Data processing terms

Version 8 October 2026, under legal review

These terms apply when files you upload to postcache contain personal data, for example photos or videos showing people. They form part of the terms and meet Article 28 of the GDPR. You don't need to sign anything: they apply as soon as you use the service.

Roles

You (the customer) are the controller of personal data in your files. EndorphinIT a.s. (we) processes it on your behalf as processor, only to provide postcache.

What we process

• Subject matter: storing, checking, converting and serving the files you upload, and deleting them.
• Duration: until the file expires (at most 7 days) or you delete it.
• Data: images and video, and any personal data in them or in their metadata, such as faces, voices, names in captions or location data.
• People concerned: anyone who appears in your files.

Our obligations

• We process the data only on your documented instructions. Using the API and its settings (target, conversion, expiry, delete) are those instructions. If an instruction breaks the law, we tell you.
• Everyone at EndorphinIT who can access the data is bound to confidentiality.
• Security: we serve files only over HTTPS and keep them in private storage on our servers in the Czech Republic. API keys are stored as hashes. Files are deleted automatically when they expire, and access is limited to our team.
• Sub-processors: none for your files. Stripe processes billing data as an independent controller, not under these terms. We tell you at least 30 days before we add a sub-processor for files, and you can object or end the contract.
• We help you answer requests from the people concerned and meet your duties on security, breach notification and impact assessments, as far as our role allows.
• We tell you without undue delay, and within 48 hours at the latest, after we become aware of a personal data breach affecting your files.
• At the end of the service we delete all your files; we keep no copies. Fingerprints of removed or illegal files stay on our block list.
• On request we give you the information needed to show we meet these terms and allow audits, at your cost and with reasonable notice.

Your obligations

You make sure you are allowed to upload and publish the personal data in your files, and you inform the people concerned where the law requires it.

Removal of content

We may remove files and act on reports as described in the terms. That is our own decision as a hosting service, not processing on your behalf.

Law

These terms are governed by Czech law, like the terms of service.