Postproxy

GDPR overview

Implementation is concrete rather than declarative. Postproxy is operated from the European Union by 64Bit Labs UG (haftungsbeschränkt) in Berlin, named explicitly as data controller, and processing is placed under the GDPR together with German law (BDSG, TTDSG). The privacy policy, last updated 24 June 2026, sets out legal bases article by article — contract Art. 6(1)(b), legitimate interest Art. 6(1)(f), consent Art. 6(1)(a), legal obligation Art. 6(1)(c) — and lists data subject rights from Art. 15 to Art. 21 plus withdrawal under Art. 7(3), exercised at privacy@postproxy.dev. A Data Processing Agreement is available on request. Transfers outside the EU rely on Standard Contractual Clauses or adequacy decisions. No DPO and no Article 27 representative are named, which is consistent for an EU-established company. SOC 2 Type II is only in progress, not obtained.

Who owns the data?

Under the Terms & Conditions, customers keep ownership of every piece of content they publish through Postproxy. The vendor receives only a limited right to process that content for the sole purpose of operating the service, does not pre-moderate it and accepts no responsibility for it; customers remain responsible for their own backups. For personal data, 64Bit Labs UG acts as processor or subprocessor while the customer stays the controller and must hold the necessary rights, legal basis and authorisations. The company states that it does not sell personal data, and reserves only anonymised, aggregated usage data to improve the service.

Reuse rights

The end user keeps full control of their own content and needs no permission from Postproxy to reuse, repurpose or republish it elsewhere, because ownership never transfers. The licence granted to the vendor is deliberately narrow: processing strictly limited to operating the service, which means publishing to the networks the customer instructs, relaying comments, direct messages and reviews, and returning insights. Beyond that, the company reserves only anonymised and aggregated usage data for product improvement. Data reached through connected social accounts is limited to what each feature requires, and the vendor states it does not access unrelated account data. Content published onward remains governed by each network's own terms, which the customer also accepts.

Data retention & training

Hosting summary

The vendor states that all data is stored and processed on European servers, describing its platform as clustered EU infrastructure with multiple server locations, and presents this as a sovereignty and compliance argument. Jurisdiction is unambiguous: the controller is 64Bit Labs UG (haftungsbeschränkt), based at Kolonnenstr. 8, 10827 Berlin, Germany, the terms specify that German law applies with jurisdiction in Berlin, and the privacy policy invokes the GDPR alongside the German BDSG and TTDSG. Beyond the regional claim, however, no hosting country, technical region or infrastructure provider is ever named. Some service providers may sit outside the EU or EEA, in which case the vendor relies on Standard Contractual Clauses or adequacy decisions; no subprocessor is listed by name and the public trust centre shows none. Note that the domain's resolved public IP is a Cloudflare anycast node geolocated in the United States, which reflects the CDN edge in front of the service rather than where application data lives. Anyone with a data residency requirement should ask for the specific hosting country in writing.