YourPoste — Privacy Policy

Last updated: 29 September 2026 · This version effective: 29 September 2026 · First published: 4 May 2026

Privacy policy, simply explained

We collect only what we need to run the service. We do not sell your data. We do not use it for third-party advertising. You can access, correct, or delete your data at any time. We comply with Regulation (EU) 2016/679 (GDPR), the Spanish Organic Law 3/2018 (LOPDGDD), and the ePrivacy Directive as implemented in Spain.

1. Who we are (data controller)

• Controller: POSTRAVELER, S.L.
• NIF: B-26947879
• Address: Calle Pintor Maella 11, 2º, puerta 8ª, 46023 Valencia, Spain
• Contact: contact@yourposte.com (please prefix data-protection requests with `[GDPR]` in the subject line)

Data Protection Officer: not appointed. We have assessed the criteria under Article 37 GDPR and Article 34 LOPDGDD and concluded that formal appointment is not mandatory at our current scale. If this changes, we will appoint one and notify the Agencia Española de Protección de Datos (AEPD).

2. What personal data we process

2.1 Data you provide

• Account: full name, email address, password (hashed with bcrypt / argon2)
• Profile: preferred language, profile photo (optional), biography ("about"), phone number (optional), referral code
• Orders: item description, pickup and delivery cities, dates, size and weight, proposed reward
• Trips: origin and destination cities, travel dates, capacity
• Offers: proposed reward, message to the sender
• Chat messages: text content exchanged with deal participants
• OTP codes: one-time delivery confirmation codes
• Reviews: ratings and written reviews about other users
• Support communications: messages and attachments sent to support
• Identity verification (optional): identity-document type and image, selfie image, status, rejection reason — reviewed manually by our administrators

2.2 Data collected automatically

• Device and technical: browser, operating system, screen size, app version
• Usage (first-party analytics): in-app events (for example whatsapp_share, whatsapp_contact, copy_share, facebook_share), timestamps
• Authentication: login timestamps, session tokens
• Error diagnostics: error messages, stack traces, URL, user-agent — throttled and deduplicated, used to detect and fix bugs
• IP address: stored in server logs; used for security, fraud prevention, and coarse geolocation
• Push notification tokens: OneSignal external-id + device tokens when you opt in to notifications
• AI chat assistant (website only, optional): if you start a chat with our assistant — the messages you type, the page you are on, your language and a random chat-session identifier
• Cookies and similar technologies: see Section 11 and our separate Cookie Policy

2.3 Data from third parties

• Google (OAuth, optional): name, email, Google ID, avatar, if you choose to sign in with Google
• App stores (Apple App Store, Google Play): app-install receipts and crash reports when available
• Other users: ratings and written reviews about you, reports concerning your conduct, messages addressed to you

2.4 Data of non-users from public sources (B2B outreach)

To identify business partners for professional outreach on the Spain ↔ Morocco corridor (restaurants, travel agents, transporters), we may process publicly available business contact information (generic business emails such as info@restaurant.com, posted telephone numbers, public-page contact links). This processing:

• Is limited to professional contact information that businesses have themselves made public
• Is used for one-time professional introductions under the B2B exception of LSSI-CE Article 21.2, with an opt-out in every message
• Does not involve targeting individual natural persons whose details are not publicly associated with a professional business role
• Is subject to the data-subject rights in Section 9; any person so contacted can ask us to erase their record by replying to the introduction email or writing to contact@yourposte.com

2.5 Data we do not process

We do not process special categories of personal data under Article 9 GDPR (health, religion, political opinions, biometric data for unique identification, etc.). Identity verification is performed by a human reviewer and does not involve automated facial comparison.

3. Purposes and legal bases

We process personal data under the following purposes and lawful bases (GDPR Article 6):

Withdrawing consent

Wherever consent is the basis, you can withdraw it at any time:

• Marketing emails: turn off in Settings → Emails → Marketing emails, or click Unsubscribe in any marketing email
• Cookies / trackers: click "Cookie settings" in the footer to reopen the banner
• Push notifications: turn off in Settings → Notifications
• Optional phone: remove it from your profile

Withdrawal does not affect the lawfulness of processing that took place before withdrawal.

Automated decision-making

We do not make decisions producing legal or similarly significant effects about you by solely automated means (GDPR Article 22). Proximity matching is a ranking aid; you remain in control of every offer, acceptance, and completion.

