PostSyncer

GDPR overview

Compliance is claimed rather than documented. The only GDPR statement anywhere on the site sits in the homepage FAQ, which says PostSyncer is fully GDPR compliant and undergoes regular security audits. The privacy policy itself, effective 25 February 2025, never uses the word GDPR, cites no legal basis and no article. There is no Data Processing Agreement, no Article 27 EU representative, no data protection officer, no subprocessor list and no stated retention period. International transfers are announced without naming a transfer mechanism or a destination country. The policy does enumerate data subject rights, namely access, rectification, erasure, marketing opt-out, withdrawal of platform permissions and data export, but sets out no procedure and no deadline, and the only contact address published on the site is a general support mailbox. Google API Limited Use requirements, by contrast, are spelled out precisely.

Who owns the data?

The terms are explicit about ownership. You keep every right to the content you publish through the service, and PostSyncer states it claims no ownership over what its AI generates; the company retains only its own software, code, trademarks and documentation. What it holds about you is broader: OAuth access tokens for each connected account, profile data, published posts, analytics and audience insights, plus billing and usage data. Credentials are encrypted with AES-256-CBC and MAC-signed, and social passwords are never stored. Data may be shared with service providers and partners, with the connected platforms, with law enforcement on legal request, and with other parties only on your explicit consent.

Reuse rights

Yes, and without asking. The terms grant commercial usage rights over everything the AI produces: images, videos, captions and other visuals may be published, monetised and distributed across social platforms, in advertising and in client projects, with no additional attribution and no prior permission. Content you upload yourself remains yours throughout, and the privacy policy gives you the right to export your data. Two limits survive. You must still comply with the rules of each connected network, which the terms restate at length for Facebook, Instagram, YouTube, TikTok, X and LinkedIn, and you remain fully responsible for what you post, including a warranty that it infringes nobody else's rights.

Data retention & training

Hosting summary

The site publishes nothing about where data physically lives. No hosting provider, no country and no region is named anywhere in the privacy policy, the terms or the product pages, and the policy limits itself to saying data may be transferred internationally with appropriate safeguards in place, without identifying the mechanism or the destination. What is defined is the contractual jurisdiction: the terms are governed by the law of the State of Delaware with exclusive jurisdiction of Delaware courts, and the company's published address is in Dover, Delaware. Security measures are documented in more detail than location: encryption in transit and at rest, OAuth access tokens encrypted with AES-256-CBC and MAC-signed through OpenSSL, access controls limited to authorised personnel, regular security assessments and threat monitoring. No subprocessor list is published, although the terms name OpenAI and Google as AI infrastructure providers in an explicitly non-exhaustive way. There is no Data Processing Agreement and no SOC 2 or ISO 27001 certification on the site.