Mailyard privacy policy

Mailyard, Inc. ("Mailyard," "we," "us") operates mailyard.ai, the Mailyard product at app.mailyard.ai, the QR code links on our customers' letters at go.mailyard.ai, and the letter pages at view.mailyard.io, and provides direct-mail services to business customers. This policy explains what personal information we collect, how we use and share it, and the choices you have. It covers three groups of people:

Visitors to our website, mailyard.ai;
Customers, their team members who use Mailyard, and the people they ask to review a letter before it mails;
Recipients, the people our customers ask us to find addresses for and mail.

If you received a letter and want to know how we got your address, see section 4.

1. Visitors to our website

When you visit mailyard.ai, our hosting provider keeps standard server logs (IP address, browser type, pages requested and times) for security and reliability. If you email us or fill in a form, we keep what you send.

We also use cookies, pixels and similar technologies from the analytics, advertising and visitor-identification providers below. They can collect your IP address, browser and device details, cookie identifiers, the pages you view, the page that sent you to us, what you click and when. We use them to understand how the website is used, to measure and improve our marketing, to show Mailyard ads to people who have visited, and to learn which businesses are interested in Mailyard. Each provider may also use this information under its own privacy policy, and may combine it with information it already has about you.

Google Analytics (Google LLC) measures visits and how people use the website. We also use its advertising features, such as Google signals, to measure our ads and build audiences for advertising on Google. See Google's privacy policy.
Meta Pixel (Meta Platforms, Inc.) measures our Facebook and Instagram ads and lets us show ads to people who visited. See Meta's privacy policy.
TikTok Pixel (TikTok) measures our TikTok ads and lets us show ads to people who visited. See TikTok's privacy policy.
LinkedIn Insight Tag (LinkedIn Corporation) counts visits, shows us aggregate information about the professional audience visiting our site, and lets us show ads on LinkedIn to people who visited. See LinkedIn's privacy policy.
RB2B identifies some U.S. visitors to business websites. When it can match your visit to professional information it holds, it may tell us your name, job title, company, LinkedIn profile and business email address, along with the pages you viewed. We may use this to follow up with you about Mailyard by email or LinkedIn. You can ask us to stop at any time. When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout.
Mixpanel (Mixpanel, Inc.) records how people use our website and product, such as pages viewed and features used, so we can improve them. In the product, it is linked to your account. See Mixpanel's privacy policy.
Crisp (Crisp IM SAS) runs the chat window on our website. It receives the messages you send us, any name or email you give in the chat, and basic details about your browser and visit, and it sets a cookie so a conversation stays open from page to page. See Crisp's privacy policy.
In the Mailyard product, we may also use advertising pixels to record conversion events, such as signing up, starting a plan or making a purchase. They do not receive your contact lists, recipients or campaign content.

We never send these providers the lists our customers upload, the people our customers mail, or campaign content. We may share information about our own customers and prospects with advertising providers, such as the email address you signed up with or gave us, and events like signing up or making a purchase, to measure our ads and to build custom and lookalike audiences. On mailyard.ai, Google Analytics and the advertising and visitor-identification tools load unless you decline them in our cookie banner. Mixpanel, which we use for analytics only, loads for all visitors. Under some U.S. state laws, using these tools can count as "selling" or "sharing" personal information or as "targeted advertising." You can change your choice at any time, as described in section 10. We may add or change providers over time and will update this list when we do.

2. Information we collect from customers

Account data: name, work email, password (stored hashed), organization name, role and the invitations you send to teammates.
Payment data: handled by our payment processor. We receive your name, email, card brand and last four digits, and transaction records. We never see or store full card numbers.
Campaign data: the contact lists you upload or send through an integration, column mappings, letter copy and images, return address, landing-page links, proofs, approvals, and each campaign's delivery and scan results.
Usage and security data: sign-in events, IP address, device and browser type, actions taken in the product, product analytics events, and an audit trail of sensitive actions such as approvals, payments and address edits.
Support communications: emails and messages you send us.
Proof reviews: if a customer sends someone a link to review a letter's proofs, we record when the page is opened and the type of device, and, if that person answers, the name, email and notes they enter and their decision. We show these to the customer. The mailing address on each proof is covered by default. The page sets no cookies and loads its typefaces from Google Fonts.

