Who we are
Postcrest is operated by Laosway Co., Ltd (Vientiane, Lao PDR). For data our customers connect, the customer is the controller and Laosway acts as processor under a Data Processing Agreement.
Data we receive from platform APIs
We only use official APIs and OAuth. We never ask for or store your platform passwords.
Meta (Facebook Pages, Instagram professional accounts, Threads): Page and account profile (name, handle, avatar, follower count), the list of posts with their captions, permalinks, media type and publish time, post and account insights (views, viewers or reach, reactions, likes, comments, shares, saves, replies, reposts, quotes), and comments on your posts including the commenter’s platform ID and name. When you enable comment-to-DM automation we send one private reply per eligible comment and record whether the person replied.
Google (YouTube) and TikTok, when enabled for your workspace: channel or account profile, video list and metadata, and video and account analytics. We store metadata and URLs only; we never download or re-host videos.
Access tokens are encrypted at rest and are deleted as soon as you disconnect a channel.
Why we use it
To show your performance dashboards, compare each post with your own recent posts (Trend Score), send the private replies you configure, and produce the exports you request. We do not sell data and do not compare your accounts with unrelated accounts.
Retention
Raw API responses: 90 days. Commenter names and comment text: 90 days (counts are kept). Normalized metrics: as long as your plan’s history allows. Audit logs: 1 year. When you disconnect a channel its tokens are deleted immediately and its data is purged after 30 days. When you delete a workspace everything is purged within 30 days.
Where data is processed
Postcrest runs on Cloudflare’s global network, so your data may be processed outside your country. We ask for your consent to this cross-border transfer when you create a workspace (Lao Law on Electronic Data Protection No. 25/NA, Thailand PDPA, GDPR).
Sub-processors
Cloudflare (hosting, database, storage), Resend (transactional email). The list is updated before any change takes effect.
Your choices
You can export your workspace data, disconnect channels, or delete your workspace from Settings. Facebook users can also remove Postcrest from their Facebook settings and request deletion; see the Data deletion page.
Contact: privacy@laosway.com