Privacy Policy
Last updated: 24 April 2026
Protecting your personal data is a priority for Postfast. This privacy policy tells you how we collect, use and protect your data when you use our application, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).
1. Data controller
The data controller is:
Thibaut Diesbecq, auto-entrepreneur (French self-employed sole trader)
Email: hello@postfast.fr
2. Data collected
2.1 Data provided directly by the user
- Account data: email address, password (encrypted)
- Item photos: images sent for analysis by the AI
- Notes and preferences: free-text notes added to items, personalisation preferences (tone, platforms, Vinted username, etc.)
- Generated listings: titles, descriptions, prices and hashtags created through the service
2.2 Data collected automatically
- Usage data: number of generations carried out, dates of use
- Technical data: device type, application version, operating system
- Push notification token (Expo Push Token) if the user has allowed notifications
3. Purposes and legal bases
| Purpose | Legal basis | Retention period |
|---|---|---|
| Management of the user account | Performance of the contract | Lifetime of the account + 30 days |
| AI generation of listings | Performance of the contract | Duration of the processing only |
| Management of quotas and subscriptions | Performance of the contract | Duration of the subscription |
| Listing history | Performance of the contract | Lifetime of the account |
| Push notifications | Consent | Until consent is withdrawn |
| Improvement of the service | Legitimate interest | Anonymised data, 12 months |
4. Processing of photos
The photos you take with Postfast are processed as follows:
- Images are compressed locally on your device (maximum resolution 1024px, quality 0.7) before any transfer
- Up to 5 photos are sent to the OpenAI API (vision models) for analysis
- Photos are transmitted in base64 and are not stored by OpenAI beyond the immediate processing
- No photo is kept on our servers after the listing has been generated
5. Processors and data transfers
We use the following processors to operate the service:
| Processor | Role | Location |
|---|---|---|
| Supabase | Database hosting, authentication | EU (AWS Frankfurt infrastructure) |
| OpenAI | AI analysis of photos, text generation | United States |
| Railway | Backend server hosting | United States |
| Expo (EAS) | Push notifications | United States |
| eBay | Publishing listings to your eBay account (only if you connect your account) | United States / EU |
Transfers of data to the United States are governed by the European Commission’s standard contractual clauses and/or the EU-US Data Privacy Framework, in accordance with the GDPR.
6. Data security
We implement the following security measures:
- Authentication by JWT (JSON Web Tokens) with the ES256 algorithm
- Encryption of passwords (bcrypt hashing via Supabase Auth)
- Communications encrypted with HTTPS/TLS
- Row Level Security (RLS) on the database — each user can access only their own data
- Rate limiting: 5 requests per minute per user, 60 per minute overall
- Environment variables for API keys (no key in the source code)
7. Your rights
In accordance with the GDPR, you have the following rights:
- Right of access: obtain a copy of your personal data
- Right to rectification: correct inaccurate data
- Right to erasure: request the deletion of your data
- Right to data portability: receive your data in a structured format
- Right to object: object to the processing of your data
- Right to restriction of processing: restrict the processing in certain cases
- Right to withdraw consent: withdraw your consent at any time for processing based on it
To exercise these rights, contact us at: hello@postfast.fr. We will reply within a maximum of 30 days.
You also have the right to lodge a complaint with the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL): www.cnil.fr.
8. Cookies and trackers
The Postfast mobile application does not use cookies. The postfast.fr website does not use any tracking or advertising cookies. Only technical cookies strictly necessary for the operation of the site may be used.
9. Minors
Postfast is not intended for people under the age of 16. If we learn that data concerning a minor under the age of 16 has been collected, we will delete it as soon as possible.
10. Changes
We reserve the right to amend this privacy policy at any time. Any change will be notified to users through the application. The date of the last update is shown at the top of this page.
11. Contact
For any question relating to this privacy policy or to the protection of your data, contact us:
Email: hello@postfast.fr