3. How we use customer information

We use it to provide the service (find and verify addresses, help you write letters, print, mail and track your campaigns), to bill you, to secure accounts and prevent fraud and abuse, to answer support requests, to understand how the product is used and improve it, including address-finding quality, and to meet legal obligations. We send service messages about your campaigns and account. We may send you marketing email about Mailyard, and every marketing email has an unsubscribe link. We do not sell customer information, and we do not use your contact lists for anything other than your own campaigns. We may also create aggregated or de-identified information that no longer identifies any person and use it for any lawful purpose, such as measuring and improving our services.

4. Recipients: the people our customers mail

Where your information comes from. A Mailyard customer gave us a list that included you, usually a work email address or a LinkedIn profile link, and sometimes a name, company, title, city or an address they already had. Our job is to find a business mailing address for you so that customer can send you a letter.

How we find an address. We research where your company says it operates, using public sources such as the company's website, its LinkedIn page, business listings and public filings, along with third-party data providers and AI research tools. We look for business addresses only and never search for where someone lives. A business's published address is sometimes also where its owner lives, for example a home-based business, and we use such an address only because the business lists it publicly. Each address is checked against USPS address standards (CASS) before anything mails, and addresses we cannot confirm are held, not mailed.

What we keep. The details the customer supplied, the address we found and its sources, the verification result, whether a letter was sent and whether the QR code on it was scanned. We keep this so the customer can see what was mailed, and so people who opt out are not mailed again.

Who we act for. We process your information as a service provider to the customer who gave us the list. That customer decided to mail you and chose what the letter says, and their name and return address are on it. We do not sell the addresses we find or build a database of them for sale.

QR codes and letter pages. The QR code on a letter opens a go.mailyard.ai link. If you scan it, we record the time of the scan, your device type and limited technical information, such as the IP address our hosting provider logs for security, then send you to the customer's landing page with an opaque code and, where the customer supplied one, their own record ID for you. If the customer sent you a link to view your letter online, it opens on view.mailyard.io, and we record views and clicks the same way. These pages set no cookies. They load their typefaces from Google Fonts, so your browser also sends Google your IP address and browser details. We do not use scans or letter views to track your precise location or build a profile of you. What happens on the customer's landing page is covered by the customer's privacy policy, not ours.

Your choices. Email privacy@mailyard.ai. If we can identify you from what you send us, we will add you to the do-not-mail list of the customer whose list included you, so they do not mail you through Mailyard again, and delete the address and research record we hold about you, except what we need to keep the do-not-mail entry and our accounting records. If you received a letter, the sender's name and return address are on it, and you can also contact them directly. A do-not-mail request covers mail sent through Mailyard, not mail a business sends some other way. These requests are free and need no account.

Service providers run parts of the service for us, under contracts that let them use the data only to provide their service to us. They include:

Supabase, which hosts our database and file storage, including account, campaign and recipient data;
Vercel, which hosts our website and application and keeps server logs;
Google Workspace, where we keep waitlist signups (name, work email, company and your answers);
Cal.com, which schedules the demos and calls you book on our website and receives the name, email and anything else you enter when booking;
Crisp, which runs the chat on our website and receives the messages you send through it;
Mixpanel and Google Analytics, for analytics and, for Google Analytics, advertising measurement and audiences, as described in section 1;
our printing and mailing partner, which receives each recipient's name, address and letter content to print and mail it;
USPS address verification, background processing, payment processing and email delivery providers; and
the AI and public-data services we use to research business addresses and help write letters.

