Privacy policy

1. Controller and contact

The service controller is PostisPop, a digital project operated from Spain. For any privacy questions or to exercise your rights, you can write to postispop@gmail.com. This policy applies to postispop.com, its account features and its associated applications.

2. Data we process

• Account data: email address, display name and, if you sign in with Google, the profile image provided by Google.
• Content you choose to save: boards, notes, titles, drawings, embedded images and data needed to share or collaborate.
• Technical and security data: session identifiers, access logs, IP address, browser, device, language, date and time, and incidents needed to prevent abuse and maintain the service.
• Communications: messages you send to support and transactional emails, such as account confirmation or access recovery.
• Payments, if enabled: transaction status and purchase reference. Full card details are processed by the payment provider, not by PostisPop.

3. Data from Google

If you choose “Continue with Google”, PostisPop only requests the basic permissions openid, email and profile. This allows us to authenticate you, link your account and display your name and, when available, your profile photo. PostisPop does not request access to Gmail, Google Drive, contacts, calendar or other content in your Google account.

Data received from Google is used exclusively to create and protect your session and provide PostisPop features. It is not sold, used for personalized advertising or shared with third parties except for the technical providers described in this policy or where legally required. The use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

4. Purposes and legal bases

• Creating and managing your account, authenticating you and providing the requested service: performance of the terms of use.
• Saving, syncing and sharing the boards you choose: performance of the service and actions you request.
• Sending essential security, confirmation and support emails: performance of the service and a legitimate interest in keeping accounts secure.
• Preventing fraud, abuse and unauthorized access, and resolving incidents: legitimate interest and, where applicable, legal compliance.
• Sending optional communications or using nonessential technologies: only with your consent, which you may withdraw.

5. Providers and recipients

To operate PostisPop, we may use providers that process data under our instructions: Supabase for authentication, database and storage; Google for OAuth sign-in when you choose it; Resend for transactional emails; Cloudflare and hosting infrastructure for delivery, security and availability; and, if purchases are enabled, a payment provider such as Stripe. We may also disclose data when required by a competent authority or when necessary to establish, exercise or defend legal claims.

6. International transfers

Some providers may process information outside the European Economic Area. In those cases, the safeguards required by applicable rules are used, such as adequacy decisions, standard contractual clauses or other valid mechanisms, together with appropriate technical and organizational measures.

7. Retention

We retain data while your account remains active and for as long as necessary to provide the service. Security logs are kept for limited periods, and legal obligations may require certain data to be retained for longer. Deleted notes may temporarily remain in the trash or in backups before permanent deletion. When you request erasure, we will delete or anonymize the data unless we must retain it to comply with a legal obligation or defend legal claims.

8. Your rights

You may request access, rectification, erasure, objection, restriction of processing and portability; you may also withdraw consent without affecting earlier processing. Write to us at postispop@gmail.com with your request. We may ask for reasonable information to verify your identity. If you believe we have not properly addressed your rights, you may complain to the Spanish Data Protection Agency.

9. Security, minors and automated decisions

We apply access controls, encryption in transit and measures intended to protect information, although no system connected to the Internet can guarantee absolute security. The service is not directed at children under 14; if we identify an account created without the required authorization, we may delete it. We do not make decisions with legal effects based solely on automated profiling.

10. Control of your account and changes

You can sign out from the home page. To delete your account or revoke its link with Google, contact postispop@gmail.com; you can also withdraw access in your Google account's security settings. We may update this policy to reflect changes to the service or applicable rules. The current version will always be available at this URL and, if a change is significant, we will communicate it appropriately.