Captured before automated identity checks (Oct 14, 2026): accurate as of its capture on Jul 19, 2026; our capture on Oct 21, 2026 found the same text, but its identity was not checked by them.
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
This is Postman's Privacy Policy, covering how the company collects and uses personal information when users interact with its API platform and related services, including the astropods.ai domains. The policy authorizes sharing of cookie-derived visitor information and hashed contact details with advertising and marketing partners, and states that personal information may be used to develop AI tools and systems under separate Postman AI Terms. For users covered by GDPR or US state privacy laws, the policy describes rights including access, correction, deletion, opt-out of targeted advertising, and the ability to designate an authorized agent for rights requests.
This document is Postman's Privacy Policy (last updated April 2026), governing the collection, use, sharing, and processing of personal information across Postman's software, services, and websites, including astropods.com and astropods.ai, with legal bases asserted under GDPR legitimate interests, contractual necessity, legal obligation, and consent frameworks. The policy states that Postman collects account and profile information, billing information, device and connection data, browsing and interaction data, collaboration metadata, and inferences about user preferences; the terms authorize sharing of visitor information and hashed contact data with advertising and marketing partners, and permit use of personal information to develop AI tools and systems as referenced in the Postman AI Terms. The policy states that Postman does not sell information that directly identifies users by name or contact details to advertisers, but separately authorizes disclosure of cookie-derived visitor information and hashed identifiers to advertising partners, a distinction that may engage state law definitions of 'sale' or 'sharing' under statutes such as the CCPA and similar US state privacy laws. The policy asserts compliance with the EU-U.S. Data Privacy Framework, UK DPF Extension, and Swiss-U.S. DPF, with Postman certified under all three frameworks and subject to FTC investigatory and enforcement powers; unresolved DPF complaints are referred to JAMS arbitration, with binding arbitration available as a final resolution mechanism under DPF Annex I. Compliance teams should note that the policy explicitly references AI data use governed by separate Postman AI Terms not reproduced here, that data is processed in ten listed countries including India, Nigeria, Ukraine, and the Philippines under Standard Contractual Clauses or DPF mechanisms, and that the policy applies differently depending on whether Postman acts as a controller or processor for organizational customers.
The agreement authorizes use of personal information including contact data, usage patterns, and inferred preferences to develop AI tools and systems, subject to separate Postman AI Terms that are not reproduced in this policy. Under these terms, cookie-derived visitor information and hashed contact identifiers may be shared with advertising and marketing partners, even though the policy states Postman does not sell directly identifying information such as name and contact details to outside parties. You can opt out of targeted advertising by following the steps at the 'Your Privacy Choices' link in the policy footer, adjust cookie and tracking preferences in Privacy Settings, and submit deletion or correction requests by emailing help@postman.com or calling 1-888-616-1665.
Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.
We published a capture of this page that was not the document. Each correction is recorded in our correction log:
We withheld clauses we had published from this document. Each withholding is recorded in our correction log:
“If you register or access the Services using an email address with a domain that is owned by your employer or organization...certain information about you (including your name, profile picture, contact info, content and past use of your account) may …”
“Postman, Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the DPF (UK DPF Extension), and the Swiss-U.S. Data Privacy Framework (Swiss DPF) as set forth by the U.S. Department of Commerce.”
“Postman's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.”
“We are not in the business of selling information about you to advertisers or other third parties. We do not sell information that directly identifies you (like name and contact info) to outside parties.”
“Where we provide the Services under contract with an organization (for example your employer), that organization controls the information processed and acts as the data controller...we operate as the data processor and the contract may require us to process the …”
“Postman shall remain liable under the Principles if its agent processes such personal information in a manner inconsistent with the Principles, unless Postman shows that it is not responsible for the event giving rise to the damage.”
“Postman personnel do not access private workspace content except for: security purposes to assist the workspace owner with a support matter to maintain the integrity of the Service to comply with our legal obligations if we have reason to believe …”
“We process personal data for the purpose it was originally collected unless consent to materially different processing purposes has been obtained or, depending on relevant jurisdiction, there is no applicable opt-out of such processing.”
“Residents of states with US State Privacy Laws may have the right to opt out from the "sale" or "sharing" of your personal information, including the processing of your personal information for purposes of targeted advertising.”
“We may also use information you provide to develop artificial intelligence (AI) tools and systems as set forth in our Postman AI Terms.”
“If you choose to store any Sensitive Personal Information on our servers, you are responsible for complying with all applicable legal obligations regarding that data.”
“Visitor information, however, including information collected via cookies and other tracking technology, may be provided to other parties for marketing, advertising, or other uses. We may also share or use hashed contact information for this purpose.”
Every distinct legal provision identified in this document. Featured provisions appear above with analysis.
We have not recorded a change to this document since we began capturing it. Monitor includes alerts from a daily check, structured change summaries, and monitoring for up to 20 platforms.
Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.
Cross-platform context
See how other platforms handle Binding Arbitration Available for Unresolved DPF Complaints and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 343 platforms.