Your own details: your name, email address, company and billing information. We decide what to do with those, so we are the controller and this policy is our answer for them.
Your recipients' details: the addresses and names you upload. Those are yours. You decide who goes on a list and what is sent; we hold and process them on your instructions. You are the controller, we are the processor, and the permission rules are your side of that.
The one exception is the suppression list in section 4, which we maintain for the whole platform in our own right.
We use these to run the service, take payment, answer support, and keep the platform safe. We do not sell personal information, and we do not use your recipients' addresses to market anything of our own.
We do not add to this from anywhere else, and we do not build profiles across customers.
You reached this page because something arrived from our sending domain. Here is exactly what we do.
We keep your email address on a permanent do-not-mail list. That is the whole record, and it is what stops you being mailed again, by the company that sent the card and by every other customer of this service. It is deliberately global, because you opted out of mail from this domain and you have no way to tell our customers apart.
We will not delete it, even if you ask. Deleting it is the one thing that would let you be mailed again, which is the opposite of what you asked for. Keeping it is a legal obligation as much as a courtesy.
The customer who sent you the card holds their own copy of your details. To have those removed, ask them. Their name and postal address are at the bottom of the message you received. If you cannot reach them, contact us and we will pass it on.
We use a small number of suppliers, each for one job:
Each gets only what it needs for its job. We do not sell personal information, or share it for advertising.
Our suppliers operate in Canada, the United States and the European Union, so data may be processed outside the country you are in. Where that involves personal data from the EU or the UK, transfers rely on the standard contractual clauses.
A cookie is a small file a site leaves in your browser. We keep ours to the few that are needed, and we set them ourselves rather than letting anybody else set one through us.
We do not use advertising cookies, we do not let advertising networks measure you here, and we do not sell or share what we measure. If that ever changes, this page changes first and you will be asked again.
Depending on where you live, you can ask for a copy of what we hold about you, ask us to correct or delete it, object to some uses of it, or ask for it in a portable form. You can also complain to your data protection authority.
If you are a recipient rather than a customer, the request usually belongs with the business that sent you the card, see section 4, because it is their list. We will help either way.
Traffic is encrypted in transit, passwords are stored hashed rather than in any recoverable form, and access to customer data is limited to the people who need it to do support. No system is perfect; if a breach affects you we will tell you and the relevant authority as the law requires.
This is a product for businesses. It is not directed at children, and we do not knowingly collect information about them.
The date at the top of this page is when this policy last changed. Where a change materially affects you we will tell you rather than relying on you noticing.
For anything in this policy, including a request under section 8 (Your rights), write to us at the postal address shown at the bottom of every card we send, or reply to any email you have had from us.
