Privacy policy
Last updated: 2026-10-27
1. Controller
maxiFIT Sebersdorf e.U., owner Sabine Schreiber, Oberlimbach 33, 8271 Bad Waltersdorf, Austria
Email: support@postaro.at
We are not required to appoint a data protection officer. Please send any data protection questions to the address above.
2. What we are responsible for
Postaro is a service for businesses. We act in two roles:
- We are the controller for the data we process for our website, the free preview, your customer account, billing and our contact with you. This privacy policy covers that.
- We are a processor for the content you give us as a customer: content of your website, knowledge entries, photos, videos, logos, posts and the data of people shown or named in them. Our data processing agreement applies; you are the controller for that data.
3. Visiting the website, server
Postaro runs on its own server in a data centre in Frankfurt am Main (Germany), rented from Hostinger International Ltd., 61 Lordou Vironos, 6023 Larnaca, Cyprus. When you open a page, your browser necessarily transmits your IP address, the requested address, date and time and browser details. The connection is always encrypted (HTTPS).
Our application logs requests without your IP address (the log only contains the address of our internal proxy, the requested address, time and status code). The log is continuously overwritten (at most 30 MB per service).
Protection against password attacks: after failed sign-ins we store a non-reversible check value (hash) of the email address entered and of the IP address with the time, in order to block repeated attempts temporarily. These entries are deleted after 2 days without a new failed attempt.
Legal basis: our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).
Our public pages do not load content from third-party servers: no analytics, no advertising or tracking services, no social media plugins. We serve the fonts ourselves.
4. Free preview (demo)
For the free preview you enter a company name and the address of its website. No sign-up or personal details are needed. Our server opens the public website with an automated browser and reads texts, images, colours, fonts and the logo. An AI service (see section 8) uses this to create a knowledge profile and example posts; photos from the website may be sent to the AI service for description and checking, and AI-generated images are added.
Public websites may contain personal data (e.g. names and photos of staff). Please only use the preview for your own business or with its consent.
The preview is available via a random share link valid for 90 days; after that it can no longer be opened via this link. We delete preview data at any time on request; if you turn it into a customer account, the rules for customers apply.
Legal basis: legitimate interest in showing you a preview on request (Art. 6(1)(f) GDPR) or pre-contractual steps (Art. 6(1)(b)).
5. Customer account and portal
For your account we process your email address, your password (only as a non-reversible check value, scrypt), your settings (workflow, posting plan, design, language), links to your social media profiles, the connection to your Buffer account (access keys stored encrypted only) and the content you create in the portal. We also keep a technical log of important events (e.g. sign-in, password reset, cancellation, errors) with account number and time.
For cost control we store, for each AI request, only time, customer number, purpose, provider, model and usage – never the content of the request or the answer.
When you sign up we store proof that you signed up as a business and accepted our terms including the data processing agreement (time, email address, account number, version of the texts).
Legal basis: contract (Art. 6(1)(b) GDPR); proof of acceptance and log: legitimate interest (Art. 6(1)(f)).
6. Payment (Stripe)
Payments are handled by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland. You enter your payment details (e.g. card or account), name, email and billing address directly on Stripe's payment page; we do not receive them. Stripe sends us the customer and subscription ID, the payment status and the invoices. Stripe also processes data in the USA (EU-US Data Privacy Framework or standard contractual clauses) and is itself responsible for its own purposes such as fraud prevention: stripe.com/privacy.
Legal basis: contract (Art. 6(1)(b) GDPR) and statutory retention obligations (Art. 6(1)(c)).
7. Emails
We only send emails that are part of the service: password reset links, a welcome email with instructions after sign-up and notices when something did not work with your posts. Agencies can send approval links to their clients via Postaro. We do not send newsletters or advertising. Emails are sent via the mail server of easyname GmbH, Vienna, Austria.
Legal basis: contract (Art. 6(1)(b) GDPR).
8. AI services
Postaro creates texts, images and voice-overs with artificial intelligence. For this we send the content needed for each step to:
- Anthropic (Anthropic PBC, San Francisco, USA): writing and checking posts (fact check), creating the knowledge profile, describing photos and checking whether they fit, checking stock videos.
- OpenAI (OpenAI Ireland Ltd., Dublin, Ireland, or OpenAI, L.L.C., USA): fallback text model if Anthropic is unavailable, AI images and the voice-over in reels.
We send content from your website and knowledge profile, topics, post texts, your style instructions and photos from your library, as far as needed for the step. We do not send your password, your payment data or the email address of your account. Under their business terms, neither provider uses data from its API to train its models. Processing may take place in the USA (EU-US Data Privacy Framework or standard contractual clauses).
