Privacy Policy
Last updated: 10 October 2026
Protecting your personal data is a priority for Postfast. This privacy policy tells you how we collect, use and protect your data when you use our application, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).
1. Data controller
The data controller is:
Thibault Diesbecq, auto-entrepreneur (French self-employed sole trader), SIREN 934 407 487
105 route de Langrune, 14750 Saint-Aubin-sur-Mer, France
Email: hello@postfast.fr
2. Data collected
2.1 Data provided directly by the user
- Account data: email address, password (encrypted)
- Item photos: images sent for analysis by the AI
- Notes and preferences: free-text notes added to items, personalisation preferences (tone, platforms, Vinted username, etc.)
- Generated listings: titles, descriptions, prices and hashtags created through the service
2.2 Data collected automatically
- Usage data: number of generations carried out, dates of use
- Technical data: device type, application version, operating system
- Push notification token (Expo Push Token) if the user has allowed notifications
3. Purposes and legal bases
| Purpose | Legal basis | Retention period |
|---|---|---|
| Management of the user account | Performance of the contract | Lifetime of the account + 30 days |
| AI generation of listings | Performance of the contract | Duration of the processing only |
| Management of quotas and subscriptions | Performance of the contract | Duration of the subscription |
| Listing history | Performance of the contract | Lifetime of the account |
| Push notifications | Consent | Until consent is withdrawn |
| Improvement of the service | Legitimate interest | Anonymised data, 12 months |
4. Processing of photos
The photos you take with Postfast are processed as follows:
- Images are resized and compressed locally on your device before any transfer
- Up to 5 photos per listing (3 in Buying mode) are sent to our artificial intelligence providers for analysis: OpenAI to recognise the item's category, and Google to write the listing, estimate the price and retouch photos. If Google is unavailable, writing and price estimation are handled by Anthropic, then by OpenAI if Anthropic is unavailable too
- These providers process them for as long as it takes to answer our request. We use their programming interfaces, whose terms provide that the data sent is not used to train their models
- The photos in your listings are kept on our servers (Supabase Storage, European Union), because they are part of the listing you view and reopen. They can only be reached through time-limited signed links, and are deleted along with the listing, or with your account
5. Processors and data transfers
We use the following processors to operate the service:
| Processor | Role | Location |
|---|---|---|
| Supabase | Database hosting, authentication | EU (AWS Frankfurt infrastructure) |
| OpenAI | AI analysis of photos (recognising the item's category); writing the listing and price estimation if Google and Anthropic are unavailable | United States |
| AI analysis of photos: writing the listing, price estimation, photo retouching | United States | |
| Anthropic | AI analysis of photos: writing the listing and price estimation, only if Google is unavailable | United States |
| Railway | Backend server hosting | United States |
| Expo (EAS) | Push notifications | United States |
| eBay | Publishing listings to your eBay account (only if you connect your account) | United States / EU |
Transfers of data to the United States are governed by the European Commission’s standard contractual clauses and/or the EU-US Data Privacy Framework, in accordance with the GDPR.
6. Data security
We implement the following security measures:
- Authentication by JWT (JSON Web Tokens) with the ES256 algorithm
- Encryption of passwords (bcrypt hashing via Supabase Auth)
- Communications encrypted with HTTPS/TLS
- Row Level Security (RLS) on the database — each user can access only their own data
- Limits on the number of requests per minute, per user and per address, to block abuse
- Environment variables for API keys (no key in the source code)
7. Your rights
In accordance with the GDPR, you have the following rights:
- Right of access: obtain a copy of your personal data
- Right to rectification: correct inaccurate data
- Right to erasure: request the deletion of your data
- Right to data portability: receive your data in a structured format
- Right to object: object to the processing of your data
- Right to restriction of processing: restrict the processing in certain cases
- Right to withdraw consent: withdraw your consent at any time for processing based on it
To exercise these rights, contact us at: hello@postfast.fr. We will reply within a maximum of 30 days.
You also have the right to lodge a complaint with the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL): www.cnil.fr.
8. Cookies and trackers
The Postfast mobile application does not use cookies. The postfast.fr website does not use any tracking or advertising cookies. Only technical cookies strictly necessary for the operation of the site may be used.
9. Minors
Postfast is not intended for people under the age of 16. If we learn that data concerning a minor under the age of 16 has been collected, we will delete it as soon as possible.
10. Changes
We reserve the right to amend this privacy policy at any time. Any change will be notified to users through the application. The date of the last update is shown at the top of this page.
11. Contact
For any question relating to this privacy policy or to the protection of your data, contact us:
Email: hello@postfast.fr