1. Who is responsible
Controller: AutoPostr, Albert-Schweitzer-Ring 35, 22045 Hamburg, Germany, contact privacy@autopostr.app. We have not appointed a Data Protection Officer because we are not required to; privacy questions go to the same address. We act as controller for your account, billing, security, and product-usage data, and as processor for the content and connected-account data you ask us to process (see the DPA).
2. What we process, why, and on what legal basis
| Activity | Data | Legal basis (Art. 6) |
|---|---|---|
| Create and secure your account | Name, email, password hash, sign-in and security events, terms-acceptance record | Contract (6(1)(b)); legal obligation and legitimate interests for security and proof of consent (6(1)(c),(f)) |
| Research, write, critique, generate media, and publish your content | Niche, briefs, brand voice, drafts, uploaded media, scheduling data, platform tokens | Contract (6(1)(b)) |
| Learn from your best posts to improve future drafts | Published posts, engagement metrics, text embeddings of high performers (stored in our database, scoped to your campaign) | Contract (6(1)(b)) |
| Billing and tax | Billing details, subscription and invoice records (card data is held by Stripe) | Contract (6(1)(b)); legal obligation (6(1)(c)) |
| Service emails | Email address; publish, failure, approval, and account-deletion notices | Contract (6(1)(b)) |
| Onboarding and product emails | Email address, name | Legitimate interests (6(1)(f)) in helping new users get value; you can unsubscribe in one click at any time |
| Operate, debug, and protect the service; control costs | Server logs (IP, user agent, timestamps), error traces, per-user usage and cost events, admin audit log | Legitimate interests (6(1)(f)) |
We do not sell personal data, do not use it for advertising, and do not take decisions about you based solely on automated processing that produce legal or similarly significant effects (Art. 22). AI is used to produce content you review; it does not decide anything about your rights.
3. How AI services use your data
- Text, image, and vision AI (OpenAI): we send prompts assembled from your niche, brief, brand voice, trend research, and sample posts, plus images when you ask for edits or checks, and post text for embeddings. We use API access and do not opt your content into model training.
- Voice and transcription (ElevenLabs): script text is sent to be voiced; audio you upload is sent for transcription.
- Image and video generation (fal.ai): visual prompts derived from your content, and reference images where relevant.
- Research (Brave Search, stock-media providers): only search keywords derived from your topic — not your account details.
- Likeness and voice: only upload recordings and images of people if you have the right and, where required, their consent. You are responsible for that consent.
Do not put special-category data (health, beliefs, biometrics, and similar) or other people's sensitive data into prompts or uploads.
4. Who receives data
Our sub-processors (Supabase, Railway, Vercel, Cloudflare (R2), OpenAI, ElevenLabs, fal.ai, Stripe, Resend, Brave Search, Pexels, Pixabay and Unsplash) are listed with the exact data each receives at autopostr.app/subprocessors. The social platforms you connect receive your content when you publish, as independent controllers.
5. International transfers
Our primary database is hosted in the United Kingdom (London); the application servers and several AI and email providers are in the United States. Transfers out of the EEA/UK rely on adequacy decisions (including the UK adequacy decision and the EU–US Data Privacy Framework where a provider is certified) or the EU Standard Contractual Clauses with the UK Addendum, as incorporated in our DPA and our agreements with sub-processors. Ask privacy@autopostr.app for a copy of the relevant safeguards.
6. How long we keep data
| Data | Retention |
|---|---|
| Account, campaigns, content, media | While your account is active; deleted after the 30-day recovery period following account deletion |
| Platform OAuth tokens | Until you disconnect or delete your account; revoked with the provider where it supports revocation |
| Pipeline run events (debug) | 30 days, then purged automatically |
| Billing and tax records | As required by law (typically up to 10 years in Germany) |
| Backups | Roll off on the provider's normal schedule after deletion |
7. Your rights
You can ask us to access (Art. 15), correct (16), erase (17), restrict (18), or export (20) your data, to object to processing based on legitimate interests (21), and to withdraw consent at any time (7(3)). You can delete your account in the app or email privacy@autopostr.app from your account address; we respond within one month. You have the right to complain to a supervisory authority — in the EU, the authority in your country of residence or work; for us, the Hamburg Commissioner for Data Protection and Freedom of Information; in the UK, the ICO.
8. Cookies and tracking
We use only strictly necessary cookies (your sign-in session and theme preference). We do not use advertising or third-party analytics cookies, and our web fonts are served from our own domain rather than from Google's servers, so no cookie banner is needed. If that changes, we will ask for consent first.
9. Security
Data is encrypted in transit; platform tokens and API keys are encrypted at rest; access is scoped per user, with an audit log for administrator actions. See section 5 of the DPA for details. We will notify affected users and the competent authority of a personal-data breach as the law requires.
10. If you use AutoPostr for your own customers
If the content you process includes other people's personal data (for example, messages from your Instagram audience or footage of clients), you are the controller of that data and we are your processor. Our DPA applies automatically and covers the Article 28 terms and the transfer clauses.