Privacy notice

Last updated 5 October 2026. This notice fulfils the information duties of Art. 13 GDPR for everyone who uses PosterBell: poster authors (“authors”) and people who open a poster page (“visitors”).

Who is responsible

The controller for the data processed by PosterBell is:

Use the same address for every privacy question or request.

Messages to an author. PosterBell stores and delivers what visitors send. Once a ring or message has reached the author, the author decides what to do with it — for example replying from their own mailbox — and is responsible for that use themselves. Apart from the providers listed under Providers that process data for us, PosterBell passes visitor data to no one, and never for anyone’s own purposes.

Data of authors

• Account: e-mail address, name (shown on your poster pages), and settings such as your notification channel and QR-code design. Purpose: providing your account. Legal basis: performance of our contract with you, Art. 6(1)(b) GDPR. Without an e-mail address we cannot create an account.
• Posters: title, subtitle and the PDF you upload. These are public: anyone with the link or QR code can see them and download the PDF. We ask search engines not to index poster pages, but we cannot stop people who have the link from copying or sharing a poster. Legal basis: Art. 6(1)(b).
• Telegram (optional): your numeric private chat ID after you connect through a one-time link. Purpose: sending you notifications. Legal basis: Art. 6(1)(b).
• Login: one-time login links and codes (valid 30 minutes) and a session cookie (valid 30 days from your last visit to the dashboard, at most 90 days). Legal basis: Art. 6(1)(b).
• Replies you send to visitors are e-mailed with your e-mail address as reply-to, so the visitor can answer you directly.

Private feedback and help

When you send feedback, we store your account reference and reply e-mail, category, message, optional poster reference, the author-page path (without query strings or fragments), UTC submission time and review status. We use these to investigate problems, improve PosterBell and answer your questions (Art. 6(1)(b) GDPR for help with the service; Art. 6(1)(f) for our legitimate interest in improving it). Feedback is private and goes to the PosterBell operator through our hosting and e-mail providers. It is not publicly posted and does not subscribe you to marketing. We do not automatically collect session or action tokens, visitor messages, uploaded PDFs or browser/device data. Please avoid including sensitive information in your message.

Feedback records and queued or sent notification payloads in the application are deleted automatically within 90 days of submission, even if e-mail delivery fails. The operator also removes feedback notification copies from the contact inbox within 90 days; e-mail conversations are kept only as needed to handle your request. You can request feedback access, export or deletion at office@posterbell.com. Backup deletion follows the schedule below.

Conference Pass interest

If you use “Notify me”, we store your e-mail address and the time you agreed so we can contact you if Conference Pass becomes available. This is not a purchase. Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw by e-mailing us.

Data of visitors

• Rings: time, the poster, the author’s answer, and a pseudonymised identifier derived from your IP address with a secret key (not the address itself). Purpose: notifying the author and showing you their answer; the identifier is used against abuse and flooding. Legal basis: our legitimate interest, and the author’s, in delivering the ring you request and in preventing abuse, Art. 6(1)(f).
• Messages: your name, your message and — only if you enter it — your e-mail address, plus the time you gave consent. Purpose: passing your message to the author so they can read and answer it. Legal basis: your consent, Art. 6(1)(a). Sending a message is voluntary. You can withdraw consent at any time by e-mailing us; we then delete the message. Withdrawal does not affect processing before it. If the author receives notifications through Telegram, your consent also covers sending your name, message and e-mail through Telegram, which may process them outside the EU (Art. 49(1)(a) GDPR). The message form tells you when this applies.
• If the author replies, we e-mail the reply to the address you gave us.

Technical data and cookies

• Your IP address is needed to deliver pages to you. We do not write access logs; for rate limiting and blocking abuse we only keep the pseudonymised identifier described above. To see how much the service is used and whether it is healthy, we also count requests in anonymous hourly totals per page type (for example “poster page: 40 views”). These totals contain no IP address, cookie or other data about individual visitors. For requests that fail (for example a mistyped or probed address) we additionally keep the requested path, without query string, IP address or user agent, for 30 days to find and fix faults and to recognise abuse. Legal basis: Art. 6(1)(f), our interest in a secure, working service.
• Authors get two cookies, both strictly necessary for signing in, so they need no consent: the session cookie pb_session (see “How long we keep data”) and pb_login_challenge, which ties a login link or code to the browser that asked for it and expires after 30 minutes. Visitors get no cookies.
• After you ring, your browser remembers that ring (its reference and start time) in local storage on your device, so the status is still there if you reload the page. It is never sent anywhere except back to the poster page to look up the status, is needed for the function you asked for, and expires after an hour. Clearing your browser data removes it.
• No tracking or analytics services, no advertising, no tracking pixels, no fonts or scripts from other sites.

Providers that process data for us

These providers process data on our behalf under a processing agreement (Art. 28 GDPR), except Telegram, which the author chooses.

We never sell data or share it for advertising. We disclose data to authorities only where the law obliges us to.

Transfers outside the EU

Hosting and e-mail delivery run in the United States. InterServer, Inc. is certified under the EU-U.S. Data Privacy Framework, on which the European Commission’s adequacy decision of 10 July 2023 is based, and its data processing agreement additionally provides for Standard Contractual Clauses as a fallback. Telegram may process notifications outside the EU when an author selects it; for visitor messages this relies on the visitor’s explicit consent given on the message form. E-mail office@posterbell.com for a copy of the safeguards that apply to your data.

How long we keep data

• Rings and notification copies: deleted automatically 90 days after they were created. At 90 days we ask authors whether to continue their poster and retain messages. If they do not respond within 14 days, new rings and messages pause while existing messages remain. Authors can choose to delete messages when continuing, or delete the poster and its messages.
• Login links and codes: 30 minutes. Sessions: 30 days after your last dashboard visit, at most 90 days after login, or until you log out.
• Account, posters, PDFs and Telegram link: until you delete them. Deleting a poster also deletes its PDF, rings and messages at once; to delete your whole account, e-mail us.
• Conference Pass interest: until you withdraw your consent or ask us to delete the address. No Conference Pass mailing campaign is active yet.
• Blocked addresses (e-mail addresses or IP addresses blocked for abuse): 12 months after the block was set, or until we lift it earlier.
• Backups: encrypted daily backups are kept for 30 days and then deleted automatically, so deleted data leaves the backups within 30 days (PDFs of deleted posters within 31 days). Before software updates we also take access-restricted local snapshots, which we delete after 14 days. Contact us if you need data removed from backup copies sooner.

Your rights

You have the right to access your data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on our legitimate interests (Art. 21). Where we rely on your consent, you can withdraw it at any time with effect for the future (Art. 7(3)). E-mail office@posterbell.com; we answer within one month. We make no automated decisions about you.

Right to complain

You can lodge a complaint with a supervisory authority, in particular in the EU country where you live or work, or where you believe the infringement happened. Our lead authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

Changes

We update this notice when the service changes. The date at the top shows the current version.