Privacy

1. Introduction

Welcome to the privacy policy of trypia.app ("we", "us", "trypia"). This policy explains how we collect, use, and protect your personal data when you use our social media scheduling and cross-posting service (the "Service"). We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and other applicable German data protection laws.

2. Controller

The controller responsible for the processing of your personal data within the meaning of Art. 4(7) GDPR is:

[LEGAL_NAME]
[BUSINESS_ADDRESS]
Germany

Email: support@trypia.app

3. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent at any time, with effect for the future (Art. 7(3) GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR). You may contact the authority responsible for your place of residence, place of work, or the location of the alleged infringement. You can find your local authority via bfdi.bund.de.

To exercise any of these rights, contact us at support@trypia.app.

4. Hosting (Vercel)

We host the Service on infrastructure provided by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA ("Vercel"). When you access our website, Vercel processes technical data such as IP address, browser type, and access times in server log files to operate and secure the Service. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing a stable and secure service). Vercel may process data in the United States; we have entered into Standard Contractual Clauses (SCCs) with Vercel to ensure an adequate level of data protection.

5. Database & Authentication (Supabase)

We use Supabase, hosted on servers located in the European Union, as our database provider and for user authentication. Supabase stores your account data (e.g. email address, hashed password or OAuth identifiers, account settings) and application data related to your use of the Service. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Because our Supabase project is hosted within the EU, no transfer to a third country takes place for this processing.

6. Rate Limiting (Upstash)

To protect the Service against abuse (e.g. excessive requests, brute-force attempts), we use Upstash for rate limiting. Upstash processes technical identifiers, such as IP address or user ID, to enforce request limits. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security and stability of the Service). Where Upstash processes data outside the EU, we rely on Standard Contractual Clauses to ensure an adequate level of protection.

7. Email Communication (Resend)

We use Resend, Inc. to send transactional emails, such as account confirmations, password resets, and billing notifications. For this purpose, we share your email address and the relevant email content with Resend. Legal basis: Art. 6(1)(b) GDPR for transactional emails necessary to provide the Service. Resend is based in the United States; where data is transferred there, we rely on Standard Contractual Clauses.

8. Payment Processing (Stripe)

Payments are processed directly by Stripe, Inc. and/or Stripe Payments Europe, Ltd. When you subscribe to a paid plan, your payment data, such as card details and billing address, is transmitted directly to Stripe and processed according to Stripe's own privacy policy. We do not store full payment card details on our own servers. Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (compliance with legal and tax obligations, e.g. invoicing).

9. Social Media Posting (PostForMe)

The core function of our Service is to let you publish content to your connected social media accounts. To do this, we use PostForMe as a technical proxy. When you connect a social media account and create a post, the following data is transmitted to and stored by PostForMe: your social media account credentials and OAuth access tokens, and the content you upload, including text, images, and videos. PostForMe processes and stores this data on its own infrastructure to publish your posts to the respective platforms. Legal basis: Art. 6(1)(b) GDPR (performance of a contract — this is the core service you signed up for). PostForMe acts as an independent processor, and possibly joint controller, for this data; we recommend reviewing PostForMe's own privacy policy for details of their processing.

10. Cookies & Local Storage

We only use cookies that are strictly necessary for the operation of the Service, in particular authentication cookies set by Supabase Auth to keep you logged in. These essential cookies do not require your consent under § 25(2) TTDSG, as they are necessary to provide a service you explicitly requested. We do not use marketing, tracking, or third-party advertising cookies. Although not legally required for essential-only cookies, we display a cookie banner for transparency. You can control or delete cookies at any time through your browser settings.

11. Analytics (Vercel Analytics)

We use Vercel Analytics in its cookie-free configuration to understand aggregate usage of our website, such as page views and referrers. This tool does not set cookies and does not create individual visitor profiles; data is aggregated and anonymized. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding and improving the Service). No consent is required since no personal identifiers or cookies are used.

12. International Data Transfers

Some of our processors, including Vercel, Resend, Stripe, and potentially PostForMe and Upstash, are based outside the European Economic Area (EEA), in particular in the United States. Where personal data is transferred to such third countries, we ensure an adequate level of protection through appropriate safeguards, in particular the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where applicable, the processor's certification under the EU-U.S. Data Privacy Framework.

13. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy, or as required by law. Account data is deleted upon request, subject to statutory retention obligations under German commercial and tax law (§§ 257 HGB, 147 AO), which can require retaining invoicing data for six to ten years. Content shared with PostForMe is retained according to PostForMe's own retention policy.

14. Data Security

We implement appropriate technical and organizational measures, in accordance with Art. 32 GDPR, to protect your data against unauthorized access, loss, or misuse, including encrypted transmission (TLS) and access controls. However, no method of transmission over the internet is completely secure.

15. Children's Privacy

Our Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children.

16. Changes to this Policy

We may update this privacy policy from time to time to reflect changes to our Service or legal requirements. The date at the top of this page indicates when it was last revised.

17. Contact

If you have any questions about this privacy policy or wish to exercise your rights, please contact us at:

Email: support@trypia.app