Privacy Policy
Last updated:
Postamory is a subscription service in which families share photos and short texts during the month and receive a printed family magazine. This policy explains how personal data is processed when you visit our website, create an account or use the service. It contains the information required by Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) and the information notice required by Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK).
1. Who is responsible
The controller (data controller under the GDPR, "veri sorumlusu" under the KVKK) is Postamory, Heidelberg. You can reach us for every privacy matter at i116@pm.me. The legal notice contains further details about the operator. We are established in Germany.
Where a family member uploads photos or texts that show or concern other people, that member decides what is shared with the family. We process this content only to provide the service to the family as described below.
2. What data we process
- Account data: name, e-mail address, language and your password (stored only as a hash by our authentication provider).
- Profile photo (optional) and the display name you chose. The display names of the family members who contributed to an issue are printed on the back cover of the printed magazine of your family; the profile photo is not printed.
- Family data: family name, the members of the family, the recipient's name and postal address for the magazine, time zone and the dedication message.
- Content: photos (which may show children and other family members), captions and short texts, emoji reactions, and the magazine PDFs and page layouts created from them. Photos are prepared in your browser before upload so that camera metadata such as the location (GPS) is not transmitted.
- Subscription and payment data: chosen plan and billing interval, payment provider references, amounts, dates and status. We do not receive or store card numbers; card data is entered with and processed by Stripe.
- Invitations, support and feedback messages you send us, and the e-mails we send you (type, time, delivery status).
- Technical and security data: audit records of important actions, login-attempt counters (e-mail address and IP address) used against abuse, server logs and the technical data your browser sends (IP address, browser type, requested page, time).
Most of this data comes from you or from members of your family. Provider references and delivery status come from our service providers.
3. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR / KVKK) |
|---|---|---|
| Creating and running your account and your family space | Account, family data, content | Performance of a contract, Art. 6(1)(b) GDPR / KVKK Art. 5(2)(c) |
| Producing, printing and delivering the family magazine | Family data, recipient address, content, magazine files | Performance of a contract, Art. 6(1)(b) GDPR / KVKK Art. 5(2)(c) |
| Subscription, billing and payment handling | Plan, payment references, amounts, status | Performance of a contract; legal obligation (accounting and tax), Art. 6(1)(b), (c) GDPR / KVKK Art. 5(2)(c), (a) |
| Naming the family members who contributed to an issue on the back cover of the family magazine: your display name | Display name | Performance of a contract, Art. 6(1)(b) GDPR / KVKK Art. 5(2)(c), and legitimate interest in a magazine that names the family it was made for, Art. 6(1)(f) GDPR / KVKK Art. 5(2)(f). You can change your display name at any time (Settings); this applies to all future issues |
| Sending service e-mails (confirmation, invitations, password reset, payment notices) | Account data, e-mail log | Performance of a contract, Art. 6(1)(b) GDPR / KVKK Art. 5(2)(c) |
| Security, abuse protection (login limits, bot protection), fraud prevention, audit records | Login-attempt counters, IP address, audit and technical logs | Legitimate interest, Art. 6(1)(f) GDPR / KVKK Art. 5(2)(f) |
| Measuring page performance and use of the website without personal identifiers | Aggregated, cookie-less analytics data | Legitimate interest, Art. 6(1)(f) GDPR / KVKK Art. 5(2)(f) |
| Answering your requests and support messages | Contact data, message content | Performance of a contract or legitimate interest, Art. 6(1)(b), (f) GDPR / KVKK Art. 5(2)(c), (f) |
| Photos of children and other third parties shared by family members | Photos, captions | Towards the uploading member: performance of the contract (Art. 6(1)(b) GDPR / KVKK Art. 5(2)(c)); towards the people shown: legitimate interest in providing the service (Art. 6(1)(f) GDPR / KVKK Art. 5(2)(f)) and, where required, consent of the persons concerned or, for children, of their parents or guardians (Art. 6(1)(a), Art. 8 GDPR / KVKK Art. 5(1)), obtained by the member who shares the content; see section 11 |
| Meeting legal obligations and defending legal claims | Invoices, payment records, correspondence | Legal obligation and legitimate interest, Art. 6(1)(c), (f) GDPR / KVKK Art. 5(2)(a), (ç), (e) |
Providing an account and the magazine is not possible without the data marked as necessary in the forms. If you do not provide it, we cannot offer you the service.
4. Who receives your data
We do not sell personal data and we do not use it for advertising. We share it only with the following recipients, who act as processors on our behalf unless stated otherwise, or with authorities where the law requires it. We have contracts under Art. 28 GDPR with our processors.
| Recipient | Role | Data concerned |
|---|---|---|
| Supabase | Account authentication, database and file storage (photos, magazine PDFs) | Account data, family data, content, logs |
| Vercel | Hosting and delivery of the website; cookie-less Web Analytics and Speed Insights | Technical request data (e.g. IP address), aggregated usage and performance data |
| Stripe | Payment processing and subscription billing. Stripe processes card data itself and is, for some processing, an independent controller | Name, e-mail, plan, amount, payment data entered at Stripe |
| Resend | Sending service e-mails | E-mail address, name, e-mail content |
| Cloudflare (Turnstile) | Bot protection on sign-up and login forms | IP address and browser signals needed to tell humans from bots |
| Our print and delivery partners | Printing the magazine and delivering it by post | Recipient name and postal address, magazine file |
| Authorities, courts, advisers | Where required by law or to establish, exercise or defend legal claims | Only the data required in the individual case |
Members of your family can see the content and the family data of that family; this is the purpose of the service. A member who is removed from a family loses access to that family.
The optional newspaper-style writing help runs on our own server using fixed rules by default; the text is not sent to any third party. Only if we deliberately switch on an external provider (Anthropic) will the text you submit with that button, and nothing else, be sent to it, and the app then says so next to the button.
