Privacy policy

Last updated: 24 October 2026

1. Who is responsible

PostKlar is a joint project of Abdallah and Shahed. We are joint controllers (Art. 26 GDPR).

Email: support@postclaro.de

We have agreed: we decide together which data PostKlar processes, for what, and with which service providers. We answer requests to support@postclaro.de together; you can also contact each of us individually. If we notice a data breach, we inform each other at once.

Before the public launch, a company will take over PostKlar. We will tell you then and ask for your consent again in the app.

2. Which data we process and why

• Account Email address and sign-in codes, so that you can sign in. Basis: the contract for using the app (Art. 6(1)(b) GDPR).
• Letters Photos or PDF, recognised text, title, folder, tags, explanation, deadlines and reminders. With these, PostKlar shows, explains and translates your letters and reminds you of deadlines. Basis: contract.
• Health information Letters from a health insurer, a doctor’s practice or a care insurer often contain health data. PostKlar stores and explains it only with your explicit yes. You give and withdraw it under Settings › Privacy. Without a yes, the app reminds you before scanning not to scan such letters. Basis: consent (Art. 9(2)(a) GDPR).
• Chat Your question and the letter, so that the AI can answer. Only your phone keeps the chat history. Basis: contract.
• Profile picture and details Voluntary: a photo without location, gender and year of birth, if you like day and month. The photo shows whose letters these are. We only want to use the details later as totals, for example per age group; so far nothing is done with them. You can delete both at any time. Basis: legitimate interest (Art. 6(1)(f) GDPR).
• Consents Your answers with time, version of the text, language and app version, as proof. Basis: legal obligation (Art. 6(1)(c) and Art. 7(1) GDPR).
• Reminders and sharing Whether reminders are on and how early they come. If you share a profile: who sees it, since when, and the invitation code (valid for 72 hours). Basis: contract.
• Profiles for relatives See section 9.
• Feedback What you write via “Feedback”, with device type and language. For a letter, its type, title (which often names the sender), folder and number of pages are added, not the text or the photo. Basis: legitimate interest.
• Emails to us So that we can reply to you. Basis: legitimate interest.
• Operation and security Technical data such as IP address and time, so that PostKlar runs securely. Basis: legitimate interest.

3. How the AI works

PostKlar uses AI by Mistral AI (Paris) through their access point in the EU. The AI receives the text of your letter, for translations the explanation, and in the chat your question, the letter and today’s date. If text recognition on the phone does not work, it receives the photos. It never receives your email address, profile names, profile pictures or personal details.

Mistral does not train on your data; we have opted out. To detect misuse, Mistral keeps requests and answers for 30 days and is itself responsible for this.

The AI can make mistakes and gives no legal advice; check deadlines and amounts in the letter. The app says in the chat and below every explanation that an AI is answering. It decides nothing about you (no automated decision under Art. 22 GDPR).

The app first recognises the text on your phone, with Google ML Kit. No image is sent to Google in the process.

4. Who receives data

• Supabase (Supabase Pte. Ltd., Singapore): database, files and sign-in, in a data centre in Frankfurt am Main. Supabase and its service providers such as Amazon Web Services may also access it from outside the EU for maintenance; the EU Standard Contractual Clauses apply (Art. 46 GDPR). Supabase also stores IP addresses, for example of your sign-in.
• Hetzner (Hetzner Online GmbH, Gunzenhausen): our server in Nuremberg, through which the app and the AI run. It does not store IP addresses.
• Mistral AI (Mistral AI SAS, Paris): the AI, see section 3.
• Brevo (Sendinblue SAS, Paris): sends the emails with your sign-in code.
• IONOS (IONOS SE, Montabaur): our email inbox and the address postclaro.de.
• Google (Google LLC, USA): Google ML Kit on your phone sends Google technical usage data such as device model, operating system, app version, error values and identifiers of the device and installation, not your letters. On Android, the scanner and text recognition run via Google Play services. Google is itself responsible for this; Google is certified under the EU-US Data Privacy Framework.
• Apple: If you test PostKlar via TestFlight on an iPhone or iPad, Apple gives us crash reports, usage data and your feedback, depending on the invitation with your name and email address. Apple is itself responsible for this.
• People you share a profile with: With “Only deadlines” they see the profile, its picture and the deadlines, with “Everything” also the letters, never personal details.

