This Privacy Policy explains what personal data Postefly collects, why, how long we keep it and what your rights are under the GDPR.
1. Who we are and how to contact us
Postefly is owned and operated by Ioannis Barmparis, who is the data controller for personal data processed through postefly.com. For any privacy question or request, and for support, email info@postefly.com.
2. What data we collect, why, and on what legal basis
| Data | Why we use it | Legal basis (GDPR Art. 6) |
|---|---|---|
| Account data: email, creation date, password stored only as a secure hash, or your Google account identifier if you sign in with Google | To create and run your account and sign you in | Contract |
| Photos and event details you add | To create your poster. On the website they stay in your browser on your device and are sent to our servers only when you create a poster | Contract |
| Posters you save and their 4K copies | To store your posters and let you download them | Contract |
| Generation records: generation history, technical records of each AI request (model, success or error, duration), and for ChatGPT requests the event details of the request | To deliver posters, refund failed generations and fix problems | Contract; legitimate interest (service reliability) |
| Credits and payment records: balance, credit history, package, amount, currency, status, Stripe payment reference (never card details) | To sell credits and add them to your account | Contract; legal obligation for tax records, which Stripe keeps as merchant of record |
| Signup log: IP address, email and browser details recorded at sign-up | Used only to prevent abusive mass sign-ups; deleted automatically after 24 hours | Legitimate interest (fraud and abuse prevention) |
| Email records: log of emails sent (type, recipient, status) and your unsubscribe choice | To send service emails (verification, password reset, receipts) and occasional account reminders, each with an unsubscribe link | Contract (service emails); legitimate interest (reminders, which you can stop at any time) |
| Usage records from ChatGPT and other AI apps (see section 5) | To understand how the integration is used and keep it working | Legitimate interest |
We do not currently rely on consent for any processing: we use only essential cookies (section 6) and do not send you marketing that requires consent.
3. Service providers (sub-processors)
| Provider | Purpose | Location / safeguard |
|---|---|---|
| Lovable Cloud (Lovable, built on Supabase) | Hosting, database, sign-in, file storage, email delivery | Database and file storage in the EU (Ireland); other processing may take place outside the EEA under Standard Contractual Clauses |
| Cloudflare | Runs the website and servers as part of our hosting | May process data outside the EEA under Standard Contractual Clauses |
| Stripe | Payments; merchant of record, handles VAT/sales tax | May process data outside the EEA under Standard Contractual Clauses |
| OpenAI | Poster generation: receives your photos, event details and poster instructions | May process data outside the EEA under Standard Contractual Clauses |
| Replicate (via Lovable's connector service) | 4K upscaling of finished posters | May process data outside the EEA under Standard Contractual Clauses |
| Sign-in, only if you choose Sign in with Google | May process data outside the EEA under Standard Contractual Clauses |
4. How long we keep data
| Data | Retention |
|---|---|
| Account data | Until your account is deleted |
| Saved posters and 4K copies | Until you delete the poster or your account. Deleting a poster also deletes its 4K copy |
| Photos added on the website | Kept in your browser on your device; not stored on our servers |
| Photos added through ChatGPT or other AI apps | Deleted automatically after 7 days |
| Generation records, credit history, usage records, email log | Until your account is deleted |
| Payment records | Our copy is deleted with your account. Stripe keeps its own transaction records as merchant of record |
| Signup log (IP address, email, browser details) | IP address, email and browser details recorded at sign-up are used only to prevent abusive mass sign-ups and are deleted automatically after 24 hours. |
| Unsubscribe and bounce list | Kept so we do not email you again after you unsubscribe or an email bounces |
Account deletion: you can request deletion from your billing page. After a 30-day grace period, during which you can cancel, your account, posters, 4K copies, uploaded photos, and the records listed above as kept until account deletion are permanently erased automatically.
5. Using Postefly through ChatGPT and other AI apps
- You connect your existing Postefly account through a secure sign-in (OAuth). You can disconnect at any time from the connected-apps settings of ChatGPT or the other AI app.
- We receive only what the Postefly tools need: the photos and logos you attach or add in the Postefly window, and the event details the assistant fills in from what you wrote (such as title, venue, date, time, performer names, price, phone). We do not receive your conversation history.
- Photos you add this way are stored in private storage and automatically deleted after 7 days.
- Posters you create are saved to your Postefly account until you delete them. Their 4K copies are stored alongside them and are deleted together with the poster.
- As on our website, your photos and event details are sent to OpenAI to generate the poster, and finished posters are sent to Replicate for 4K upscaling.
- We keep limited usage records: event type, tool name, which app was used (e.g. ChatGPT or Claude), your account ID, the related job ID and the time. These records never include chat content, photos or prompt text.
- You use the same credits as in your Postefly account. Credits can be purchased only on postefly.com.
6. Cookies
We use only strictly necessary cookies and browser storage. We do not use analytics, advertising pixels or third-party trackers. On your device we store:
- sb-…-auth-token (local storage): keeps you signed in;
- postefly:locale (local storage): remembers your language;
- postefly.cookieConsent.v1 (local storage): remembers that you dismissed the cookie notice;
- postefly:projects:migrated:v2:… (local storage): a one-time flag used when upgrading saved studio drafts;
- postefly:studio-preview:… (session storage): keeps your latest preview while the tab is open;
- "postefly" database (IndexedDB, stores studio-projects and studio-photos): your studio drafts and photos, kept only on your device;
- When you buy credits, Stripe's secure checkout is loaded and Stripe may set its own cookies needed for payment and fraud prevention.
7. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you;
- Correct inaccurate data;
- Erase your data and account (see section 4);
- Restrict processing, or object to processing based on legitimate interest;
- Receive your data in a portable format;
- Lodge a complaint with the Hellenic Data Protection Authority (dpa.gr) or the data-protection authority of your country.
To exercise any of these rights, email info@postefly.com from the address linked to your account.
8. Children
Postefly is not directed to children under 16. We do not knowingly collect personal data from children.
9. Changes to this policy
We will update this policy when our practices change and change the date at the top. Material changes will be announced in-app or by email.