Privacy Policy

Effective Date: March 17, 2026

Last Updated: October 14, 2026

1. Introduction

Apricity Advisory Ltd., operating as Postally ("Postally", "Company", "we", "us", "our"), is a corporation incorporated in British Columbia, Canada. We operate the Postally direct mail platform ("Platform"), including the website and dashboard at postally.ca, and the API at api.postally.ca.

This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our Platform. We are committed to complying with the Personal Information Protection and Electronic Documents Act (PIPEDA), the British Columbia Personal Information Protection Act (BC PIPA), the California Consumer Privacy Act (CCPA), and the General Data Protection Regulation (GDPR) where applicable.

You decide whose information you upload to the Platform and what is mailed to them. If you received mail sent through Postally, see section 9.5.

2. Privacy Officer

Our designated Privacy Officer is responsible for overseeing compliance with this policy and applicable privacy laws. You may contact our Privacy Officer at:

Privacy Officer
Apricity Advisory Ltd., operating as Postally
Email: enrico@postally.ca
General inquiries: support@postally.ca

3. Information We Collect

3.1 Account Information

When you create and use an account, we collect:

• Company name and contact email address
• Password (stored as a bcrypt hash — we never store plaintext passwords)
• Mobile phone number (optional, stored encrypted), province or state, and country
• Optional answers you give at signup (industry, company size, primary use case, and previous mail provider)
• How you found us, if you sign up in the browser tab where you first opened one of our public pages: the campaign tags (UTM parameters) and any ad click identifier (from Google, Microsoft or Meta ads) in the link you arrived by, the domain of the website that sent you (never the full address), and the page you first opened. You can see what we recorded through GET /v1/users/me.
• Your return address, if you enter one in Settings
• Sign-in security settings: two-factor authentication secrets and backup codes (stored encrypted) and passkey public keys
• Billing information (processed by Stripe — we do not store credit card numbers)
• A data region label, set to Canada at signup. It is a record-keeping field only and does not change where your data is stored (see section 11)

3.2 Recipient Data

When you use our Platform to send mail, you provide recipient information including:

• Names, job titles, company names, and delivery addresses
• Email addresses and phone numbers, if you provide them
• Return addresses, if you give a recipient its own
• Tags, custom metadata, and any custom merge values and metadata you send with your mail pieces
• Artwork you supply, including print-ready PDFs you personalize for each recipient
• A flag marking a recipient as health information, if you set one

Recipient names, job titles, company names, street addresses, cities, provinces or states, postal codes, email addresses, phone numbers, and return addresses (except their country) are encrypted field by field with AES-256-GCM before they are stored in our database, using keys managed by our application rather than a separate key-management service. Some recipient data is not encrypted this way: a recipient's country and the province we bill tax to, tags, custom metadata (including any per-recipient QR code link), the custom merge values, metadata and tags you send with a mail piece, and our record of why a mail piece failed its print checks, which can quote part of the recipient's address. When you ask for changes to a campaign proof, we also keep the name, city, province and postal code of the proof's sample recipient with your support request, without field-level encryption. When a request carries an Idempotency-Key (the dashboard sends one with every change), we also save the response so that a retried request gets the same answer; saved responses are stored without field-level encryption and can include the recipient details the request returned. Print-ready PDFs of each mail piece, campaign proofs, and the artwork you supply show recipients' names and addresses as printed; these files are stored in Amazon S3 with Amazon-managed (SSE-S3) AES-256 encryption.

3.3 Usage Data

We automatically collect:

• API and dashboard request logs (endpoint, timestamp, response code, IP address)
• An audit log of access to and changes of recipient data, and of account activity, through the API and dashboard, including the IP address of each request and, for some actions, the browser user agent
• Dashboard session information (sign-in time, IP address, and browser user agent)
• Visits to our public pages (the home page, pricing, FAQ, guides, terms, privacy, signup and help pages; the help page is counted whether or not you are signed in, and no other page of the signed-in dashboard is measured): the page and the day and, for the first page opened in a browser tab, the domain of the website that sent the visitor and any campaign tags in the link. We count these ourselves, without a cookie, and do not store the visitor's IP address or browser user agent: to count visitors, we combine them with a random value that changes every day and is discarded after two days, and keep only the result (a one-way hash), which links one visitor's page views within that day and cannot be linked across days. Known bots and monitoring tools are not counted. If your browser sends a Global Privacy Control or Do Not Track signal, our pages record none of this and do not keep how you arrived (section 3.1).
• QR code scan events from people who scan your mail pieces: the time of the scan, the scanner's IP address and browser user agent, and an approximate location (country, region, city, and coordinates rounded to about 1 km) looked up from the IP address through ip-api.com (see section 6). The sender of the mail piece can see each scan, including its IP address, in the dashboard and through the API.

