Privacy Policy

Version 1.0. Effective 14 August 2026. Every published version of this document is retained and can be produced on request.

PostLever Pty Ltd ACN 701 249 881 ("PostLever", "we", "us") operates the PostLever platform, an email deployment and orchestration platform for affiliate senders. This policy explains how we handle personal information, and it applies to our website at https://www.postlever.com, to the PostLever platform, and to our dealings with customers, prospective customers, and visitors.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and we undertake to do so whether or not we are at any time an APP entity under that Act.

Where this policy refers to a business day, it means a day that is not a Saturday, a Sunday, or a public holiday in Brisbane, Queensland, Australia.

1. TWO KINDS OF PERSONAL INFORMATION.

1.1. We hold personal information of two kinds, and they are handled differently.

1.2. Recipient data. This is the contact and engagement data our customers upload to, or generate in, their PostLever accounts: the people they send campaigns to. We hold it, and we act on our customer's documented instructions. We do not decide who a campaign is sent to, what it says, or on what basis the recipient's consent was obtained. Our handling of recipient data is governed by our contract with the customer, and Section 13 explains what a recipient can ask us for.

1.3. Our own information. This is personal information we collect for ourselves: from visitors to our website, from people who contact us, from prospective and current customers, and from the individuals who administer customer accounts. Sections 2 to 12 are mainly about this.

1.4. Australian law does not draw a controller and processor distinction, so the split above allocates responsibility as between us and our customers. It does not reduce our own obligations under the Privacy Act for any personal information we hold, of either kind.

2. WHAT WE COLLECT.

2.1. About visitors, customers, and prospective customers:

• Identifiers: name, email address, postal address, phone number.
• Account information: company name, business contact details, job title, login credentials, and account configuration.
• Billing information: billing contact and address, and the payment records our payment provider returns to us. We do not store full card numbers.
• Commercial information: your enquiries, support tickets, communications with us, marketing preferences, and your history as a customer.
• Technical information: the technical and usage data that reaches us when you use our website or the platform, such as IP address, browser and device type, operating system, referring page, pages viewed, and time spent. Section 6 describes what our website loads, what it does not, and who receives what.

2.2. About recipients, held on our customers' instructions: email address, and where our customer supplies it, name and other contact details, segmentation attributes, engagement data such as opens, clicks, bounces, complaints, and unsubscribes, and campaign response data. We also generate deliverability and suppression indicators from that data in order to run our customer's campaigns.

2.3. Sensitive information. Sensitive information has the meaning given in section 6 of the Privacy Act and includes health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, biometric and genetic information, and union membership. We do not seek sensitive information, and our terms require customers not to upload it to the platform. If you send it to us unsolicited, we will destroy or de-identify it in accordance with APP 4 unless we are required to keep it.

3. HOW WE COLLECT IT.

3.1. We collect personal information about you directly from you: when you visit our website, contact us, request a demonstration, subscribe to our mailing list, open an account, or use the platform.

3.2. We collect technical information automatically when you use our website or the platform. Section 6 describes what our website loads and what it does not.

3.3. We collect recipient data from our customers, not from recipients. We have no direct relationship with the people our customers send to.

3.4. We do not buy personal information, and we do not acquire it from data aggregators, list vendors, or public databases to build our own datasets.

3.5. If we collect personal information about you from someone other than you, and APP 5 applies, we will take reasonable steps to notify you or to make you aware of it. For recipient data, those steps are these. We do not contact recipients, because a message from us to a person who never asked to hear from us would itself be the unsolicited contact APP 5 exists to guard against. Our customer collects the data and gives any notice required of it at the point of collection. Section 13 is the route for a recipient who wants to reach us, and we act on a request that relates to information we hold.

4. ANONYMITY AND PSEUDONYMITY.

You can deal with us anonymously or under a pseudonym where it is lawful and practicable, for example when making a general enquiry. It is not practicable where we need to identify you: to open or administer an account, to bill you, to provide support on a specific account, or to respond to a request under Section 12.

5. WHY WE USE IT.

5.1. We use personal information to:

• provide, operate, maintain, and secure the platform and our website;
• create and administer accounts, authenticate users, and provide support;
• bill customers and collect payment;
• communicate with you about your account, including service, security, and billing notices;
• market our own services to customers and prospective customers, subject to Section 7;
• understand and improve how the platform and our website are used, and develop new features;
• detect, investigate, and prevent fraud, abuse, security incidents, and breaches of our Acceptable Use Policy; and
• comply with our legal obligations and establish, exercise, or defend legal claims.

