Postruta
Log in

Privacy policy

Last updated 16 October 2026

Postruta is a service for businesses: a link page for the Instagram bio that mirrors the business's feed. This policy explains what personal data we process, why and for how long, and what rights you have.

1. Data controller

Pure D Solutions AB, company reg. no. 556962-3654
Skeppargatan 39A, 114 52 Stockholm, Sweden
Email: hej@postruta.se

2. Customers and users

When a business uses Postruta, we process data about the people who log in: name, email address, password (stored only as a hash, never in plain text), which accounts the person has access to and their role.

We use this data to provide the service, for logging in, and to send emails about the service, for example when the Instagram connection needs to be redone or when new posts have no link. The legal basis is the contract with your business and our legitimate interest in contacting the business's users about the service.

Logging in to the admin uses necessary cookies to keep you signed in. We use no cookies for tracking or marketing.

3. Instagram accounts

When a business connects its Instagram account, we only ask for permission to see the profile and the published posts (instagram_business_basic). We cannot read messages, see or write comments, or publish anything.

We store the account's ID and username, an access token (encrypted) and, for each published post: the caption, the link to the post on Instagram, when it was published, the type of post and a copy of the image. We use this data to show the business's link page. The legal basis is the contract with the business.

4. Visitors to link pages

Link pages use no cookies for tracking or marketing, and we do not store visitors' IP addresses. To show statistics to the business, we count views and clicks. For each view or click we store:

  • the time, and which page or post it concerned,
  • where the visitor came from, but only the domain (for example l.instagram.com), never the full address,
  • an anonymous visitor ID: a hash of the IP address and browser together with a random value that changes every day. The IP address is only used to calculate the hash and is not stored. Because the random value changes, the same visitor cannot be followed from one day to the next, and the IP address cannot be recovered.

The legal basis is our and the business's legitimate interest in measuring how the link page is used. Visits from known search engines and link previews are not counted.

5. Hosting and security

Our hosting provider may process IP addresses in technical logs to protect the service and to troubleshoot. The hosting provider's network (Cloudflare) sets a necessary security cookie, __cf_bm, that tells people and bots apart. It lasts at most 30 minutes and is not used for tracking or marketing. Our own website, postruta.se, also works without tracking cookies and without analytics tools.

6. How long we keep data

  • Users and accounts are kept for as long as the business uses the service. When an account is closed, it is deleted along with its data and images.
  • Instagram posts are kept for as long as the account exists. Images are kept only for each account's 100 most recent posts, and the image of a post removed on Instagram is deleted. If you disconnect Instagram, the access token is deleted. Posts already fetched remain until you delete them, close the account or request deletion (see section 8).
  • Individual views and clicks are deleted after 90 days. After that, only daily totals remain, which cannot be linked to individual visitors.

7. Who receives data

We never sell personal data. We use the following providers, who only process data on our behalf:

  • Laravel Cloud for hosting and storage (region: EU).
  • An email delivery provider, for emails about the service.
  • Meta, when a business connects its Instagram account. Meta's own terms and privacy policy also apply there.

If a provider processes data outside the EU/EEA, this is done under the European Commission's standard contractual clauses or another safeguard approved under the GDPR.

8. Deleting data from Instagram

A business can have its Instagram data deleted at any time:

  • Remove Postruta in Instagram under Settings → Website permissions → Apps and websites. The connection then stops working. If you also request that your data be deleted, Instagram notifies us automatically and we delete the access token and every post and image we fetched from the account. You get a confirmation code and a link where you can follow the deletion.
  • Disconnect in Postruta under Instagram. The access token is deleted immediately.
  • Email us at hej@postruta.se.

9. Your rights

You have the right to request access to, correction of and deletion of your personal data, to request restriction of processing, to object to processing based on legitimate interest, and to receive data you have given us (data portability). Contact us at hej@postruta.se.

If you are unhappy with how we process your personal data, you can complain to the Swedish Authority for Privacy Protection (imy.se) or to the supervisory authority where you live.

10. Changes

We may update this policy when the service changes. The date at the top shows when it was last changed. We notify customers of significant changes by email.