3.4 Emails You Send Us

When you email support@postally.ca or sales@postally.ca, we keep your message and its attachments in our Google Workspace mailboxes and may record your request as a support ticket. Image and PDF attachments up to 20 MB are also stored on the Platform, in Amazon S3, so our team can open them, and we check PDF attachments automatically for size and format. Replies to these emails are written with the help of an AI assistant, which also sees your earlier messages in the same email thread and any replies a person at Postally sent you in it (not our assistant's own earlier replies) and images of those attachments, except for accounts marked as handling health information and senders at such an account's email domain, for which it sees neither those images nor the replies a person at Postally sent (see sections 4 and 6). To improve our published answers, we also keep a support question log: each question you ask, as the assistant rewrote it in general terms, with your own name, your company's name, email addresses, phone numbers, street and postal addresses, IP addresses and order or reference numbers removed automatically where our filter recognises them (other names you mention, and a name that is also an ordinary word, may remain), its topic and whether it was answered, linked to your account and to a keyed one-way fingerprint of your email address (never the address itself). For accounts marked as handling health information, only the topic and whether it was answered are kept. Once a week a tool run by Postally staff reviews these questions, without the fingerprint, your account or any other identifier, with the help of an AI assistant (Anthropic's Claude models), to propose which published answers to add or improve. Those answers come from our own product documentation and code, or are confirmed by our staff, never from your emails or from the assistant's replies.

3.5 Information We Do Not Collect

• Credit card numbers or bank account details (handled entirely by Stripe)
• Government-issued identification numbers
• Biometric data

4. How We Use Your Information

We use personal information to:

• Provide the service: Print and deliver mail pieces to the recipients you specify
• Process payments: Manage prepaid credit balances and billing via Stripe
• Verify addresses: Check delivery and return addresses with our address verification provider (Smarty) when paid mail is prepared for printing, when a campaign proof is generated, and when a paying account saves a return address in Settings. Name fields are not sent; an address line that itself contains a name, such as a "c/o" line, is sent as written. Nothing is looked up for test-mode mail or test campaigns.
• Answer support and sales email: Emails you send to support@postally.ca or sales@postally.ca are answered with the help of an AI assistant (Anthropic's Claude models), which receives your email and your earlier messages in the same email thread and any replies a person at Postally sent you in it (not our assistant's own earlier replies), the result of our automatic size and format check of any PDF you attach, images of your image and PDF attachments (up to two pages of each PDF, rendered by us), and, if you have an account, a summary of it (company name, design and campaign names, open support requests, counts, statuses, and amounts) with no recipient details. Attachments can show whatever your artwork shows, including names and addresses. For accounts marked as handling health information, and for senders at such an account's email domain, attachment images are never sent, and neither are the replies a person at Postally sent you. Most of its replies are sent automatically. When a message needs a person, a member of our team is told; depending on our settings, the drafted reply may be held for them to review before it is sent, and you then receive a short acknowledgement meanwhile.
• Review designs (optional): If you add AI Proof Review to a campaign, Anthropic's Claude models review your campaign proof and, if you choose the per-piece check, each rendered mail piece, including recipient names and addresses. It is not available for campaigns that include health information.
• Moderate images: Images you upload to the design builder, and snapshots of saved designs, are checked automatically by Amazon Rekognition for prohibited content
• Send notifications: Email you about order confirmations, campaign completions, low balances, and account activity
• Maintain security: Detect and prevent fraud, abuse, and unauthorized access
• Improve the service: Analyze usage patterns to improve reliability and features
• Understand how people find us: Count visits to our public pages and record how a new account arrived (section 3), to judge our search visibility and, if we advertise, which advertising leads to accounts that use the service
• Comply with legal obligations: Respond to lawful requests from authorities