Legal basis: contract (Art. 6(1)(b) GDPR); our customers' content is covered by the data processing agreement. Our AI notice explains what is AI-generated.
9. Publishing via Buffer
Posts are published through your own Buffer account (Buffer Inc., USA), which you connect to Postaro. We send Buffer the approved post texts, the image or video address, the selected channels and the time; Buffer passes them on to Instagram, Facebook or TikTok. Buffer's and the platforms' own terms and privacy policies apply; the Buffer account is your contract with Buffer.
So that Buffer and the platforms can fetch graphics and reels, these files can be accessed without sign-in under a random address that cannot be guessed.
10. Images, videos, music, fonts
- Stock videos: for reels we search Pixabay (Pixabay GmbH, Berlin) with English keywords. No personal data is sent; the videos are downloaded to our server and used from there.
- Music: background music comes from our own licensed library or from your own library.
- Fonts: our public pages use fonts from our own server. In the live preview of the design studio in the portal, your browser loads the fonts of the selected template directly from Google Fonts (Google Ireland Limited, Dublin, Ireland); your IP address is transmitted to Google. Legal basis: contract (Art. 6(1)(b) GDPR) – you see the preview as the graphic will look.
11. Agencies and partner programme
Agencies: for agency accounts we process name, email address, role and password check value of the team members, the booked plan and which clients they manage. An agency's clients can approve posts or request changes via personal links; we store this feedback with the post. The agency is responsible towards its clients.
Partner programme: if you arrive via a partner's referral link (address /r/…), we store a cookie with the partner code for 90 days so that we can attribute a later sign-up to the partner and pay the commission. For partners we store name, email address and the commission statement. Legal basis: legitimate interest in billing (Art. 6(1)(f) GDPR) or the contract with the partner (Art. 6(1)(b)).
12. Cookies
We do not use analytics, advertising or tracking cookies. Postaro only sets its own cookies that are needed for the respective function:
| Name | Purpose | Duration |
|---|---|---|
| ap | sign-in to the customer portal | 60 days |
| ag, ak | sign-in to the agency area, selected client | 30 / 60 days |
| ap_lang | selected language | 1 year |
| ap_bo | connecting Buffer (protection against forged requests) | 15 minutes |
| ap_partner | partner code, only after opening a referral link | 90 days |
The portal app (home screen) stores an offline page in the browser cache. Legal basis: § 165(3) Austrian Telecommunications Act 2021 and Art. 6(1)(b) or (f) GDPR.
13. Backups
Postaro's database and files are backed up every night: to a computer of the operator in Austria (14 daily versions, then overwritten) and – encrypted only, without the provider being able to read them – the latest version at Dropbox (Dropbox International Unlimited Company, Dublin, Ireland). Legal basis: legitimate interest in data security (Art. 6(1)(f), Art. 32 GDPR).
14. Recipients and third countries
| Recipient | Purpose | Location |
|---|---|---|
| Hostinger International Ltd. | server (data centre) | Frankfurt, Germany |
| Anthropic | AI for texts, checks, image descriptions | USA |
| OpenAI | AI images, voice-over, fallback text model | Ireland/USA |
| Stripe Payments Europe, Limited | payment | Ireland/USA |
| easyname GmbH | sending emails | Austria |
| Buffer Inc. | publishing (your own account) | USA |
| Google Ireland Limited | fonts in the design preview (portal only) | Ireland/USA |
| Dropbox International Unlimited Company | encrypted backup | Ireland/USA |
For transfers to the USA we rely on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, otherwise on the European Commission's standard contractual clauses (Art. 46 GDPR). We do not sell data.
15. Retention
- Account and content: for the term of the contract. After the contract ends we delete them immediately on request, otherwise no later than 90 days after the end; backups are overwritten within a further 14 days.
- Invoices and accounting records: 7 years (§ 132 Austrian Federal Fiscal Code, BAO).
- Preview (demo): share link 90 days, data deleted at any time on request.
- Check values against password attacks: 2 days after the last failed attempt.
- Proof of acceptance of the terms/DPA: for the term of the contract and afterwards until the limitation periods expire.
16. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Just write to support@postaro.at. How to request the deletion of your data (also after connecting Facebook or Instagram) is explained under Delete your data.
You can lodge a complaint with a supervisory authority; in Austria this is the Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.
There is no automated decision-making with legal effect on you (Art. 22 GDPR). Providing your data is necessary to sign up for and use Postaro; without it we cannot provide the service.
This English version is provided for convenience. The German version is authoritative.