5.2. We use recipient data only to provide the platform to the customer whose account holds it, and for the limited purposes our terms set out. We do not use it for our own marketing, we do not use it to build profiles, and we do not combine it with data from other customers or other sources.

5.3. We use de-identified and aggregated data for analytics, benchmarking, service improvement, and security. We take steps designed to prevent re-identification, and we do not attempt to re-identify it.

5.4. We do not use automated decision-making that produces a legal or similarly significant effect on an individual.

6. COOKIES, ANALYTICS, AND WHAT OUR WEBSITE LOADS.

6.1. Our website sets no cookies. Our website at https://www.postlever.com sets no cookies, and it stores nothing in your browser's local storage or session storage. There are no analytics cookies, no advertising cookies and no functional cookies on it, so there is no cookie consent for us to ask you for and no consent banner for us to show you.

6.2. The one third party script we load. Every page of our website loads one script from a third party origin: the Cloudflare Web Analytics beacon, served from static.cloudflareinsights.com and operated by Cloudflare, Inc. in the United States. It is an analytics product, and we use it to measure traffic to our website and how our pages perform. Your browser's request for that script, and the measurements it sends back, go to Cloudflare and carry what any request to a server carries, including your IP address. Cloudflare describes the product as cookieless. What Cloudflare collects, how long it keeps it, and what it does with it, are Cloudflare's to describe rather than ours; we do not restate Cloudflare's description here as our own, and we have not verified it.

6.3. When this is personal information. Australia does not require consent for cookies in the way European law does. Where information collected about your visit is personal information under the Privacy Act, we treat it as personal information and handle it under this policy.

6.4. Do not track. Our website does not respond to browser "do not track" signals, because there is no agreed standard for how to interpret them.

6.5. Tracking across other websites. We do not use our website to collect information about what you do on other websites, and we do not engage anyone to do that for us. Our website loads no advertising pixels, no social media scripts, and no third party script other than the Cloudflare beacon described at 6.2. Cloudflare receives what 6.2 describes, and whether it collects anything about your activities on other websites is a matter for Cloudflare's own disclosures rather than a statement we make.

6.6. The application. This Section describes our website. The PostLever application at https://app.postlever.com is available only to signed in users, and it stores what is needed to sign you in and to keep you signed in while you work. We do not use cookies or any similar technology, on our website or in the application, to advertise to you or to track you across other websites.

6.7. Managing this in your browser. Every major browser has settings for managing and deleting cookies and other site data. Blocking or deleting them does not affect our website, which sets none. Blocking them for the application may prevent you signing in.

6.8. We update this Section when what our website loads changes.

7. DIRECT MARKETING.

7.1. We use personal information to market our own services, as APP 7 permits. Every marketing email we send identifies us, and carries a functional unsubscribe facility that we act on within five business days, as the Spam Act 2003 (Cth) requires.

7.2. You can opt out at any time using the unsubscribe link in any marketing message, or by contacting us under Section 20. Opting out of marketing does not stop service, security, and billing notices, which we need to send you while you hold an account.

7.3. We do not provide personal information to third parties for their own direct marketing.

8. WHO WE DISCLOSE IT TO.

8.1. We do not sell personal information. We do not sell, rent, lease, trade, or otherwise monetise personal information or data derived from it, we do not share it for cross-context behavioural advertising, and we do not act as a data broker. Our terms bind us to this contractually as well.

8.2. We disclose personal information to the recipients listed below. Our service providers may handle it only on our instructions and only to provide those services to us.

