Data Request Policy — My Auto Poster

My Auto Poster handles requests from public authorities under four principles: every request is reviewed for legality, unlawful requests are challenged, only the minimum necessary data is ever disclosed, and every request and response is documented.

1. Scope

This policy explains how My Auto Poster handles requests from public authorities — such as law enforcement agencies, regulators, or courts — for the personal data or personal information of our users.
It applies to every request, regardless of the country it originates from, and works alongside our Privacy Policy and Terms of Service.

2. Required review of legality

Every request is reviewed individually before any data is disclosed. No request is answered automatically.
We verify that the request is validly issued under applicable law, comes from an authority with proper jurisdiction, identifies the data sought with reasonable specificity, and follows the correct legal process (for example, a subpoena, court order, or warrant as required).
Requests that are overbroad, lack legal basis, or fail to follow proper process are rejected or narrowed before we respond.

3. Challenging unlawful requests

Where a request appears unlawful, unconstitutional, overbroad, or otherwise improper, we reserve the right to challenge it — including by seeking to narrow its scope, requesting clarification, or pursuing available legal remedies such as motions to quash.
We will not disclose data in response to a request we reasonably believe to be unlawful until the issue is resolved through the appropriate legal process.

4. Data minimization

When disclosure is legally required, we disclose only the minimum information necessary to satisfy the specific legal obligation — nothing more.
We interpret requests narrowly and do not volunteer data beyond what is expressly compelled.
Where possible, we ask the requesting authority to narrow requests that seek more data than the stated purpose requires.

5. Documentation of requests

Every request is logged and retained, including: the requesting authority, the date received, the legal process cited, the data sought, our legal reasoning, the actions we took in response, and the identities of the people involved in the decision.
These records allow us to account for every disclosure and to demonstrate compliance with this policy.

6. Notifying affected users

Unless we are legally prohibited from doing so (for example, by a court-ordered gag or a valid non-disclosure order), we will notify the affected user before disclosing their data so they have an opportunity to seek legal protection.
Where notification is prohibited, we will notify the user once the prohibition expires or is lifted, where the law allows.

7. Emergency requests

Requests citing an emergency involving imminent risk of death or serious physical harm are reviewed under the same standards but on an expedited basis.
We require emergency requests to be made through verifiable official channels and still verify the identity of the requester and the legal basis claimed.

8. Contact

Public authorities should direct requests through the contact address listed on the About page, marked clearly as a legal data request.
Users with questions about this policy can reach us through the workspace or the same contact address.

This policy is provided as a standard template. Before publishing or submitting it to third-party app reviews, have it reviewed by a qualified attorney to confirm it matches your actual internal processes — the commitments made here should reflect what your team genuinely does.