This policy explains what personal data SpeedPost processes, why, for how long, who it is shared with and how to exercise your rights. It supplements our terms of use and sale.
1. Data controller
The data controller is MINDLET SAS, Hameau de Cateraggio, Lot Rumana, Entrée Lot 1, 20270 Aléria, France — SIREN 943 845 743.
Your account is the account for the whole SpeedPost ecosystem: it opens SpeedPost Social, PassWallet, SpeedCRM and WebAgentic. This policy covers the account itself and SpeedPost Social. Each product publishes its own policy for the data specific to it — in particular PassWallet, which processes the merchant’s customers’ data, where the roles are therefore reversed.
For any question about your data: contact@speedpost.fr.
2. Data we process
2.1 Data you provide
| Data | Detail |
|---|---|
| Account | Email address, password (never stored in clear text: only a cryptographic hash is kept), display and language preferences |
| Connected social accounts | Access tokens issued by the platforms, identifiers and names of the connected profiles — strictly what is needed to publish on your behalf |
| Content | Text, images and video you create, import or generate, and your scheduled posts |
| Brand identity | Colours, fonts, logo, editorial tone, keywords, hashtags and, where applicable, the photograph and description of your brand character |
| Agent conversations | The history of your conversations with the SpeedPost agent and the lessons it keeps for your future requests |
| Billing | Plan, subscription status, renewal dates, invoices. We neither receive nor store any payment card details. |
2.2 Data collected automatically
| Data | Detail |
|---|---|
| Usage | Pages viewed, features used, interactions with the agent |
| Technical | IP address, device type, browser, operating system, timestamps |
| Diagnostics | Error logs and incident reports used to fix faults |
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and manage your account, provide the Service | Performance of the contract |
| Publish and schedule your content on the networks you connected | Performance of the contract |
| Generate content using artificial intelligence at your request | Performance of the contract |
| Manage subscriptions, billing and collection | Performance of the contract and legal obligation |
| Keep the Service secure and prevent abuse | Legitimate interest |
| Measure audience and improve the product | Legitimate interest, with the ability to object |
| Answer your support requests | Performance of the contract and legitimate interest |
| Comply with our accounting and tax obligations | Legal obligation |
We do not sell your data. We do not use it for advertising. We do not train any artificial-intelligence model on your content.
4. Artificial intelligence
When you request the generation of text, an image or a video, the content of your request — and, where relevant, elements of your brand identity and the media concerned — is sent to the provider of the model used (see section 6). Those providers act as processors: they handle the data to carry out your request, not to train their models.
Automatic media descriptions and quality scores produced by the Service are stored alongside the media concerned, in your workspace.
5. Retention periods
| Data | Period |
|---|---|
| Account and associated content | For as long as the account is active |
| After account deletion | Immediate erasure in the database and media storage; residual technical backups expire within 30 days. Only accounting records are kept, as required by law |
| Session refresh tokens | 7 days, rotated on each use |
| Social network access tokens | Until the relevant social account is disconnected |
| Invoices and accounting records | 10 years (article L123-22 of the French Commercial Code) |
| Technical and security logs | 12 months maximum |
| Audience measurement | 12 months |
6. Processors and recipients
| Provider | Role | Location |
|---|---|---|
| Cloudflare, Inc. (United States) | Hosting, database, media storage, service execution | Processing within the European Union |
| BUNDLE SP. Z O.O. (Warsaw, Poland) | Social network connections, publishing, analytics | European Union |
| Mistral AI SAS (Paris, France) | Assisted drafting, media description, speech synthesis | France |
| Google Ireland Limited (Dublin, Ireland) | Image generation and editing (Gemini) | European Union and United States |
| Anthropic PBC and OpenAI | Alternative conversational models, used on request | United States |
| Stripe Payments Europe Ltd (Dublin, Ireland) | Payment for subscriptions purchased on the web | European Union |
| Plus Five Five, Inc. (Resend, United States) | Transactional email | United States |
| PostHog, Inc. (PostHog Cloud EU instance) | Audience measurement and diagnostics | Frankfurt, Germany |
| Discord Inc. (United States) | Internal channel receiving our technical incident alerts | United States |
Subscriptions purchased from the mobile applications are collected by Apple and Google, which act as controllers for the transaction, under their own policies.
Your data may also be transmitted to the social networks you connect (Instagram, Facebook, LinkedIn, TikTok, X, Pinterest, YouTube, Google Business and others), for the sole purpose of publishing what you requested. Those platforms are controllers for what happens on their side.
Finally, your data may be disclosed to administrative or judicial authorities where the law requires it.
7. Transfers outside the European Union
Transfers to providers established in the United States are governed by the European Commission’s standard contractual clauses and, where applicable, by the provider’s EU-US Data Privacy Framework certification, supplemented by technical measures (encryption in transit and at rest, minimisation of the data transmitted).
8. Cookies and trackers
SpeedPost uses no advertising cookies and carries out no cross-site advertising tracking.
| Category | Use |
|---|---|
| Strictly necessary | Authentication session, refresh token, language and display theme. Stored in the browser’s local storage; no consent is required |
| Audience measurement | PostHog, on its European instance: page views, features used, session replay with systematic masking of input fields, error reporting. Set as a cookie and in local storage |
You can object to audience measurement by enabling your browser’s Do Not Track signal, by blocking the corresponding cookies, or by writing to contact@speedpost.fr.
In the iOS, iPadOS, Android and macOS applications, no data is transmitted for advertising tracking purposes: SpeedPost does not collect an advertising identifier and therefore does not request tracking permission.
9. Security
Traffic is encrypted in transit (HTTPS/TLS). Passwords are stored as cryptographic hashes. Authentication relies on short-lived tokens, renewed by rotation. Access to production data is restricted and logged. In the event of a data breach likely to result in a high risk to your rights, we will inform you in accordance with article 34 of the GDPR.
10. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to give directions on what happens to your data after your death.
- To exercise a right: write to contact@speedpost.fr. We reply within one month, extendable by two months for complex requests.
- To delete your account: directly in the application, Settings → Delete my account. The full procedure is described on the account deletion page.
- To complain: you may refer the matter to the French data protection authority CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
11. Minors
The Service is intended for professionals and is not aimed at people under 16. We do not knowingly collect data concerning minors under 16; were that the case, the data would be deleted upon receipt of a report.
12. Changes
This policy may change. Any substantial change is notified to you by email or in the application. The date of last update appears at the top of this page.
13. Contact
- By email: contact@speedpost.fr
- By post: MINDLET SAS, Hameau de Cateraggio, Lot Rumana, Entrée Lot 1, 20270 Aléria, France
- Full legal information: legal notice