Supabase, Hetzner, Mistral AI, Brevo and IONOS work on our behalf (Art. 28 GDPR).

5. What stays on your phone

• Language, design, your sign-in, chat histories, translated titles, ticks and the scan draft. The app needs these (Section 25(2) no. 2 TDDDG). What belongs to a letter is deleted with the letter and when you sign out.
• Your phone schedules reminders itself, without a push service. They show the title of the letter, depending on your settings also on the lock screen.
• The app only needs the camera, photos and notifications for scanning, the profile photo and reminders.
• Before the app opens a link, it briefly checks whether the page can be reached. Other sites, for example of advice centres, have their own privacy policy.

6. How long we keep data

• Letters with everything that belongs to them: until you delete the letter, the profile or your account. We then remove the files first, then the rest.
• Account, profiles, pictures, details, consents, settings and shares, including expired invitations: until you delete them or your account.
• Feedback: until you delete your account or the letter it belongs to.
• Emails to us: until your question has been dealt with, at most one year.
• At Mistral AI: at most 30 days.
• Backups at Supabase: up to 7 days.
• Logs: Our server logs errors without IP addresses and overwrites the logs continuously. Supabase deletes its logs after a few days.

7. Authorities

We do not sell your data and do not give it to authorities voluntarily. Only if a court or an authority legally forces us do we have to hand over data. We then check this and hand over only what we must. Duties to report to the immigration office apply to authorities, not to us.

8. Your rights

You have the right of access, rectification, erasure, restriction and data portability (Art. 15 to 18 and 20 GDPR). Where we process data based on legitimate interest, you can object (Art. 21). You can withdraw a consent at any time (Art. 7(3)); what happened until then remains lawful.

You delete letters, profiles and your account in the app. Under Settings › Account you get your data as a file, without the photos of the letters. For everything else, write to us: support@postclaro.de

You can complain to a data protection supervisory authority (Art. 77), for example in your federal state.

Providing data is voluntary. Without an email address, however, there is no account, and without letters nothing to explain.

9. For relatives

This section is for you if someone manages your letters for you with PostKlar (Art. 14 GDPR).

• Responsible: Abdallah and Shahed, email support@postclaro.de.
• Data: your name, your relationship, your language, who consented and when; your letters with explanation, deadlines and reminders. With your yes, also a photo and personal details (gender, year of birth).
• Where from: from the person who creates your profile and from the letters they scan.
• What for: so that they can help you with your post. Basis: legitimate interest, yours and theirs (Art. 6(1)(f) GDPR).
• Letters about your health: only with your explicit yes or that of your legal representative, for example parents, a legal guardian or a lasting power of attorney (Art. 9(2)(a)). Without this yes, the person must not scan such letters; the app reminds them of this. A photo and details also only with your yes.
• Who sees them: the person who manages your profile and whoever they share it with; in addition, the service providers from section 4 and the AI.
• How long: until the person deletes your profile or you ask for it to be deleted.
• Your rights: as in section 8. Write to us at support@postclaro.de. You can withdraw your yes at any time; tell the person or us.

10. Other people’s data in letters

Letters often contain names of other people, for example of the case worker or of family members. PostKlar stores and explains them as part of the letter, for nothing else. It is not possible for us to notify these people individually (Art. 14(5)(b) GDPR); that is why it is stated here.

11. This website

postclaro.de sets no cookies, loads nothing from other providers and does not store visits. When you visit, your browser sends technically necessary data such as the IP address to our server at Hetzner; it is only used to deliver the page.

12. Pilot and changes

PostKlar is being tested with family and friends. An account is for adults; for a child, the parents create a profile. If we change this policy, a new date appears at the top; we will tell you about important changes in the app.

Back to top