Postaged Privacy Policy

This Privacy Policy explains how Postaged, Inc. ("Postaged," "we," "us") collects, uses, and shares personal information. Postaged provides a direct mail advertising platform that businesses ("Customers") use to send physical mail, identify website visitors for mail retargeting, and measure campaign performance.

1. Our Two Roles

Understanding this policy requires understanding that Postaged acts in two distinct capacities:

As a processor / service provider. When Customers upload mailing lists, connect their CRM or e-commerce platforms, or install the Postaged Pixel on their websites, we process that data on the Customer's behalf and under their instructions. The Customer is the controller (or "business" under U.S. state law) of that data. If you received mail from one of our Customers or visited a Customer's website, that Customer's privacy policy governs, and requests about that data should be directed to them — though we will assist as described in Section 8.

As a controller. We are the controller of personal information about visitors to postaged.com, our own prospects and Customers' account users, and the operational data we generate running our business.

Sections 2-6 describe both roles; Sections 7-10 explain your rights in each.

2. Information We Collect

Provided by Customers and their users (controller role): name, business email, phone, company, job title, billing information (processed by our payment processors — we do not store full card numbers), account settings, and support communications.

Customer Data we process on Customers' behalf (processor role): mailing lists and audience files (typically names, postal addresses, and marketing attributes), CRM and e-commerce records synced from integrations (e.g., Shopify, HubSpot, Salesforce), creative assets, campaign configurations, and suppression lists.

Collected via the Postaged Pixel (processor role): when a Customer installs our pixel on their site, we collect device and browser information, IP address, pages viewed, timestamps, and identifiers (including hashed identifiers and cookies) from visitors to that site. This data is used, together with identity resolution partners, to associate a website visit with a postal address or household so the Customer can send that visitor direct mail and measure whether mail recipients later visited or purchased.

Collected automatically on our own properties (controller role): log data, device information, cookies and similar technologies, and product usage analytics.

From third parties (controller role): business contact information from data providers and publicly available sources for our own sales and marketing, and information from identity resolution and address-hygiene partners used to provide the Services.

We do not intentionally collect sensitive personal information (e.g., health, precise geolocation, government identifiers) and our Terms of Service prohibit Customers from uploading it.

3. How Identity Resolution and Measurement Work

Because this is the least familiar part of our Services, we describe it plainly:

1. A Customer installs the Postaged Pixel on their website and is required to disclose it in their privacy policy and honor applicable consent and opt-out requirements.
2. The Pixel collects device signals and identifiers from site visitors.
3. We and our identity partners match those signals against reference datasets to resolve a visitor to a postal address or household. Matching is probabilistic and not always accurate.
4. The Customer may then send direct mail to that address and measure conversions (e.g., whether a mailed household later purchased).
5. Resolved data is made available only to the Customer whose site the visitor used, solely for that Customer's own direct mail marketing and measurement. We contractually prohibit Customers from reselling it or using it to build data products.

We do not sell Customer mailing lists. Under some U.S. state privacy laws, the identity-resolution process described above may be considered "selling" or "sharing" personal information between the Customer, Postaged, and identity partners; opt-out rights for that activity are described in Section 8.

4. How We Use Information

• To provide, operate, secure, and support the Services, including producing and mailing physical mail via production partners and USPS
• To perform identity resolution, address standardization (including NCOA processing), suppression, and attribution measurement as instructed by Customers
• To bill and manage accounts
• To improve and develop the Services, including using aggregated or de-identified data
• To communicate with Customers, including service notices and (with opt-out) marketing
• To comply with law, enforce agreements, and protect rights, safety, and security
• With respect to AI creative features: to generate copy and designs requested by Customers. Customer Data is not used to train AI models.

5. Legal Bases (GDPR / UK GDPR)

Where GDPR applies and we act as controller, we rely on: contract performance (providing the Services to Customers), legitimate interests (securing and improving the Services, B2B marketing, fraud prevention — balanced against your rights), consent (where required, e.g., certain cookies), and legal obligation (tax, accounting, compliance). Where we act as processor, our Customer determines the legal basis and we process per their instructions under our agreements with them.

6. How We Share Information

We share personal information with:

• Production and mailing partners (printers, letterpress/handwriting fulfillment vendors, USPS and other carriers) to produce and deliver mail
• Identity resolution and data hygiene partners to provide visitor identification, address standardization, and suppression
• Infrastructure and software providers (hosting, storage, analytics, communications, payments) that process data on our behalf
• Integration partners you connect (e.g., Shopify, HubSpot, Salesforce), as configured by the Customer
• Professional advisors and authorities where required by law or to protect rights
• Successors in a merger, acquisition, or asset sale, subject to this policy

We do not permit these providers to use personal information for their own purposes except as permitted by law, and we bind them to data protection terms.

7. International Transfers

We are based in the United States and process data there. Where we transfer personal data from the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and UK Addendum / Swiss adaptations).

8. Your Rights and Choices

If you are in the EEA, UK, or a U.S. state with a privacy law (including California, Virginia, Colorado, and Connecticut), you may have rights to access, correct, delete, and port your personal information, to opt out of targeted advertising, "sale," or "sharing," to limit certain processing, and to not be discriminated against for exercising rights.

How to exercise rights against Postaged (controller role): email sam@postaged.com. We will verify your request and respond within the legally required period. You may appeal a denial by replying to our decision; EEA/UK residents may lodge complaints with their supervisory authority.

If your data was processed on behalf of a Customer (processor role): we will identify the Customer where feasible and refer your request to them, and we assist Customers in fulfilling verified requests. You can also always:

• Opt out of mail sent through Postaged: email sam@postaged.com with your name and mailing address, or follow the opt-out instructions on the mail piece. We will refer your request to the relevant Customer and assist that Customer in suppressing your address within their account.
• Opt out of pixel-based identification: use the opt-out mechanisms on the Customer's website (e.g., "Do Not Sell or Share My Personal Information" links, cookie settings).

Marketing emails from Postaged: use the unsubscribe link in any message.

9. Retention

We retain personal information for as long as needed for the purposes described above: account data for the life of the account plus limited periods required for legal and tax purposes; Customer Data for the subscription term, with export available for 30 days after termination and deletion thereafter; pixel-derived Visitor Data for 12 months; and logs and backups on rolling schedules. Retention specifics are available on request.

10. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, role-based access controls, logging and monitoring, and vendor security review. No system is perfectly secure; we will notify affected parties of breaches as required by law.

11. Children

The Services are B2B and not directed to children under 18. We do not knowingly collect children's data and prohibit Customers from targeting minors.

12. California Notice (CCPA/CPRA)

For California residents, the categories of personal information we collect are described in Section 2 (identifiers, commercial information, internet activity, professional information, and inferences); purposes in Section 4; disclosure categories in Section 6. Depending on how the law applies to identity resolution, Postaged's role may constitute "selling" or "sharing" as defined by the CCPA; California residents may opt out as described in Section 8. We do not use or disclose sensitive personal information for purposes requiring a right to limit. We do not knowingly sell or share personal information of consumers under 16. Statistics on privacy requests received are available on request.

13. Changes

We will post updates to this policy here and update the date above. Material changes will be notified via the Services or email.

14. Contact

Postaged, Inc.

25 Gale Road, Bloomfield, CT 06002

sam@postaged.com

EU/UK representative: Samuel Slocum, 25 Gale Road, Bloomfield, CT 06002, USA