4. Recipients of your data

4.1 Other Platform users

• Senders see the traveler's display name, profile photo, rating, trip route, and dates
• Travelers see the sender's display name, profile photo, rating, order details, pickup and delivery cities
• Within a deal both parties exchange messages via the Platform chat

We never share your email, IP address, credentials, or phone number with other users unless you choose to disclose them yourself in chat.

4.2 Service providers (processors or independent controllers)

All processors are bound by data-processing agreements compliant with GDPR Article 28. You may request a copy of the applicable SCCs at contact@yourposte.com.

4.3 Administrators

Authorised YourPoste personnel may access chat and account data to investigate safety incidents, resolve disputes, prevent fraud, respond to legal requests, or enforce our Terms. Access is logged and restricted by role.

4.4 Authorities

We will disclose data to courts, police, customs, or tax authorities when required by law or to protect life or safety. We will notify you unless legally prohibited.

4.5 What we never do

• Sell your personal data
• Share your data with advertisers outside consented third-party trackers
• Use your data to profile you for third-party ad targeting beyond the consent you give in the cookie banner
• Provide your data to data brokers

5. International data transfers (GDPR Articles 44–49)

Your data is primarily stored in the EU (Frankfurt). Some processors above are established in the United States. For each transfer we rely on:

• EU Standard Contractual Clauses (European Commission Implementing Decision 2021/914), and
• EU-US Data Privacy Framework where the recipient is certified under it

The DPF remains in force at the time of writing. If it were to be invalidated by a court judgment, we would continue to rely on SCCs and apply additional safeguards. You may request details at contact@yourposte.com.

6. Retention

7. Security

Measures include:

• TLS 1.2+ encryption in transit
• Encryption at rest (AES-256 via Supabase / AWS)
• Row-Level Security — every database query is scoped to the authenticated user's permissions
• Secure session management via Supabase Auth with short-lived sessions and refresh rotation
• Passwords hashed with a modern algorithm (bcrypt / argon2); no plain-text storage
• Role-based access control for personnel with access logging
• Periodic security review against the OWASP Top 10
• Automated off-platform-contact redaction in push notification previews for pre-deal chat — phone numbers, emails, WhatsApp, Instagram, Telegram references are redacted before the push is sent, a privacy-by-design measure under GDPR Article 25
• No storage of sensitive user data in browser local / session storage beyond session tokens
• Documented incident response plan

No system is fully secure. If you suspect a security issue, email contact@yourposte.com with `[Security]` in the subject.

8. Personal data breaches (GDPR Articles 33–34)

If a breach occurs, we will:

• Assess risk to rights and freedoms within 24 hours of detection
• Notify the AEPD within 72 hours where the breach is likely to result in a risk
• Notify affected users without undue delay where the breach is likely to result in a high risk, including a plain-language description, likely consequences, mitigation steps, and our contact point

9. Your rights

You have the right to:

• Access a copy of your personal data (Art. 15)
• Rectification of inaccurate or incomplete data (Art. 16)
• Erasure ("right to be forgotten"), subject to our legal obligations (Art. 17)
• Restriction of processing (Art. 18)
• Data portability in a structured, commonly used, machine-readable format (Art. 20)
• Object to processing based on legitimate interests (Art. 21)
• Withdraw consent at any time, where processing is based on consent (Art. 7(3))
• Not be subject to solely automated decision-making with legal or similarly significant effects (Art. 22). We do not engage in such decision-making.
• Post-mortem rights: under LOPDGDD Article 3, persons connected to a deceased user may exercise rights on their behalf unless the deceased prohibited it.

How to exercise your rights

• Email contact@yourposte.com with `[GDPR]` in the subject line, from the address associated with your account; or
• Use in-app settings where available (e.g., delete account, toggle marketing emails, manage cookie preferences)

We may request reasonable identity verification if we have doubts about your identity. Exercising your rights is free of charge unless requests are manifestly unfounded or excessive.

We respond within one month. For complex or numerous requests we may extend this by up to two further months, informing you within the first month.

Complaints

If you are unsatisfied with our response, you may lodge a complaint with:

• The Agencia Española de Protección de Datos (AEPD) — <https://www.aepd.es> — C/ Jorge Juan 6, 28001 Madrid
• The supervisory authority of your EU / EEA country of residence

10. Account deletion

You may delete your account at any time from Settings or by emailing contact@yourposte.com.