5. Transfers to third countries
Some of our providers (for example Vercel, Stripe, Resend and Cloudflare) may process data outside the European Economic Area or outside Turkey, in particular in the United States. Where this happens we rely on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework for certified providers) or on the standard contractual clauses of the European Commission together with additional safeguards where necessary. For transfers from Turkey we use the mechanisms offered by Article 9 KVKK. You can request a copy of the safeguards by writing to i116@pm.me. A transfer takes place only if the requirements of Art. 44 et seq. GDPR are met.
6. How long we keep data
| Data | Retention |
|---|---|
| Account data | As long as the account exists. After you ask us to delete the account, we delete it within 30 days, except data we must keep by law. |
| Photos, captions, texts and reactions | As long as the family space exists. A post deleted by a member is removed from view immediately and permanently deleted within 30 days. |
| Profile photo | Until you remove it or delete the account. Removing it applies to future issues; a magazine that was already produced or printed keeps what was printed in it. |
| Magazine PDFs and page layouts | As long as the family space exists, so the family can access past issues. |
| Invoices and payment records | As long as tax and commercial law require (in Germany, depending on the document, six to ten years; in Turkey generally up to ten years). |
| Recipient address | As long as the family space exists; changes replace the previous address. |
| Support and feedback messages | Until the request is resolved and for up to 24 months afterwards. |
| E-mail logs and audit records | Up to 24 months. |
| Login-attempt counters and server logs | Short-lived: counters expire within hours or days; server logs are kept for a few weeks. |
Data we must keep by law is blocked from other use and deleted when the retention duty ends. Backups of our database provider are overwritten in their regular cycle.
7. Your rights
Under Articles 15 to 21 GDPR and Article 11 KVKK you have the right to:
- learn whether we process your data and receive a copy and further information (access);
- have inaccurate or incomplete data corrected (rectification);
- have your data deleted or destroyed where the legal requirements are met (erasure);
- restrict processing in the cases the law provides;
- receive the data you provided in a structured, commonly used, machine-readable format and have it transmitted to another provider (data portability);
- object to processing based on legitimate interest, on grounds relating to your particular situation, and at any time to direct marketing (we do not send any);
- withdraw consent at any time with effect for the future, without affecting earlier processing;
- ask that corrections and deletions are notified to the recipients of your data, and object to a result against you that arises solely from automated analysis (we take no such decisions);
- claim compensation for damage caused by unlawful processing (KVKK).
To exercise your rights write to i116@pm.me from the e-mail address of your account or identify yourself otherwise, so that we do not hand data to the wrong person. We answer within 30 days, free of charge as a rule; we may charge a reasonable fee or refuse only for manifestly unfounded or excessive requests. At present such requests are handled personally by us by e-mail; there is no self-service export or deletion yet.
8. Right to lodge a complaint
You may complain to a supervisory authority. In the European Union this is the authority of your habitual residence, your place of work or the place of the alleged infringement (the list is published by the European Data Protection Board). In Turkey it is the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, KVKK). We would appreciate it if you contacted us first so we can resolve your concern. The authority competent for us is the data protection authority competent for the operator's seat (Art. 77 GDPR).
9. Security measures
- Encrypted transmission (HTTPS) between your device and our servers.
- Content, members and subscription data of a family are readable only by members of that family, enforced in the database by row-level access rules; photos are stored privately and delivered through short-lived signed links.
- Passwords are stored only as salted hashes; sign-up, login and password-reset forms are protected by rate limits and bot protection.
- Photos are re-encoded in your browser before upload, which removes camera metadata including GPS location.
- Staff access to family content is limited, separate and recorded in audit logs.
- Card data never touches our servers; it is handled by Stripe.
No system is completely secure. If a personal data breach is likely to put your rights at risk we will notify you and the competent authority as the law requires.
11. Children and photos of other people
Accounts are for adults. You must be at least 18 years old to create an account; we do not knowingly create accounts for younger people. Families often share photos of children. The member who uploads a photo is responsible for having the consent of the people shown or, for children, of their parents or guardians, and for sharing only photos that may be shared with the family. All photos are private to the family and are not published. If you are a parent and want a photo removed, write to i116@pm.me. For children under 16, the sharing member obtains the consent of the parents or guardians (Art. 8 GDPR).
12. Automated decisions
We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, and we do not profile you. The optional writing help only makes a suggestion that you can accept, edit or ignore. We do not use face recognition and do not analyse photos.
13. Notes for users and recipients in Türkiye (KVKK)
If you live in Türkiye or your magazine is delivered there, Postamory is also the data controller (veri sorumlusu) within the meaning of Law No. 6698 (KVKK). Purposes, legal bases (Art. 5 KVKK), recipients and retention are stated in the sections above, which fulfils the duty to inform under Art. 10 KVKK. We collect the data through the account, the forms and the members of the family, by automated means and partly by non-automated means through the website and app.
Because we and our service providers process data abroad, we transfer personal data abroad under Art. 9 KVKK: on the basis of an adequacy decision, appropriate safeguards (in particular standard contracts under the requirements of the Turkish data protection authority, or binding corporate rules) or, only where no other mechanism applies and only in the exceptional cases provided by law, on the basis of your separately given explicit consent after being informed, which you may withdraw at any time.
You can exercise your rights under Art. 11 KVKK by writing to i116@pm.me (proof of sender and identity as described above); we answer free of charge within 30 days at the latest. If your request is not answered or the answer is insufficient, you can turn to the Turkish data protection authority under Art. 14 KVKK.
14. Changes to this policy
We update this policy when the service, our providers or the law change. The date at the top shows the latest version. If a change significantly affects you, we will inform you in an appropriate way, for example by e-mail.