This policy explains what personal data SpeedPost processes, why, for how long, who it is shared with and how to exercise your rights. It supplements our terms of use and sale.
1. Data controller
The data controller is MINDLET SAS, Hameau de Cateraggio, Lot Rumana, Entrée Lot 1, 20270 Aléria, France — SIREN 943 845 743.
Your account is the account for the whole SpeedPost ecosystem: it opens SpeedPost Social, PassWallet, SpeedCRM and WebAgentic. This policy covers the account itself and SpeedPost Social. Each product publishes its own policy for the data specific to it — in particular PassWallet, which processes the merchant’s customers’ data, where the roles are therefore reversed.
For any question about your data: [email protected].
2. Data we process
2.1 Data you provide
| Data | Detail |
|---|---|
| Account | Email address, password (never stored in clear text: only a cryptographic hash is kept), display and language preferences |
| Connected social accounts | Access tokens issued by the platforms, identifiers and names of the connected profiles — strictly what is needed to publish on your behalf |
| Content | Text, images and video you create, import or generate, and your scheduled posts |
| Brand identity | Colours, fonts, logo, editorial tone, keywords, hashtags and, where applicable, the photograph and description of your brand character |
| Agent conversations | The history of your conversations with the SpeedPost agent and the lessons it keeps for your future requests |
| WhatsApp (if you enable it) | Your WhatsApp number and the identifier WhatsApp assigns to your account, your messages to the SpeedPost assistant, the photos, videos, documents and voice messages you send it, the transcripts of those voice messages, and whether you chose to receive the weekly summary |
| Billing | Plan, subscription status, renewal dates, invoices. We neither receive nor store any payment card details. |
2.2 Data collected automatically
| Data | Detail |
|---|---|
| Usage | Pages viewed, features used, interactions with the agent |
| Technical | IP address, device type, browser, operating system, timestamps |
| Diagnostics | Error logs and incident reports used to fix faults |
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and manage your account, provide the Service | Performance of the contract |
| Publish and schedule your content on the networks you connected | Performance of the contract |
| Generate content using artificial intelligence at your request | Performance of the contract |
| Manage subscriptions, billing and collection | Performance of the contract and legal obligation |
| Keep the Service secure and prevent abuse | Legitimate interest |
| Measure audience and improve the product | Legitimate interest, with the ability to object |
| Answer your support requests | Performance of the contract and legitimate interest |
| Comply with our accounting and tax obligations | Legal obligation |
We do not sell your data. We do not use it for advertising. We do not train any artificial-intelligence model on your content.
4. Artificial intelligence
When you request the generation of text, an image or a video, the content of your request — and, where relevant, elements of your brand identity and the media concerned — is sent to the provider of the model used (see section 6). Those providers act as processors: they handle the data to carry out your request, not to train their models.
Automatic media descriptions and quality scores produced by the Service are stored alongside the media concerned, in your workspace.
AI assistants you connect (Claude, ChatGPT, Le Chat…)
You can connect SpeedPost to an AI assistant of your choice (guide: speedpost.fr/connecter-ia). The connection uses a secure authorisation (OAuth): you sign in on SpeedPost, never in the assistant, and your password is not shared with it. You choose the permissions granted (read only, publishing, visual creation).
- What SpeedPost keeps: the authorisation itself (assistant name, permissions, dates); a log of the actions the assistant performs (publish, schedule, delete, reply, send a file…), limited to the action name, its date, its outcome and a hashed fingerprint of its parameters — never their content in clear nor your tokens; the files you or the assistant send, stored in your media library like your other media. File upload links are single-use and kept only as a hash.
- What SpeedPost does not see: your conversations with the assistant. SpeedPost only receives the requests the assistant sends it (for example “schedule this post”), and does not read the assistant’s history, memory or files.
- What the assistant receives: the information its requests bring up (your posts, statistics, comments, brand identity…), in order to answer you. The assistant’s provider (Anthropic, OpenAI, Mistral AI…) processes it as a separate controller, under its own privacy policy and your settings with it.
- Your controls: you can revoke an assistant’s access at any time in Settings → Connected AI assistants; its tokens are then deleted.
SpeedPost assistant on WhatsApp
You can link your account to SpeedPost’s official WhatsApp number (Settings → WhatsApp), then message the assistant as you would in the app: post ideas, job-site photos and videos, voice messages.
- Linking: done with a one-time code sent from your app. A number that has not been linked has no access to any account data.
- What is kept: your messages and the assistant’s replies join the “WhatsApp” conversation of your account, visible in the app. Photos, videos and documents you send join your media library. Voice messages are transcribed automatically: the transcript is kept with the conversation and the audio recording is deleted after 30 days.
- Messages we send you: replies to your requests and, if you have accepted it, a weekly summary of your posts and alerts (post published or failed). Send STOP to stop messages we initiate; SUPPORT to reach a member of the team.
- Your controls: you can unlink your number at any time in Settings → WhatsApp.