• Amazon Web Services, Inc., which hosts our platform, stores the data it holds, and sends the email we send ourselves. It processes that information in the United States.
• Cloudflare, Inc., which serves our platform edge and operates the click and open tracking that our customers' campaigns use, so it handles recipient identifiers and engagement events in the ordinary course. It also operates the Web Analytics beacon our website loads, and your browser sends request data to Cloudflare whenever it loads that beacon, which Section 6.2 describes.
• Anthropic, PBC, which provides the language model behind the assistant in our application. Where a customer asks the assistant something that requires it to read data in their account, that data is sent to Anthropic so the assistant can answer.
• PostHog, Inc., which provides our product analytics, session recording and error monitoring. It receives the email address of the person signed in to our application. Recipient data is masked out of session recordings before they are sent.
• Google LLC, whose Workspace service holds our support correspondence and our own internal mail, including anything you send to an address at our domain. It holds no customer or recipient data.
• A customer, in relation to their own account and the recipient data it holds.
• A party you direct us to, including your own sending infrastructure and suppression sources, at your instruction.
• Mailbox providers, blocklist operators, and anti-abuse organisations, where one of them makes a request or brings an action relating to a customer's sending, and disclosure of information about that account is required of us or is reasonably necessary to respond.
• Professional advisers, including lawyers, accountants, and auditors, under confidentiality.
• An acquirer, if we sell or transfer our business or assets. We will require the acquirer by contract to handle it in accordance with this policy, and where its handling would materially change we will tell affected individuals. We are not in the business of selling personal information as an asset in itself, and any such transfer is of the business it relates to.
• Regulators, courts, and law enforcement, where we are required by law, or where disclosure is reasonably necessary to establish, exercise, or defend a legal claim, or to prevent a serious threat to life, health, or safety.

8.3. We do not publish a separate list of the service providers who handle personal information for us. The recipients described in Section 8.2 are the whole of that disclosure. We do not currently process payments, so no payment processor holds personal information for us. We will name the processor in this policy before we begin billing.

9. OVERSEAS DISCLOSURE.

9.1. We are an Australian company, and the personal information we hold is stored and processed outside Australia, including in the United States. Our hosting, our tracking edge, our analytics and the language model behind the assistant in our application run in the United States. Cloudflare is a global edge network and serves our platform edge from the point of presence nearest the visitor, so request data may be handled in the country that point of presence is in.

9.2. Where APP 8 applies, we take steps that are reasonable in the circumstances to ensure an overseas recipient does not breach the Australian Privacy Principles in relation to that information, and we remain accountable under the Act for what they do with it.

9.3. Where a customer instructs us to send data to a recipient it nominates, including its own sending infrastructure or suppression sources, the customer is responsible for its own compliance with APP 8 in respect of that disclosure.

10. SECURITY.

10.1. We take steps that are reasonable in the circumstances to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure, as APP 11 requires. Those steps include multi-factor authentication on the accounts that can reach production, individual named accounts rather than shared logins, credentials held in a managed secrets store, encryption of traffic in transit with all web requests forced to HTTPS, application servers that run without public network addresses, backups that we have tested restoring, and a written plan for responding to an incident. Members of our support team can enter a customer's account to diagnose a problem, using access that is limited to a designated support group, granted through a signed token rather than a shared password, and recorded when it is used. The technical and organisational measures we apply to personal data we process on a customer's behalf are set out in Annex II to the Standard Contractual Clauses in Addendum A to our terms of service, and we will not reduce the overall level of protection they provide.

10.2. No system is completely secure, and we do not represent otherwise. Transmission over the internet carries risk that we cannot eliminate.

11. RETENTION AND DESTRUCTION.

11.1. We keep personal information for the purposes set out in this policy, and for as long as the law requires us to keep it. APP 11.2 obliges us to destroy or de-identify personal information once we no longer need it for any purpose for which it may be used or disclosed under the Australian Privacy Principles, and we are not required by law, or by a court or tribunal order, to keep it. That obligation applies to us as a matter of law. Nothing in the platform deletes data on a schedule, so information is removed when we act on a request to remove it, and Section 11.2 describes how that works for recipient data.

11.2. Recipient data is retained while the account holding it is open, and it is not deleted automatically when that account closes. A customer may ask us to remove its data by emailing support@postlever.com, and we act on that request. Our pricing terms describe a 180 day inactivity schedule for contact data. That schedule is how the platform is intended to behave rather than what it does today, and we will update this policy when it operates. Where an address has been suppressed, we keep the record we need in order to give effect to that suppression for as long as we need it, because a suppression that expires is a suppression that fails. Retention periods for our own records follow the purpose each record serves: we keep account and support records while an account is open and for as long afterwards as may be needed to deal with a question or claim about it, and we keep financial records for at least seven years, as section 286 of the Corporations Act 2001 requires.

12. ACCESS AND CORRECTION.

12.1. You may ask us for access to the personal information we hold about you, and ask us to correct it if it is wrong, out of date, incomplete, or misleading. Contact us under Section 20.

