Privacy Policy

Last updated: November 2026. This policy applies to the website postalike.ai (including postalike.com and postlikethis.com) and to the PostAlike web app at app.postalike.com. The German version is legally binding; this English version is provided for your convenience.

1. Controller

Heiko Lindner – Social Media Experte & IT Berater, Tumblingerstraße 45, 80337 Munich, Germany
Email: [email protected] – further details in the legal notice (Impressum).

2. Website

2.1 Hosting

The website is delivered through Cloudflare Pages (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). When you visit it, Cloudflare processes technically necessary data such as your IP address and the time of access in order to deliver the site and protect it against attacks (Art. 6(1)(f) GDPR). We have a data processing agreement with Cloudflare; Cloudflare is certified under the EU-U.S. Data Privacy Framework. Waitlist entries are stored in a database in Western Europe.

2.2 Waitlist

If you sign up for early access, we store your email address, optionally your answer to “I am …”, the domain you signed up on and the time. We use this data only to contact you about early access (Art. 6(1)(a) GDPR). You can withdraw your consent at any time by emailing [email protected]; we will then delete your data.

2.3 No tracking cookies

The website sets no tracking or marketing cookies and loads no fonts or scripts from third parties.

3. The PostAlike web app

PostAlike helps you create, schedule and publish Instagram and Facebook posts for your brands. To do this we process the following data, in each case to perform our contract with you (Art. 6(1)(b) GDPR).

3.1 Account

Email address, name, an encrypted password hash and the time of your last sign-in. For signing in we set a technically necessary session cookie.

3.2 Content

The brand profiles, texts, images, drafts and schedules you create or upload in the app, and the texts and images generated by the AI.

3.3 Connection with Facebook and Instagram (Meta)

When you connect a Facebook Page and an Instagram business or creator account to PostAlike through “Connect with Facebook”, we receive from Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, Ireland) only the data you grant in the login dialog:

the name and ID of the Facebook Pages you grant, and the ID and username of the Instagram accounts linked to them (permissions pages_show_list, business_management, instagram_basic),
access tokens that PostAlike uses to publish posts to your Page and your Instagram account on your behalf (instagram_content_publish, pages_manage_posts, pages_read_engagement) and to show basic figures of your own account and posts, such as followers, likes and comments (instagram_basic).

We store the access tokens encrypted. We use this data only to provide the features you trigger in the app: publishing posts, publishing scheduled posts at the time you chose, and showing figures of your own posts. We do not sell the data, do not share it for advertising and do not use it to train AI models. Meta's Platform Terms also apply.

You can end the connection at any time in the app under “Meta settings → Disconnect” or in your Facebook settings under “Business integrations”. How to have all data deleted is described under Data deletion.

3.4 Service providers

We use the following processors to run the service (Art. 28 GDPR). Where they process data in the USA, this is based on the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses.

Railway Corporation (USA): hosting of the app and the database, data centre in the Netherlands.
Cloudflare, Inc. (USA): storage of images and files (R2), storage location EU.
OpenAI, L.L.C. (USA) and Anthropic, PBC (USA): generation of texts and images from your input. These providers do not use API data to train their models.
Apify Technologies s.r.o. (Czech Republic): retrieval of publicly available Instagram posts whose link you paste into the app, and search of public places for a post's location.

3.5 Retention

We keep your data as long as your account exists. After your account is deleted or after a deletion request, we delete the account, content and Meta connections within 30 days, unless statutory retention obligations apply. Disconnected Meta connections are deleted immediately.

4. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, the right to withdraw consent, and the right to lodge a complaint with a data protection supervisory authority, for example the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht). To exercise these rights, email [email protected].