5. Legal Basis for Processing (GDPR / PIPEDA)

We process personal information on the following legal bases:

• Contract performance: Processing necessary to fulfil our service agreement with you (your account, billing, and sending the mail you order). You can record a lawful basis on each recipient you upload.
• Legitimate interest: Security monitoring, fraud prevention, service improvement, and measuring how people find us
• Legal obligation: Tax records, responding to lawful data requests
• Consent: Marketing communications, if we send you any (you may withdraw consent at any time)

6. Data Sharing & Third Parties

We share personal information with the service providers below, and only to the extent necessary to operate the Platform. The table shows what each one receives and where it processes it.

For mail pieces with a QR code that are rendered from HTML rather than from a saved design PDF, our rendering server fetches the QR image from the public QR code service api.qrserver.com. It receives the piece's unique scan link, but not the recipient's name, address, or IP address.

When you connect Klaviyo, Zapier, Make, or Canva, or register a webhook URL, information moves between that service or URL and Postally at your direction. Those services are your providers, not ours, and their own terms apply.

We do not sell, rent, or trade personal information to third parties for marketing purposes.

7. Data Security

We implement the following security measures to protect your data:

• Encryption of stored data: Recipient names, job titles, companies, addresses, email addresses, and phone numbers, and your mobile phone number and two-factor secrets, are encrypted field by field with AES-256-GCM using two keys managed by our application (one for personal information, one for health information), not a separate key-management service. Section 3.2 lists the recipient data that is not encrypted this way; your account email, company name, and Settings return address are not field-encrypted either. Files in Amazon S3 (artwork, print-ready PDFs, proofs, attachments) and the database backups stored in Amazon S3 are encrypted with Amazon S3 server-side encryption (AES-256).
• Encryption in transit: Connections to postally.ca and api.postally.ca use TLS 1.2 or 1.3. Our connections to the service providers in section 6 use HTTPS, with two exceptions: print files reach our print production partner over SFTP (SSH), and the QR scan location lookup sends the scanner's IP address to ip-api.com without encryption.
• Access controls: Role-based access control (RBAC) with granular API key permissions
• Audit logging: Access to and changes of recipient data, and account activity, through the API and dashboard are recorded in an append-only audit log, which is archived daily to write-once (Object Lock) storage
• Password security: Passwords hashed with bcrypt
• API key security: Keys are stored only as SHA-256 hashes, and after creation the dashboard shows only a key's prefix.
• Health information: Recipients you mark as health information are encrypted with a separate key, and API keys can be limited in what health information they can read. We do not offer Business Associate Agreements; read section 9 of our Terms before sending health information.
• Infrastructure: The Platform runs on AWS in Ohio (us-east-2) behind AWS security groups; its database and cache accept connections only from the application server itself. The database is backed up every night to Amazon S3 in Oregon (us-west-2) (see section 8).

8. Data Retention

We keep personal information as follows. Where an item says there is no scheduled deletion, it is kept until it is erased as described here.

