Privacy policy

Article 1. Controller

The controller is PostShip's publisher: Thibault Morretton EI, sole trader, 19 route de Lyon, 42400 Saint-Chamond, France, RCS Saint-Étienne 130 466 931. Full details are in the legal notice.

The publisher has not appointed a data protection officer, as it is not required to. For any question about your data: contact@postship.fr, subject "Personal data".

Article 2. Scope

This policy covers the postship.fr site, the application, the service's emails, the API and the command-line program. It concerns people who visit the site, create an account, subscribe to news or write to the publisher.

It does not cover the sites our customers monitor, nor the data PostShip processes on behalf of its customers: that is described in article 9, and falls under the privacy policy of the customer concerned.

Article 3. Data processed

Checks only cover the addresses you configure: PostShip does not crawl your site beyond them, and keeps no page body.

Article 4. Purposes and legal bases

No data is used for advertising, commercial profiling or automated decisions producing a legal effect on you.

Article 5. Retention

Backups are used only to restore the service after an incident. Deleted data disappears from the daily backups after seven days; it is never extracted from a backup for any other use, and if a backup ever had to be restored, deletions made since its date would be applied again.

Article 6. Recipients and processors

Your data is accessible only to the publisher and, for what concerns them, to the following processors, bound by a contract compliant with article 28 of the GDPR. No data is sold to third parties.

The publisher may also disclose data to an authority that requests it under the law.

Article 7. Transfers outside the European Union

Some processors listed in article 6 may process data in the United States. These transfers are covered by the standard contractual clauses adopted by the European Commission and, where the provider participates, by the EU–US Data Privacy Framework, found adequate by the Commission's decision of 10 July 2023. A copy of the applicable safeguards can be obtained at contact@postship.fr.

Article 8. Server log and abuse prevention

Like any web server, PostShip's records each request: the IP address, the date, the page requested, the referring page and the browser, as announced by the User-Agent header. This log stays on our server, in Paris; no geolocation service is involved, and it is not linked to any account.

• Legal basis: legitimate interest (article 6.1.f of the GDPR) in keeping the service secure and preventing fraud and abuse, a purpose recital 49 of the GDPR expressly recognises. This data is used neither for advertising, nor profiling, nor resale.
• What is not collected: no browser fingerprint (canvas, WebGL, fonts), no cross-site identifier, no advertising tracker. These techniques would require your consent and serve no security need.
• Retention: the log is erased automatically after 90 days at most.
• Objection: you may object to this processing on grounds relating to your particular situation (article 21 of the GDPR), by writing to contact@postship.fr.

Rate limits — the number of sign-in codes, trials or terminal sign-in requests per hour — rely on counters per IP address, erased after two days.

Article 9. Data processed on behalf of our customers

For some features, PostShip processes data on behalf of a customer, who is the controller; PostShip is then their processor, under article 8.2 of the Terms.

• Status page subscribers: the email address of a person who subscribes to a status page's updates, confirmed by a link before anything is sent, and removed with the unsubscribe link in every message.
• Real-user monitoring: when a customer enables it on their site, their visitors' browsers send the page's address, speed measurements and, where applicable, the page's error messages. The IP address is only used for anti-abuse counters.
• Screenshots: monitored pages are captured as a visitor sees them; they may show data a customer publishes there.

If you are affected by any of this processing, first contact the customer whose site or status page you are visiting. The publisher forwards to the customer any request it receives about it.

Article 10. Cookies and trackers

PostShip sets a session cookie after sign-in, remembers your display choices and, only if you accept it, measures its audience. Each item — name, purpose, duration, legal basis — and the way to change your mind are on the Cookies page.

Article 11. Your rights

You have the following rights over your data:

11.1Exercising them yourself

• Export your data: Account → Summary → Your data → Export.
• Correct your profile: Account → Profile.
• Delete your account: Account → Danger; deletion is immediate and irreversible.
• Unsubscribe from an optional email: the link at the bottom of every email.

11.2Exercising them in writing

For any other request, write to contact@postship.fr, subject "Personal data". You get an answer within one month, which may be extended by two months for a complex request; you are told if so. If there is reasonable doubt about your identity, additional information may be requested — never an identity document when your account's address is enough.

11.3Complaint

If you believe your rights are not respected, you can lodge a complaint with the French data protection authority (CNIL), at cnil.fr.

Article 12. Security

The publisher applies technical and organisational measures appropriate to the risk:

• encryption of every connection (HTTPS), including between the server and the database;
• access to data restricted within the database itself, account by account, by row-level security rules;
• passwordless sign-in, by one-time code or passkey, with two-factor authentication that a workspace owner can require;
• API keys kept as hashes, revocable at any time;
• protection against requests diverted to internal networks during checks;
• nightly backup, weekly copy off the machine, restore tests;
• administrative access reserved to the publisher, and logged.

If a data breach poses a risk to your rights, the publisher notifies the CNIL within 72 hours of becoming aware of it and, if the risk is high, tells you directly, in accordance with articles 33 and 34 of the GDPR.

Article 13. Minors

The service is intended for professionals and adults. It is not aimed at children under fifteen, and the publisher does not knowingly collect their data.

Article 14. Changes

This policy may be updated to follow changes to the service or the law. Any substantial change is notified to you by email and presented at your next sign-in; the date of the version in force is at the top of the page. Only the French version is authoritative.