Messages travel through Meta’s WhatsApp Business Platform, which acts as a processor for their delivery (see section 6). WhatsApp remains the controller for your own use of its app.
5. Retention periods
| Data | Period |
|---|---|
| Account and associated content | For as long as the account is active |
| After account deletion | Immediate erasure in the database and media storage; residual technical backups expire within 30 days. Only accounting records are kept, as required by law |
| Session refresh tokens | 7 days, rotated on each use |
| Social network access tokens | Until the relevant social account is disconnected |
| Invoices and accounting records | 10 years (article L123-22 of the French Commercial Code) |
| Technical and security logs | 12 months maximum |
| Access granted to a connected AI assistant | Until you revoke it; expires after 30 days without use, and at the latest 180 days after authorisation |
| AI assistant action log | 12 months |
| File upload links | 15 minutes, then erased within 7 days |
| Audience measurement | 12 months |
| WhatsApp link | Until you unlink your number or delete your account |
| Audio recordings of WhatsApp voice messages | 30 days (the transcript follows the conversation) |
| WhatsApp message technical log (identifier, delivery status) | 90 days |
6. Processors and recipients
| Provider | Role | Location |
|---|---|---|
| Cloudflare, Inc. (United States) | Hosting, database, media storage, service execution, AI image generation and editing (FLUX.2 models by Black Forest Labs, run by Cloudflare), fallback voiceover and document conversion (Workers AI), gateway to the AI models | Processing within the European Union |
| BUNDLE SP. Z O.O. (Warsaw, Poland) | Social network connections, publishing, analytics | European Union |
| Anthropic PBC (San Francisco, United States) | Claude artificial-intelligence models: assistant, drafting and reviewing text, media description, reading attached documents, web search | United States |
| Eleven Labs, Inc. (ElevenLabs, United States) | Speech synthesis for video voiceovers, through Cloudflare’s AI gateway (only the text to be read is sent) | United States |
| Stripe Payments Europe Ltd (Dublin, Ireland) | Payment for subscriptions purchased on the web | European Union |
| Plus Five Five, Inc. (Resend, United States) | Transactional email | United States |
| PostHog, Inc. (PostHog Cloud EU instance) | Audience measurement and diagnostics | Frankfurt, Germany |
| Discord Inc. (United States) | Internal channel receiving our technical incident alerts | United States |
| Meta Platforms Ireland Ltd (WhatsApp Business Platform) | Delivery of messages between you and the SpeedPost assistant on WhatsApp, if you enable it | European Union and United States |
Subscriptions purchased from the mobile applications are collected by Apple and Google, which act as controllers for the transaction, under their own policies.
Your data may also be transmitted to the social networks you connect (Instagram, Facebook, LinkedIn, TikTok, X, Pinterest, YouTube, Google Business and others), for the sole purpose of publishing what you requested. Those platforms are controllers for what happens on their side.
Finally, your data may be disclosed to administrative or judicial authorities where the law requires it.
7. Transfers outside the European Union
Transfers to providers established in the United States are governed by the European Commission’s standard contractual clauses and, where applicable, by the provider’s EU-US Data Privacy Framework certification, supplemented by technical measures (encryption in transit and at rest, minimisation of the data transmitted).
8. Cookies and trackers
SpeedPost uses no advertising cookies and carries out no cross-site advertising tracking.
| Category | Use |
|---|---|
| Strictly necessary | Authentication session, refresh token, language and display theme. Stored in the browser’s local storage; no consent is required |
| Audience measurement | PostHog, on its European instance: page views, features used, session replay with systematic masking of input fields, error reporting. Set as a cookie and in local storage |
You can object to audience measurement by enabling your browser’s Do Not Track signal, by blocking the corresponding cookies, or by writing to [email protected].
In the iOS, iPadOS, Android and macOS applications, no data is transmitted for advertising tracking purposes: SpeedPost does not collect an advertising identifier and therefore does not request tracking permission.
9. Security
Traffic is encrypted in transit (HTTPS/TLS). Passwords are stored as cryptographic hashes. Authentication relies on short-lived tokens, renewed by rotation. Access to production data is restricted and logged. In the event of a data breach likely to result in a high risk to your rights, we will inform you in accordance with article 34 of the GDPR.
10. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to give directions on what happens to your data after your death.
- To exercise a right: write to [email protected]. We reply within one month, extendable by two months for complex requests.
- To delete your account: directly in the application, Settings → Delete my account. The full procedure is described on the account deletion page.
- To complain: you may refer the matter to the French data protection authority CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
11. Minors
The Service is intended for professionals and is not aimed at people under 16. We do not knowingly collect data concerning minors under 16; were that the case, the data would be deleted upon receipt of a report.
12. Changes
This policy may change. Any substantial change is notified to you by email or in the application. The date of last update appears at the top of this page.
13. Contact
- By email: [email protected]
- By post: MINDLET SAS, Hameau de Cateraggio, Lot Rumana, Entrée Lot 1, 20270 Aléria, France
- Full legal information: legal notice