• Account data: Kept while your account exists. The ad click identifier in how you found us (section 3.1) is deleted 90 days after you sign up; the rest of how you found us is kept until your account is erased. To close your account, email enrico@postally.ca; we then run an account erasure, which erases your login email, password, company name, phone number, Settings return address, sign-in security settings, the answers you gave at signup and how you found us, and support attachments, revokes your API keys and sessions, and erases every recipient on the account as described below. It does not remove billing, tax, and audit records, the contact details on your past support requests, the emails you exchanged with us, saved API responses (see below), or the artwork, templates, and design files you uploaded, and it does not reach copies already held by our service providers, such as your billing email at Stripe and your company name and account email in QuickBooks Online.
• Recipient data: Kept until it is erased. Deleting a recipient (in the dashboard or with /v1/recipients/delete) hides it but keeps its encrypted record, and a deleted recipient can no longer be found by /v1/gdpr/erasure, so erase a recipient before deleting it; a deleted recipient's data is erased only when your account is erased. Each recipient carries a retention date (by default 2 years after it is added, or 6 years if it is marked as health information when it is added; marking it later does not change the date); nothing is erased automatically when that date passes. A recipient marked as health information cannot be erased through the API before its retention date.
• Print-ready PDFs and artwork: Print-ready PDFs of live mail pieces, and the per-piece artwork you supply, are kept until the recipient or your account is erased; there is no scheduled deletion. Artwork and rendered PDFs for test-mode pieces are deleted 30 days after the piece is created. Files prepared for a postcard mailing that is cancelled, or that expires before you submit it (24 hours after it is created), are deleted.
• Campaign proofs: Kept with the campaign. Erasing a recipient deletes the proofs of the campaigns that mailed them. Proofs of test campaigns are deleted 30 days after the campaign completes, is cancelled or fails, unless a support request about the campaign refers to them.
• Proof change requests: When you ask for changes to a proof, the support request keeps the proof's sample recipient's name, city, province, and postal code, with no scheduled deletion. Erasing that recipient removes them only if the campaign mailed that recipient.
• Mail piece records: Records of each mail piece (status, dates, prices, and tax) are kept for at least 7 years for tax and legal purposes, with no scheduled deletion. Erasing a recipient removes the recipient's details and print-ready PDF from its mail pieces, but not the custom merge values, metadata, or tags you sent with a piece, our record of why a piece failed its print checks (which can quote part of the address), or our records of the webhook events we delivered to your endpoints.
• Templates, designs, and uploaded images: Kept with no scheduled deletion. Recipient erasure does not remove them, and account erasure removes only the background images made when a PDF template is converted for the design builder.
• Saved API responses: Responses saved under an Idempotency-Key (section 3.2) are kept for 24 hours, after which they are no longer used and are deleted from our database by a daily cleanup. Erasure does not remove them within that window.
• Public page visits: Each visit record (page, day, referring domain, campaign tags, and the daily one-way hash) is deleted once 7 full days (UTC) have passed after the day of the visit; only daily counts are kept after that, for 13 months.
• QR code scan records: Each scan record (time, IP address, browser user agent, approximate location) is deleted 24 months after the scan; total scan counts are kept.
• Emails we send you: Our delivery log is deleted after 12 months. Copies of emails we send through Google Workspace stay in our mailboxes with no scheduled deletion.
• Emails you send us: Kept in our mailboxes and support records with no scheduled deletion. Attachments stored on the Platform are deleted when your account is erased. Our record of an email passed to a person (your email address and its subject) is deleted 12 months after it is created, or when your account is erased. If a drafted reply that was to be held for review could not be held, and so was not sent to you, the record also keeps that reply until a person marks your email as dealt with, and for at most 14 days after your email was passed to a person. That reply is never kept for an account marked as handling health information, for someone writing from such an account's email domain, or when we cannot check the sender's account. An entry in our support question log (section 3.4) is deleted 12 months after it is created, or when your account is erased. The copies of those questions used for the weekly review (no identifiers) are deleted from the reviewer's workstation after 8 weeks; account erasure does not reach them.
• AI Proof Review findings for individual mail pieces: Deleted 12 months after they are created
• Suppression list: When a recipient is permanently suppressed (for example, after an opt-out), we keep a keyed, one-way fingerprint of their details after erasure, so the same person can be recognized if they are added to your account again
• Audit logs: Kept in our database with no scheduled deletion; the log is append-only. A copy is archived daily to write-once (Object Lock) storage in Amazon S3 with a 7-year retention period. Erasure does not remove audit-log entries.
• Database backups: The database is backed up every night. Each backup is kept for 30 days in Amazon S3, and the server keeps the last 3 days. Erasure and the scheduled deletions described in this section do not reach existing backups; deleted information leaves them as they expire.
• Print files: Erasure does not reach print files and production lists already sent to our print production partner

9. Your Rights

9.1 All Users

Regardless of your location, you have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information
• Data portability: Request an export of your data in a machine-readable format

9.2 PIPEDA Rights (Canada)

Under PIPEDA, you have the right to:

• Know what personal information we hold and how it is used
• Challenge the accuracy and completeness of your information
• Withdraw consent for the collection, use, or disclosure of your information
• File a complaint with the Office of the Privacy Commissioner of Canada

