Privacy Policy

This Privacy Policy explains how WillPost ("WillPost", "we", "us") collects, uses, and protects information when you use our social media management application and website. By using WillPost you agree to the practices described here.

Who we are (data controller)

WillPost is operated by WILLBILL Ltd, a company incorporated in the Republic of Mauritius (Business Registration No. C26232106), with its registered office at Mapou, Mauritius. WILLBILL Ltd is the data controller responsible for your personal data and processes it in accordance with the Mauritius Data Protection Act 2017. You can reach us about any privacy matter at will@willpost.online.

Information we collect

Account information

When you create an account we collect your name, email address, and a securely hashed password. If you subscribe to a paid plan, payments are handled by Polar, our Merchant of Record, who processes the transaction and stores your payment details; we never see or store your full card details.

Connected social accounts

WillPost connects to Facebook, Instagram, LinkedIn, X, and TikTok through each platform's official OAuth flow. We never see or store your social media passwords. With your authorization we store the access tokens needed to publish and manage content on your behalf, and these tokens are encrypted at rest. You can disconnect any account at any time: this deletes the access tokens we hold for it and stops WillPost's access to that account. It does not always remove WillPost from your account on the platform itself; to do that too, remove WillPost in that platform's settings for connected apps.

LinkedIn

Nothing is posted to LinkedIn unless a person on your team approves it.

Content you provide

We store the media, captions, brand documents, notes, and campaign data you upload or create so that the service can generate, schedule, and publish your posts.

Usage data

We collect basic technical information such as log data and aggregate usage metrics to operate, secure, and improve the service.

Cookies, campaign attribution, and marketing measurement

The website uses three categories of cookies and similar technologies. Essential cookies are required for the site to function (for example, remembering your cookie choice) and are always active. Analytics cookies (Google Analytics) help us understand how the site is used. Marketing cookies (the Meta Pixel and Google advertising features) let us measure which campaigns lead to registrations. When you first visit, a banner lets you agree to all categories or open "Set cookies" to choose analytics and marketing individually; until you make a choice, Google Consent Mode keeps all analytics and advertising storage denied and the Meta Pixel does not load.

When you arrive through a campaign link, we may retain campaign parameters (such as source, campaign, creative, and Meta click identifier) and associate them with a registration so we can understand which launch activity works. If you do not enable marketing cookies, neither ad tag loads and WillPost does not send consent-dependent conversion events. You can clear your browser storage to reset the saved website choice; after creating an account, contact us to withdraw consent for any remaining account-linked conversion measurement.

Separately, we use Cloudflare Web Analytics to count visits. It is cookieless, sets no identifiers, and does not track you across sites, so it runs without requiring consent.

How we use your information

• To provide, maintain, and improve WillPost's features.
• To publish and schedule content to the social accounts you connect, at your direction.
• To generate captions and related content using AI based on the materials you provide.
• To communicate with you about your account, security, and service updates.
• To detect, prevent, and address technical issues, fraud, or abuse.
• With your consent, to measure marketing campaigns and registrations.

Our lawful basis for processing

Under the Mauritius Data Protection Act 2017 we process your personal data on the following lawful bases:

• Consent — when you connect a social account or ask us to generate captions and content using AI, and when you allow marketing measurement. You can withdraw consent at any time by disconnecting the account or contacting us. Clearing the saved website choice resets browser measurement after reload.
• Performance of a contract — to create and operate your account, and to schedule, publish, and manage the content you ask us to handle.
• Legitimate interests — to secure the service, prevent fraud and abuse, and improve WillPost, balanced against your rights and freedoms.
• Legal obligation — to keep records (such as billing records) where the law requires us to retain them.

How we share information

We do not sell your personal data. We share information only with the social platforms you connect (to perform the actions you request) and with service providers that help us operate WillPost (such as hosting and AI providers, Meta and Google when you consent to campaign measurement, Cloudflare for cookieless visit analytics, and Polar, our Merchant of Record, who processes payments and handles billing and sales tax), under appropriate confidentiality obligations, or when required by law.

International transfers of your data

WillPost relies on trusted service providers — including cloud hosting, AI, and payment providers — that may store or process personal data outside the Republic of Mauritius. Where we transfer your personal data abroad, we do so in accordance with the Mauritius Data Protection Act 2017: either with your consent, because the transfer is necessary to provide the service you have requested, or subject to appropriate safeguards (such as contractual data-protection commitments) that ensure your data continues to receive an adequate level of protection.

Data retention

We retain your information for as long as your account is active or as needed to provide the service. You may request deletion of your data at any time — see our Data Deletion instructions.

The messages, comments and analytics we received from Instagram and Facebook are kept for 120 days after that account stops being connected, and are then permanently deleted, together with any connection record and access token still held for it. During those 120 days that history is hidden rather than deleted, and it comes back if you reconnect the same account. Your own posts, campaigns and uploaded media are not affected. To have it deleted sooner, the account owner can use My Account → Danger zone → Delete Instagram & Facebook data in the app, you can ask for deletion in your Facebook or Instagram settings, or you can delete your WillPost account.

If you never used WillPost but commented on or messaged an account that is managed through it, you can still ask us to delete what we hold about you: email will@willpost.online with the name of that Instagram or Facebook account, and we delete it within 30 days.

Your rights

Under the Mauritius Data Protection Act 2017 (and depending on your location), you have the right to access, rectify, erase, restrict, and object to the processing of your personal data, the right to data portability, and the right not to be subject to a decision based solely on automated processing. To exercise these rights, contact us at will@willpost.online.

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Data Protection Office of Mauritius (dataprotection.govmu.org).

Security

We use industry-standard measures, including encryption of sensitive tokens at rest and encrypted connections (HTTPS), to protect your information. No method of transmission or storage is completely secure, but we work to protect your data and respond promptly to any issues.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the "Last updated" date above.

Contact us

If you have questions about this Privacy Policy, contact us at will@willpost.online.