Privacy policy

Last updated: 17/07/2026

Postloop takes the protection of your personal data seriously. This policy explains what data we process, why, and what rights you have, in accordance with the General Data Protection Regulation (GDPR).

1. Data controller

Mohamed Bouchiba, an individual trading under the business name “Postloop”, 75 avenue Mutsaard, 1020 Brussels, Belgium — contact: contact@postloop.online.

2. Data we collect

• Account: email address, password (encrypted).
• Content: ideas, drafts, posts and media you create.
• Connected social accounts: access tokens and profile details needed to publish, via our publishing partner.
• Usage data: performance stats of your posts, technical logs.

3. Purposes

• Provide and operate the service (create, schedule and publish content).
• Measure the performance of your posts and give you analytics.
• Ensure security, prevent fraud, and meet our legal obligations.

4. Legal basis

Performance of the contract (providing the service), your consent (connecting social accounts), and our legitimate interest (security, service improvement).

5. Recipients and processors

Your data may be processed by technical providers acting on our behalf:

• Supabase — database and authentication (European Union, AWS region eu-west-1).
• Railway — application hosting (United States / European Union).
• Cloudflare — media delivery and storage (global network; R2 data hosted in the European Union).
• Resend — sending and receiving email (United States).
• Stripe (Stripe Payments Europe, Ltd.) — payment processing (European Union, Ireland); data concerned: email address and payment details, the latter entered directly on Stripe’s payment pages.
• Zernio (Zernio Software SL) — publishing to your connected social networks (European Union, Spain).
• Groq — audio transcription (United States).
• OpenRouter and the model providers it federates — AI text generation (United States).
• ElevenLabs — voice synthesis and subtitles (United States).
• Sentry — error telemetry (hosted in the European Union, Frankfurt).
• PostHog — product analytics, subject to your consent: page views, milestones reached inside the application, and a recording of your journey on screen, tied to your account identifier. Input fields and the content you write are masked at the source: none of your text, ideas or messages are sent to it. Hosted in the European Union.
• Google Analytics — audience measurement across the site, subject to your consent: page views and referral source. Its tag is loaded directly by our pages, with no intermediate tag manager. None of the content you write, no account data, and none of your session tokens — the address sent is stripped of anything that could carry one. Operated by Google, in the United States.

Where data is transferred outside the European Union, those transfers rely on the European Commission's standard contractual clauses.

6. Retention

Your data is kept for as long as your account is in use. If you delete your account, your data is erased within 30 days (technical backups are purged thereafter), unless a legal obligation requires otherwise.

7. Your rights

You have the right to access, rectify, erase, restrict, port and object. To exercise them: contact@postloop.online.

As the data controller is established in Brussels, the competent supervisory authority is the Belgian Data Protection Authority (APD/GBA), rue de la Presse 35, 1000 Brussels — autoriteprotectiondonnees.be. You may lodge a complaint with it; you may also lodge a complaint with the supervisory authority of the Member State where you habitually reside or work.

8. Cookies

Postloop uses no advertising cookies and performs no cross-site tracking. Local storage strictly necessary for the service to work (authentication session, interface preferences) is exempt from consent collection.

The service measures its own audience with PostHog, hosted in the European Union: page views, milestones reached inside the application, and a recording of your journey on screen (pages visited, elements hovered and clicked). This measurement is used solely to understand where users run into difficulty; it is never sold, shared, or combined with other sites.

The site additionally measures its traffic with Google Analytics, to learn which messages hold attention and which pages get read. That service is operated in the United States: the transfer relies on the European Commission's standard contractual clauses. It receives no account data and no content, and it only starts once you agree. A single agreement covers the whole site: you are not asked twice.

It only starts once you agree. A banner asks you on your first visit: until you answer, or if you decline, no analytics cookie is set and no data is sent. Declining takes nothing away from the service. Input fields and writing areas are masked at the source in the recording: what you type is never captured.

To change your mind, clear site data for postloop.online in your browser and the banner will ask again. You can also write to us at contact@postloop.online.

9. Contact

For any question about your data: contact@postloop.online.