12.2. We will respond within thirty (30) days. We will ask for enough information to confirm your identity before we act.

12.3. There is no charge for making a request. We may charge a reasonable cost-based fee for giving access, and we will tell you before we do.

12.4. We may refuse access or correction where the Privacy Act permits it, for example where giving access would unreasonably affect another person's privacy. If we refuse, we will tell you why in writing and how to complain.

13. IF YOU RECEIVED AN EMAIL SENT THROUGH POSTLEVER.

13.1. If you received a marketing email that was sent using our platform, the sender is our customer, not us. They chose to email you, they hold the record of your consent, and they decide what happens to your data.

13.2. To unsubscribe, use the unsubscribe link in the message. The facility is the sender's rather than ours, and the sender is obliged to give effect to your request within five business days. If the link does not work, or your request is not acted on, Section 13.3 is how you escalate it to us.

13.3. You can also contact us at privacy@postlever.com. We will act on a request that relates to information we hold, and where the request is properly a matter for our customer we will pass it to them and tell you we have done so. We will not disclose our customer's identity to you where doing so would breach their rights, but we will not use that as a reason to leave a request unanswered.

14. DATA BREACHES.

If we suffer a data breach that is likely to result in serious harm, we will assess it promptly and, where it is an eligible data breach, notify the Office of the Australian Information Commissioner and affected individuals as Part IIIC of the Privacy Act requires. Where the breach affects recipient data, we will notify the customer whose account holds it so they can meet their own obligations. Under Section 4 of our terms of service the customer is the party that notifies the affected individuals, it has ten days from the point at which we and it conclude that notification is required in which to do so, and if it does not we may notify them ourselves after telling the customer first. That arrangement allocates who acts; it does not relieve either of us of an obligation the Privacy Act imposes on us in our own right, and section 26WM treats one party's notification as answering for both only where that party actually notifies.

15. COMPLAINTS.

15.1. If you think we have breached the Australian Privacy Principles, contact us under Section 20. Tell us what happened and what you want us to do about it.

15.2. We will respond within thirty (30) days. If we need longer, we will tell you why and when to expect a response.

15.3. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992, or GPO Box 5218, Sydney NSW 2001. The OAIC will usually expect you to have raised the matter with us first and given us thirty (30) days to respond.

16. GOVERNMENT RELATED IDENTIFIERS.

We do not adopt a government related identifier, such as a tax file number or Medicare number, as our own identifier for an individual, and we do not use or disclose one except where APP 9 permits.

17. CHILDREN.

The platform and our website are for business use and are not directed at children. We do not knowingly collect personal information from a child. If you believe we hold information about a child, contact us under Section 20 and we will delete it, except to the extent that we must keep it: a suppression record kept to give effect to an unsubscribe, information subject to a legal hold, and material we are required to preserve, including for at least ninety days under 18 USC 2258A(h) and anything held under a removal notice under the Online Safety Act 2021 (Cth) or an obligation under section 474.25 of the Criminal Code.

18. IF YOU ARE OUTSIDE AUSTRALIA.

18.1. European Economic Area, United Kingdom, and Switzerland. Where we process personal data subject to the GDPR, UK GDPR, or Swiss data protection law on a customer's behalf, we do so as a processor under Addendum A to our terms. Where we process it for our own purposes, we do so as a controller, and our lawful bases are performance of a contract, our legitimate interests in operating and marketing our business, and consent where we ask for it. You have the rights that law gives you, including access, rectification, erasure, restriction, portability, and objection, and you may complain to your supervisory authority. Australia is not the subject of an adequacy decision, so transfers here rely on the Standard Contractual Clauses.

18.2. United States. Where we process personal information subject to United States state privacy laws on a customer's behalf, we act as that customer's service provider or processor and do not sell or share it. Residents of states granting privacy rights should direct requests to the business that collected their information, which is our customer; contact us under Section 20 and we will assist.

19. CHANGES TO THIS POLICY.

We may update this policy. We will publish the updated version at https://www.postlever.com/privacy and change the date below. Where a change materially affects how we handle personal information we already hold, we will take reasonable steps to tell affected individuals before it takes effect, rather than relying on publication alone.

20. CONTACT US.

privacy@postlever.com

PostLever Pty Ltd ACN 701 249 881 of 7 High Street, Victoria Point, Queensland 4165, Australia