Postastory · Legal
Privacy policy
Draft — to be reviewed by a lawyer before launch. Effective 1 December 2026.
1. Who is responsible
Example Company Ltd, 1 Sample Street, 10115 Berlin, Germany, is the controller for account and billing data. For the content and personal data you add to your projects, you are the controller and we process it for you (see the DPA).
2. What we collect
- Account: your name, email address, password (stored as a hash) or Google sign-in, team memberships.
- Billing: plan, invoices and payment status. Card details are handled by Stripe; we never see them.
- Your content: brand profiles, requests, posts, images and articles.
- Connected channels: access tokens for LinkedIn, Facebook, Instagram and WordPress (encrypted), and page names.
- Website scans: the public text of the pages scanned.
- Usage and security: IP address and actions in an audit log, error reports, server logs.
3. Why, and on what basis
To provide the service (contract); billing and tax records (legal obligation); security, fraud prevention and fixing errors (legitimate interest); service emails (contract). We don’t send marketing emails.
4. Who we share it with (sub-processors)
| Provider | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Servers and database | Germany |
| Amazon Web Services (S3, CloudFront, Lambda) | Image storage and delivery | EU (Frankfurt); CDN worldwide |
| Anthropic | Writing text with AI | USA |
| OpenAI | Creating images with AI | USA |
| Stripe | Payments, invoices, tax | EU/USA |
| Resend | Sending emails | USA |
| Sentry | Error reports | EU (Germany) |
| Sign in with Google (if you use it) | — | |
| LinkedIn, Meta, your WordPress host | Publishing, when you connect them | — |
Transfers outside the EU rely on the EU Standard Contractual Clauses and, where it applies, the EU–US Data Privacy Framework.
5. How long we keep it
While your account exists; 60 days after a trial expires or an account is closed, then deleted. Invoices: as long as tax law requires. Publish logs: 90 days. Server logs: 30 days.
6. Your rights
Access, correction, deletion, export, objection and restriction; complaint to your data protection authority. Contact hello@postastory.com.
7. Security
Encryption in transit (HTTPS) and for connection tokens at rest; access limited to staff who need it; every staff action on an account is logged.
8. Cookies
See the cookie policy.
9. Changes
We’ll post updates here and email you about important ones.