On deletion:

• Your profile, orders, trips, offers, and push tokens are removed from the live database
• Chat messages are deleted within 30 days, except where retention is required for a dispute or legal obligation
• Reviews remain as "Former user" to preserve rating integrity
• Deal records are retained for up to 5 years for legal / tax purposes
• Backups are overwritten within 30 days
• Identity-verification files are deleted or destroyed in accordance with Section 6

11. Cookies and similar technologies

We use cookies, local storage, and similar technologies in three categories:

1. Strictly necessary (no consent required): Supabase authentication session, language preference, CSRF token, and the `yp_consent_v1` record of your cookie choice itself

2. Analytics and performance (consent required): first-party usage analytics written to our own database

3. Marketing (consent required): Facebook Pixel

Web push notifications (OneSignal) are not governed by the cookie banner: the script loads with the page but your browser is only registered for push — and only linked to your account — after you allow notifications in the browser's own permission prompt. See the Cookie Policy, section 4.3.

The AI chat assistant on the website (Awareto) belongs to the Analytics category: it is never loaded if you rejected Analytics cookies, and even after you accept them it only loads when you tap the chat button. It is never available while you are signed in, nor in the iOS / Android apps. See the Cookie Policy, section 4.2.

A cookie banner appears on first visit with equal-prominence Accept / Reject / Customize buttons, per the AEPD's 2024 guide on cookies. Nothing in the Analytics or Marketing categories is loaded before you make a choice. You can change your choice at any time via the "Cookie settings" link in the footer.

Full details in our separate Cookie Policy.

12. Marketing emails

With your signup you consent to receive service-related emails (welcome, onboarding, occasional product news). You can opt out at any time in three ways:

• Settings → Emails → Marketing emails toggle
• One-click Unsubscribe link in every marketing email's footer (RFC 8058), also exposed as the native "Unsubscribe" button in Gmail, Apple Mail, and Outlook
• Reply to any marketing email with "unsubscribe" or write to contact@yourposte.com

Opt-out applies within 24 hours at most. Deal-related notifications (offers, messages, OTP, pickup reminders) are transactional and are not affected by the marketing opt-out.

13. Identity verification

The Platform offers an optional identity-verification step where you can upload an identity document and a selfie. Review is performed manually by our administrators. We do not use automated biometric matching, which means the data is not processed as special-category biometric data under Article 9 GDPR.

Retention: see Section 6. You may request deletion at any time under your Article 17 right, subject to ongoing legal-defence needs.

14. Children

YourPoste is not intended for use by anyone under 18. We rely on account declarations at signup. Under Spanish law (LOPDGDD Article 7), the digital age of consent is 14, but the contractual eligibility threshold for YourPoste is 18. If you believe a minor is using the Platform, email contact@yourposte.com and we will investigate and delete the data.

15. Changes to this policy

Material changes will be communicated at least 30 days in advance by email or in-app notice. The "Last updated" line at the top of this page shows the most recent revision. Historical versions are available on request.

16. Contact

• Data protection: contact@yourposte.com (please include `[GDPR]` in the subject)
• General support: contact@yourposte.com
• Security reports: contact@yourposte.com (please include `[Security]` in the subject)

POSTRAVELER, S.L.

NIF: B-26947879

Calle Pintor Maella 11, 2º, puerta 8ª

46023 Valencia, Spain

17. Payout method data

If you receive payouts as a traveler, you can save your preferred payout method on your profile. We collect only the minimum data required to send the payment.

17.1 What we store

• Payout method choice: bank transfer or PayPal.
• Account holder name: the legal name on the receiving account.
• For bank transfers: IBAN and (optionally) BIC / SWIFT.
• For PayPal: the PayPal email address.
• Country (ISO-2) of the receiving account.
• The timestamp when the payout method was last set.

17.2 Where it is stored and who can read it

This data is stored in our managed database (Supabase) and is encrypted at rest. The full record is readable only by you (the account owner) and by YourPoste administrators acting in their operational role to operate the payouts feature and resolve disputes. Other users never see your full IBAN or PayPal email — internal admin views show masked values (e.g. `ES...1234`).

17.3 Legal basis

Performance of a contract (Art. 6(1)(b) GDPR) — to send you payouts owed under our Terms — and our legitimate interest in maintaining accurate records for accounting and dispute resolution.

17.4 Retention

We retain your payout method data for as long as your account is active. You can update it at any time on the My Earnings page. If you delete your method or your account, we remove the active record but may retain a record of past payouts (transaction reference, amount, date) for the legally required accounting period (up to 6 years under Spanish law).

17.5 Your rights

The standard GDPR rights described in section 9 apply — including access, rectification, erasure, and data portability. Email us at contact@yourposte.com to exercise them.

*YourPoste — Your data, your rights, our responsibility.*