Privacy Policy

The data controller is Selfpost UG (haftungsbeschränkt), Fürstenrieder Straße 279 a, 81377 München, Germany, registered with the Amtsgericht München under HRB 258200. Privacy questions and requests may be sent to info@selfpost.com.

We process the information needed to provide accounts and delivery workflows.

• Account and profile data, such as email address, username, password in hashed form, profile fields, phone number and preferences.
• Delivery data, including requests, proposals, pickup and destination information, parcel descriptions, price, order status, delivery code and related notifications.
• Recipient data supplied by the sender, including name, phone number and, where provided, email address.
• Identity-verification status, verification timestamps and a provider session reference. Identity documents are handled by the verification provider; Selfpost does not store the document or its contents.
• Payment and payout references, transaction status and amounts. Stripe handles card and payout-account details; Selfpost does not store full card details.
• Technical and security data generated when the service is used, such as request records, authentication events, device or browser information and error logs.
• Carrier partner application data submitted by logistics companies, including company registration and licensing details, the name, business email address and telephone number of a contact person at that company, the operational information described in the form, and the consent recorded with the application.
• Messages sent to support and other communications with Selfpost, together with case status, internal operator notes, audit events and any AI-assisted analysis generated for the case.

We process account, order, proposal, payment and recipient data as necessary to provide the service requested by users and to take steps before entering a contract (Article 6(1)(b) GDPR).

We process records needed for tax, accounting, regulatory and lawful authority requests to comply with legal obligations (Article 6(1)(c) GDPR).

We process limited account, technical, fraud-prevention and support data for legitimate interests in securing the service, preventing misuse, resolving disputes and improving reliability (Article 6(1)(f) GDPR), after balancing those interests against the rights of affected people.

When AI assistance is enabled for support, it is used under the same legitimate interests to summarise a case, classify its subject, flag possible safety concerns and prepare a draft for an operator. It does not decide a complaint, send a reply, change an order, restrict an account or trigger a refund or payout. A human operator remains responsible for every decision and user-facing message.

Identity verification is necessary to provide the service and to prevent misuse, so Selfpost processes its outcome under Article 6(1)(b) and Article 6(1)(f) GDPR. The document check itself, including any comparison between a photograph and an identity document, is carried out by Stripe Identity, which asks for your explicit consent inside that flow before processing data of that kind (Article 9(2)(a) GDPR). Selfpost receives the result, the time of the check and a session reference — not the document.

We process carrier partner applications to take the steps requested by the applying company before entering a contract (Article 6(1)(b) GDPR). The contact person named in an application is an individual rather than the company, and their name, business email address and telephone number are processed on the basis of the consent recorded when the application is submitted (Article 6(1)(a) GDPR). That consent may be withdrawn at any time for future processing by writing to info@selfpost.com, and withdrawing it does not affect processing that already took place.

Where any other use requires consent, we ask for it separately and you may withdraw it for future processing.

Information in a delivery request is shown to users as needed to search for and evaluate that request. The sender's and traveller's account information is shared only to the extent required for the delivery workflow.

Recipient contact details are disclosed to the accepted traveller only after payment is confirmed. The traveller must use them only to arrange and complete that delivery. Senders must tell recipients that their information will be provided to Selfpost and the accepted traveller and must have a lawful basis for doing so.

Carrier partner applications are not published. Selfpost does not operate a public carrier directory, and the information in an application is read only by the people reviewing it. Where a partnership follows, company details are used as the transaction, the payment or the transport documentation requires.

We may disclose information where required by law, to protect users or the service, or in connection with a corporate transaction subject to appropriate safeguards.

We use service providers to operate specific parts of Selfpost. They process data under their own terms or under instructions from the controller, depending on their role.

• Stripe processes card payments, courier payout onboarding and payout information through Stripe Connect, and identity-verification sessions through Stripe Identity. Stripe receives the data required for those services; Selfpost stores status and reference data rather than card details or identity documents.
• Hetzner Online GmbH hosts the application and the PostgreSQL database on servers in Germany.
• MailerSend transmits account confirmations, delivery notices and support communications by email.
• OpenAI provides optional AI assistance for support cases when that feature is configured. Selfpost sends only a bounded, redacted case bundle containing relevant user-visible support text, case state and policy identifiers. Before transfer, the system removes email addresses, phone numbers and delivery codes. It does not send parcel photos, raw addresses, coordinates, passwords, card data, identity documents or private storage contents. API storage is disabled for these requests. If AI assistance is unavailable, the support conversation and human review continue without it.

Default avatars are generated locally by Selfpost. Loading a default avatar does not make a third-party request, and the pages that display profiles embed no external avatar, font or tracking service. We update this policy before introducing uploaded images or embedded third-party content.

The Selfpost application, its database and its stored files run on servers in Germany, inside the European Economic Area. Transactional email is sent through MailerSend, whose service is operated from the European Union.

Stripe is one exception. Selfpost contracts with Stripe Payments Europe, Limited in Ireland, and Stripe transfers personal data to Stripe, Inc. in the United States. Those transfers are covered by the European Commission's Standard Contractual Clauses, which form part of Stripe's data processing agreement, together with the supplementary measures set out in it.

When optional AI assistance is enabled, OpenAI may process the redacted support bundle outside the European Economic Area. Selfpost uses the applicable transfer safeguards in the provider agreement for any such transfer. Users may ask Selfpost which safeguards apply to their data.

You can ask which mechanism applies to your data, and request a copy of it, at info@selfpost.com.

We keep personal data only for as long as it is needed for the purposes described above.

• Account and profile data: while the account exists, and erased within 30 days of the account being closed.
• Delivery requests, proposals, order records and the delivery-code event: three years from the end of the year in which the order was completed or cancelled, matching the ordinary limitation period for contractual claims under German law.
• Payment and invoicing records: ten years, as required by German commercial and tax law.
• Identity-verification status, timestamps and session references: while the account exists, then three years, so that a disputed delivery can still be examined.
• Recipient contact details supplied by a sender: erased 90 days after the order is completed or cancelled.
• Carrier partner applications that do not lead to a partnership: erased 12 months after the decision, so that a repeat application can be recognised and the reason for an earlier outcome explained. Where a partnership begins, the application is kept for as long as the partnership lasts and for three years after it ends.
• Technical, authentication and error logs: 90 days.
• Support messages, case records, internal notes, audit events and AI-assisted analyses: three years from the last message in the conversation, unless a longer period is needed for a claim or lawful order.
• Backups: overwritten on a rolling 30-day cycle, so data erased from the live systems leaves the backups within that period.

Where a record is needed to establish, exercise or defend a legal claim, or to comply with a lawful order, we keep it until that matter is resolved, even if the period above has passed.

We use technical and organisational measures to protect personal data, including access controls and separation of card and identity-document processing from Selfpost's own systems. No online service can guarantee absolute security. Users should protect their credentials and report suspected account misuse promptly.

Depending on the circumstances, you may have the right to access, correct or delete your data; restrict or object to processing; receive portable data; and withdraw consent for future processing. You may also lodge a complaint with the competent data-protection supervisory authority.

To make a request, contact info@selfpost.com. We may need to verify your identity before acting. Deletion is not absolute: records may be retained where required by law or needed to establish, exercise or defend legal claims.

Recipients whose contact details were supplied by a sender may also exercise their rights by contacting Selfpost. We answer requests within one month. If a request is complex we may extend that by up to two further months, and we tell you why within the first month.

We update this policy when the service or its data practices change. Where a change is material we tell users through the service or by email.

Version 1.2, effective 29 August 2026. This version adds support conversations, Operations case records and the bounded, optional use of AI assistance under human control.