Privacy Policy
Data controller
[Name / company, address]
Email: mail@fallerino.de
What data we process
MyPostcards only processes what's needed to create, print, and pay for your postcards. Here's every category, one by one:
Photos you upload — When you upload a photo, it's sent to OpenAI for image analysis (subject, colors, keywords) and to generate the decorative stamp. Your original photo is never altered or redrawn by AI — only the stamp is newly created. We don't store the original photo itself permanently; only the finished, composed postcard is stored.
Location and time data (EXIF/GPS) — If your photo carries GPS coordinates, they're read directly in your browser and sent through our server to OpenStreetMap Nominatim to resolve a place name — your own IP address is never passed on to Nominatim. Coordinates and the capture date are stored with the postcard and used for the Map view in your gallery. If you type the location or date in by hand instead, no coordinates are stored.
Account data — Email address and password (processed via Supabase Auth) for registration and sign-in. Signing in with Google gives us only your email address from Google; any other profile data Google provides isn't stored or used by us. We also store your language preference (English/German) so emails and the site show up in the right language.
Postcards you create — The finished postcard, an optional stamp export, and an optional back side are stored in Supabase Storage and shown in your gallery, linked to your account, until you delete them. A back side can carry a message you wrote and a recipient's address — both get baked directly into the card image (see "When you enter someone else's data" below).
Public links — Turning on a postcard's public link makes its front, back, location, date, and card number visible to anyone with the link — no account needed. You can turn it off again at any time. Such links may auto-preview with an image in messaging apps and social networks.
Credits & payments — Credit purchases and print orders are processed through Stripe; you enter your payment details (like a card number) directly with Stripe, and they never reach our servers. We pass your email address and an internal order/account identifier to Stripe for this. Our database keeps a list of your credit transactions (purchase, spend, refund, referral bonus).
Real printing & mailing — Ordering a postcard as a real printed copy sends the recipient's name and postal address, along with the print artwork, to our print and fulfillment partner Prodigi (production currently in Venlo, Netherlands; shipping within the EU and UK only). We store this recipient data separately from any address typed onto the card itself.
Referral program — Using your personal referral link, we record which account referred you so the credit can be attributed. Other users only ever see an aggregate count of your referrals, never which accounts they are.
Marketing emails — We only send you occasional emails about new features if you explicitly opt in at sign-up or in your account. You can unsubscribe at any time via a link in the email or in your account. Transactional emails (like "your postcard is ready") continue regardless, for as long as you use your account.
Cookies & local storage — We use only strictly necessary cookies: one for your sign-in session (Supabase) and one for your language choice. Your browser also stores a running postcard number locally (localStorage) — that value never leaves your device. We use no analytics, tracking, or advertising cookies, and embed no third-party scripts for that purpose.
When you enter someone else's data
If you enter another person's name, address, or a message for them — to mail them a printed postcard or share a public link, for example — you're responsible for making sure that information is accurate and that the person has agreed to this use of their data.
Services we use
OpenAI (USA) — image analysis and generating the stamp from your photo. Supabase — accounts, database, and file storage. Stripe — payment processing for credit and print purchases. Resend — sending transactional emails and, with your consent, marketing emails. Prodigi (UK/Netherlands) — printing and mailing real postcards. Google — signing in with a Google account, if used. OpenStreetMap Nominatim — resolving place names from GPS coordinates. Vercel — hosting this website.
Legal basis
Depending on the purpose, processing relies on Art. 6(1)(b) GDPR (performance of a contract — your account, creating postcards, printing & mailing, payment processing), Art. 6(1)(a) GDPR (consent — marketing emails), and Art. 6(1)(f) GDPR (legitimate interest — abuse and fraud prevention for the referral program).
[Not yet given a final legal review.]
International data transfers
Some of the services listed above (e.g. OpenAI, Google) process data outside the EU/EEA, including in the US. Such transfers are generally intended to rely on appropriate safeguards such as the EU Standard Contractual Clauses.
[Not yet reviewed in detail — replace with the actual safeguards each service has in place before launch.]
Retention period
Postcards, account data, and your credit transaction history remain stored until you delete them individually or have your account deleted; deleting your account also removes your stored postcards, credit history, and print orders. Data held by third parties (e.g. payment records at Stripe, order data at Prodigi, send logs at Resend) follows their own retention periods and isn't automatically deleted when you delete your account with us.
Your rights
You have the right to access, rectify, erase, and restrict the processing of your data, the right to data portability, and the right to object to processing — including, at any time and without giving a reason, to receiving marketing emails. Contact us at mail@fallerino.de for any of this. You also have the right to lodge a complaint with a data protection supervisory authority.
Changes to this policy
We update this privacy policy whenever how we process your data changes, for example through new features. The current version is always available on this page.