We also share information with:

Advertising and visitor-identification providers (Google, Meta, TikTok, LinkedIn and RB2B), for website visitors and for conversion events and audiences about our own customers, as described in section 1;
Google Fonts (Google LLC), which serves the typefaces on mailyard.ai, app.mailyard.ai and our QR code, letter and proof review pages, and receives each visitor's IP address and browser details when a page loads;
The customer whose campaign the data belongs to, and the people that customer asks to review its letters;
Professional advisers, such as lawyers, accountants and insurers;
Authorities or others when the law requires it, to enforce our terms, or to protect rights, safety or property; and
A buyer, successor or investor, and their advisers, in connection with an actual or proposed merger, acquisition, financing, reorganization, bankruptcy or sale of all or part of our business, stock or assets, including during due diligence. Personal information may be among the assets transferred, and the new owner may continue to use it as described in this policy.

We do not sell the lists our customers upload, recipient information or campaign data, and we never share them with advertising platforms. Transferring information as part of a merger, acquisition or similar transaction is not a sale.

6. How long we keep information

We keep account and campaign data while the customer's account is active, and delete campaign data when the customer asks, except records we must keep for accounting, tax, disputes, security or legal reasons. Do-not-mail entries are kept indefinitely, since deleting one would allow that person to be mailed again.

7. Security

Data is encrypted in transit, and our database and storage providers encrypt it at rest. Access to customer data is limited to the customer's own organization. We keep uploaded rows, postal addresses and payment details out of our logs, and record sensitive actions in an audit trail. No system is perfectly secure; if a breach affects your information, we will notify you and any regulator as the law requires.

8. Data we do not accept

Mailyard is not for health information, financial account numbers, government ID numbers, information about anyone under 18 or other regulated categories. Customers agree not to upload them, and we may delete such data and pause the campaign if we find it.

9. Your rights

Depending on where you live, including California, Colorado, Connecticut, Oregon, Texas, Virginia and other U.S. states with privacy laws, you may have the right to know what personal information we hold about you, to get a copy of it, to correct it, to delete it, to opt out of its sale, sharing or use for targeted advertising, and not to be treated differently for using these rights. To use a right, email privacy@mailyard.ai. You can also use an authorized agent. We will verify your request with the information you provide and respond within the time the law allows. If we decline, you can appeal by replying to our answer. Where we act as a service provider for a customer, we may pass your request to that customer or handle it for them.

The service is offered to U.S. businesses for U.S. mail, and information is processed in the United States.

10. Your privacy choices for this website

Cookie banner. When you first visit mailyard.ai, our cookie banner lets you decline Google Analytics and our advertising and visitor-identification tools (Meta, TikTok, LinkedIn and RB2B). They load unless you click Decline or close the banner. To change your choice, use the "Cookie settings" link at the bottom of any page. We record each choice, without your name or email, so we can show that we honored it.
Global Privacy Control. If your browser or an extension sends the Global Privacy Control signal, we treat it as a request to opt out of sale and sharing and as a Decline, and we do not load those tools for that browser, on mailyard.ai or in the product.
RB2B. Opt out of visitor identification and the marketing that follows from it at app.retention.com/optout.
Opt out by email. Email privacy@mailyard.ai to opt out of the sale or sharing of your personal information, including use of your information for custom or lookalike audiences, or to ask us to stop contacting you after a visit identified by RB2B.
Provider settings. You can turn off ads based on other websites in your LinkedIn, Meta and TikTok ad settings, and opt out of Google Analytics with Google's browser add-on.
Your browser. Block or delete third-party cookies.
Marketing email. Use the unsubscribe link in any marketing email from us.

The Mailyard product at app.mailyard.ai uses cookies needed to keep you signed in, Mixpanel product analytics, and advertising pixels that record conversion events only. It does not use visitor-identification tools.

11. Children

Mailyard is not directed to anyone under 18, and we do not knowingly collect information about children.

12. Changes to this policy

We will post any changes on this page with a new date and, for material changes, tell customers by email or in the product.

13. Contact

Questions and privacy requests: privacy@mailyard.ai. Mailyard, Inc.