9.3 CCPA Rights (California Residents)

If you are a California resident, you additionally have the right to:

• Right to Know: Request the categories and specific pieces of personal information collected
• Right to Delete: Request deletion of personal information
• Right to Opt-Out: We do not sell personal information, so this right does not apply. If this changes, we will provide a "Do Not Sell My Personal Information" mechanism.
• Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

9.4 GDPR Rights (EU/EEA Residents)

If you are in the EU/EEA, you additionally have the right to:

• Restrict processing: Request that we limit how we use your data
• Object to processing: Object to processing based on legitimate interest
• Lodge a complaint: File a complaint with your local data protection authority

9.5 How to Exercise Your Rights

You can exercise your data rights in two ways:

• Via API (for recipients in your account): Use the /v1/gdpr/access, /v1/gdpr/export, and /v1/gdpr/erasure endpoints for a recipient. Erasure removes the recipient's stored details, print-ready PDFs, per-piece artwork, QR scan records, and the proofs of campaigns that mailed them. It does not reach database backups until they expire, files already sent to our print production partner, audit-log entries, or the other items listed in section 8.
• Via email: Contact enrico@postally.ca with your request. We will respond within 30 days.

If you received mail sent through Postally, the organization that sent it decides what is mailed to you and holds your information in its account. Contact that organization to exercise your rights; you can also contact enrico@postally.ca.

10. Cookies & Tracking

The Platform uses minimal cookies:

• Session cookie (dm_session_v2): Required for dashboard authentication. Expires after 7 days.
• Browser storage: Your light/dark theme, sidebar state, whether you hid the dashboard's Getting started card, and signed-in account details (such as company name, email, and plan) are kept in your browser's local storage. An unfinished campaign draft, including any recipient list you uploaded, is kept in your browser's session storage until you close the tab. When you open one of our public pages, how you arrived (section 3.1) is kept in that tab's session storage until you close the tab, and is sent with your signup only if you create an account in that tab.

We count visits to our public pages ourselves (first-party), without cookies, as described in section 3.3; no other page of the signed-in dashboard is measured. We do not use third-party tracking cookies, advertising pixels, or third-party analytics services. If your browser sends a Global Privacy Control or Do Not Track signal, our pages neither count your visit nor keep how you arrived.

11. Where Your Data Is Stored and Processed

Postally is a Canadian company, but the Platform is hosted in the United States. Our application servers and database run on Amazon Web Services in Ohio (us-east-2). Files (artwork, print-ready PDFs, proofs, and support attachments), database backups, and audit-log archives are stored in Amazon S3 in Oregon (us-west-2). Mail is printed by our print production partner in Burnaby, British Columbia, Canada, and delivered by Canada Post (and, for mail sent outside Canada, by the destination country's postal service).

Personal information you give us, including your recipients' names and addresses, is therefore stored and processed in the United States, wherever you or your recipients are located. While it is there, it is subject to US law and may be accessible to US courts, law enforcement, and national security authorities.

Other service providers in section 6 also process data outside Canada: Smarty in the United States, and Stripe, Anthropic, Google, and Intuit in the United States and other countries where they operate. ip-api.com and api.qrserver.com do not state where they are located.

The data region field on your account (set to Canada at signup) and on each recipient is a label for records only. It does not change where data is stored.

12. Breach Notification

In the event of a data breach that poses a real risk of significant harm, we will:

• Notify affected individuals as soon as feasible
• Report to the Office of the Privacy Commissioner of Canada as soon as feasible, as PIPEDA requires
• Report to relevant supervisory authorities as required by GDPR
• Notify the California Attorney General where California's data breach notification law requires it
• Maintain a record of all breaches in our internal breach log

13. Children's Privacy

The Platform is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child, we will delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or dashboard notification at least 30 days before taking effect. The "Last Updated" date at the top of this page will be revised accordingly.

15. Contact Us

For questions, concerns, or requests related to this Privacy Policy or your personal information:

Privacy Officer
Apricity Advisory Ltd., operating as Postally
Email: enrico@postally.ca
General support: support@postally.ca

If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada.