Privacy Policy
Last updated: October 9, 2026
Posterity complies with the General Data Protection Regulation (GDPR) and the French Data Protection Act. Your personal data is handled with the utmost care and is never sold to third parties.
1Data controller
The data controller for personal data is:
- Steeve Benabou
- 14A chemin Tauran, 97424 Saint-Leu, La Réunion, France
- Email: contact@theposterityproject.io
- SIREN: 107 927 121 (Saint-Pierre de La Réunion Trade Register)
2Data collected
We collect the following data:
Identification data
- Last name, first name, email address
- Profile picture (if provided via Google OAuth)
- Login identifier (email or Google ID)
📝 Content data
- Published texts, photos, videos, audio recordings
- File metadata (size, type, date)
- Information about commemorated persons (name, dates, biography)
💳 Payment data
- Purchase history (amount, date, status)
- Banking data is processed exclusively by Stripe and is never stored on our servers
🌐 Technical data
- IP address, browser type, operating system
- Pages visited and visit duration (anonymized analytics)
3Purposes of processing
Data is collected for the following purposes:
- Account management: creation, authentication and administration of user accounts.
- Service delivery: hosting and display of tributes, legacies and capsules.
- Payments: processing of Posterity Pass purchases via Stripe.
- Communication: sending transactional emails (confirmation, invitations, capsule notifications).
- Service improvement: anonymized statistical analysis of usage.
- Legal obligations: retention of billing data in accordance with tax law.
4Legal basis for processing
- Performance of contract: processing necessary for the provision of the requested service (Art. 6.1.b GDPR).
- Consent: for sending marketing communications and use of cookies (Art. 6.1.a GDPR).
- Legitimate interest: service improvement and platform security (Art. 6.1.f GDPR).
- Legal obligation: retention of billing data (Art. 6.1.c GDPR).
5Data sharing
Your personal data is never sold. It may be shared with the following technical providers, strictly necessary for the service to function:
| Provider | Usage | Location |
|---|---|---|
| Supabase | Database and storage | EU / Singapore |
| Vercel | Web hosting | United States |
| Stripe | Secure payments | United States |
| Resend | Transactional email delivery | United States |
| Sentry | Technical error monitoring (page, browser, device; no session recording) | EU (Germany) |
| Upstash | Abuse protection (IP address kept for 15 minutes at most) | EU (Ireland) |
| Google Analytics | Anonymised visit statistics | United States |
| Google Translate | Automatic translation of public content | United States |
| OAuth authentication | United States |
These providers are subject to Standard Contractual Clauses (SCCs) approved by the European Commission for data transfers outside the EU.
6Data retention
- Account data: retained for the duration of service use, then 12 months after last login for free accounts, or indefinitely for Premium accounts.
- Content (tributes, legacies, capsules): retained as long as the account is active. Time capsules are kept until their reveal date, then according to the user's wishes.
- Billing data: retained for 10 years in accordance with the Commercial Code.
- Technical logs: retained for a maximum of 12 months.
7Data security
Posterity implements the following security measures:
- Encryption in transit: all communications are protected by TLS/SSL.
- Capsule protection: time capsules are securely stored on protected servers with strict server-side access control.
- Secure authentication: passwords hashed with bcrypt, signed JWT tokens.
- Row Level Security: data isolation between users at the database level.
- Backups: regular automatic data backups.
8Your rights (GDPR)
In accordance with the GDPR and the French Data Protection Act, you have the following rights:
Obtain a copy of your personal data.
Correct your inaccurate or incomplete data.
Request the deletion of your data.
Receive your data in a structured format.
To exercise these rights, contact us at: contact@theposterityproject.io
We commit to responding to your request within 30 days.
You also have the right to file a complaint with the CNIL (French National Commission for Data Protection):www.cnil.fr
9Cookies
Posterity uses three types of cookies:
- Session cookies: authentication and session maintenance (NextAuth).
- Preference cookies: language chosen by the user.
- Audience and advertising cookies: Google Analytics (traffic measurement) and Meta Pixel (Facebook, measurement of our campaigns). They are active as soon as you arrive; on your first visit, the "Decline" button in the banner disables them and removes them from your browser.
Session and preference cookies are essential to the service. Your choice regarding audience and advertising cookies is stored in your browser.
10Modifications
This policy may be modified at any time. In case of substantial changes, users will be notified by email. The date of the last update is indicated at the top of this page.
For any questions regarding the protection of your data: contact@theposterityproject.io