Security and GDPR
Made in the EU, stored in the EU
Superbridger is made by Peech Works, a company in the Netherlands, under the GDPR. Your posts, accounts and videos are stored in Frankfurt, Germany, and kept no longer than needed.
- Dutch company
- Data in Frankfurt, Germany
- Encrypted platform access
- Videos deleted within 7 days
- DPA on request
In short
- Superbridger is run by Peech Works in the Netherlands (KVK 86901249), and the Dutch Data Protection Authority is its regulator.
- The database (Supabase), the hosting and the uploaded videos and images (Vercel) and analytics (PostHog's EU cloud) are all in Frankfurt, Germany. Email (Resend) and payments (Stripe) are run from Ireland.
- Access to your social accounts is stored encrypted (AES-256-GCM), used only on our servers and never sent to a browser. You connect every account with the platform's own login: we never see your passwords.
- Uploaded videos and images are deleted within 7 days after they're posted. When you close your account, everything is deleted within 30 days.
- Business customers can ask for a data processing agreement (DPA) under Article 28 of the GDPR.
Checked on 25 October 2026.
Where is my data stored?
In the EU: the database, the hosting and your uploaded files are in Frankfurt, Germany.
| Provider | What it does for us | Where |
|---|---|---|
| Vercel | Hosting, and storage of uploaded videos, images and thumbnails | Frankfurt, Germany |
| Supabase | The database | Frankfurt, Germany |
| PostHog | Analytics, session recordings and milestones | EU cloud, Frankfurt, Germany |
| Resend | Alert emails | Ireland |
| Stripe | Payments, subscriptions, invoices and VAT, if you choose a plan | Stripe Payments Europe, Ireland |
| Signing you in, if you sign in with Google |
These providers work on our instructions. Some are US companies: where data may be accessed from outside the EU, that relies on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. The privacy policy has the full list and is the version that counts.
What happens with my social accounts?
You connect each one with the platform's own login, and Superbridger only uses the access to post what you ask and to read the post's numbers.
- No passwords. You sign in on Facebook's, Google's, TikTok's, LinkedIn's and X's own screens; we never see your password.
- Encrypted access. The tokens the platforms give are encrypted (AES-256-GCM) before they're stored, used only on our servers and never sent to a browser.
- Only what you ask. Superbridger publishes and deletes the posts you ask for, and reads their status and numbers. It doesn't read your messages, your followers' profiles or your timeline.
- Undo any time. Disconnecting an account deletes its tokens straight away and revokes the access at Google and TikTok. Revoking access on the platform itself works too.
The platforms receive what you publish to them as independent controllers, under their own terms.
How long is my data kept?
Videos and images for at most 7 days after posting; everything else while your account is open, and deleted within 30 days after you close it.
- Uploaded videos and images: deleted from our storage within 7 days after they've been posted. Your posts stay on the platforms.
- Thumbnails and post history: while your account is open, unless you ask us to delete them.
- Account access: while the account is connected. If you revoke access on the platform, we delete the tokens within 30 days.
- Analytics: a year in PostHog; session recordings 30 days.
- Your whole account: deleted within 30 days after you close it.
The data deletion page explains how to remove everything.
And AI apps such as Claude or ChatGPT?
An AI app only gets in when you connect it, works in the one team you pick, and stops the moment you disconnect it.
AI apps connect through Superbridger's MCP server with your sign-in. Their access tokens last an hour and only work for Superbridger; every request is checked against your permission and your membership of the team. You choose whether an app may post or only read, and disconnect it under Settings → Connected apps. More about posting from AI apps.
Can I get a data processing agreement (DPA)?
Yes. For the content and account data you process with Superbridger for your business or your clients, we sign a DPA under Article 28 of the GDPR.
Ask through the contact page with your company's name and address. The DPA lists the subprocessors above and what each does, and we tell you before adding a new one.
Agencies posting for clients are usually the processor for their clients' data, and Superbridger is their subprocessor: the same DPA covers that.
What are my rights?
To see, correct, export or delete your data, and to object or restrict how it's used, by email.
Email us (the address is in the privacy policy) and we answer within the GDPR's deadlines. If you think we handle your data wrongly, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Questions about security and the GDPR
Is Superbridger GDPR-compliant?
Superbridger is made by Peech Works, a Dutch company, and works under the GDPR: data stored in Frankfurt, a published list of subprocessors, short retention, deletion on request and a DPA for business customers.
Is there a European social media scheduler?
Yes. Superbridger is made in the Netherlands and stores its data in Frankfurt, Germany. It publishes to Instagram, Facebook, YouTube, TikTok, LinkedIn and X.
Where are my videos stored?
On Vercel's storage in Frankfurt, Germany, and only until they're posted: they're deleted within 7 days after that.
Do you use my data to train AI or sell it?
No. We use your data to run Superbridger for you, and we don't sell it.
Do you set advertising cookies?
The app doesn't. On the public website, Meta's ad measurement sets two advertising cookies; the privacy policy explains when and how long.
Post everywhere, starting today.
7-day free trial · No card needed. Sign up with your email or Google and post your first video today.