who sees it inside PostSir. Only the people signed in to your own account. PostSir separates every account, so one customer cannot see another customer's channels, posts or figures.
- Who sees it outside PostSir. Nobody, with one exception: the company that hosts the server holds the disks the data sits on, as any hosting provider does. It is not shared with advertisers, data brokers, analytics services or any other third party.
- What leaves PostSir. Only the video, title, description and privacy setting you chose, sent to YouTube to carry out the upload you asked for.
- Automated decisions. None. PostSir does not profile you and does not make automated decisions about you using YouTube data.
PostSir's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
We do not sell Google user data. We do not use it for advertising. We do not use it to train models. We do not transfer it to anyone except the platform it is being published to, and only to carry out an action you asked for.
By using PostSir with a YouTube channel you also agree to the YouTube Terms of Service. Google's own handling of your information is covered by the Google Privacy Policy.
You can withdraw PostSir's access to your Google account at any time at myaccount.google.com/permissions. Access stops immediately when you do. You can also ask us to delete everything we hold, using the contact address at the top of this policy.
Other platforms
The same applies to every other platform PostSir supports, including Facebook, Instagram, LinkedIn, TikTok, Threads and Bluesky. In each case we hold a token to publish on your behalf, the account name and identifier, and the results of what we published. Each platform has its own privacy policy covering what it does with the post once it arrives.
How long we keep it
- Tokens. Until you disconnect the account or revoke access at the platform. Disconnecting erases the stored tokens straight away.
- Posts and their results. Until you delete them or close your account, because this is your posting history.
- Uploaded media. Held while it is needed to publish and to show you what you posted. Where a file had to be made temporarily reachable by a platform, that link is retired automatically once the window closes.
- Sign in links and invitations. Cleared once used or expired.
Deleting your data
Three ways, depending on how much you want removed.
- One account. Sign in, go to Accounts, and disconnect it. The tokens are erased immediately and PostSir can no longer reach it.
- Access only, from the platform's side. Remove PostSir in the platform's own settings. For Google that is myaccount.google.com/permissions. For Facebook and Instagram it is under Settings, then Apps and Websites.
- Everything. Email support@wdscreative.biz from the address on your account and ask us to delete it. We will remove your account, connected accounts, posts and uploaded media within 30 days and confirm when it is done.
Posts already published stay on the platform they were published to. Deleting your PostSir data does not remove them, because we no longer control them. Delete those on the platform itself.
How it is protected
- All traffic runs over HTTPS.
- Tokens are encrypted at rest with AES-256-GCM, under keys that can be rotated without re-connecting your accounts.
- Passwords are hashed, not stored.
- PostSir checks each stored credential against the platform daily and tells you when one stops working, so a broken or revoked connection is visible rather than silent.
No system is perfect, and we do not claim otherwise. If information is ever compromised in a way that affects you, we will tell you and report it to the Information Regulator as POPIA requires.
Where it is held
On a server we control, hosted in South Africa. Content is sent to the social platforms you choose, which operate their own infrastructure internationally. That transfer is the purpose of the product.
Your rights
Under POPIA you may ask us to show you what we hold about you, correct it, or delete it. You may object to how we use it. You may complain to the Information Regulator of South Africa at inforegulator.org.za.
Ask us first at support@wdscreative.biz and we will deal with it.
Children
PostSir is a business tool and is not intended for anyone under 18.
Changes
If this policy changes in a way that affects what we do with your information, we will update the date at the top and tell account holders by email before it takes effect.