Privacy Policy

We share your information only as necessary to provide our service:

We may send Microsoft your verified-signup, checkout-start and confirmed-purchase times and references, using a hashed version of your account email, your latest valid Microsoft ad click reference, or both. Email matching can work without a saved ad click reference. Purchases include amount and currency. We do not send Microsoft your plaintext email, documents, mail contents or recipient details for this measurement. Your advertising measurement setting and browser privacy signals control this sharing too.

We do not sell your personal information to third parties.

If you connect an assistant to Postmarkr, we use WorkOS to manage that connection and share your Postmarkr account ID and email with WorkOS. You sign in to Postmarkr and confirm which account to connect. Your assistant provider also processes information you share with it under its own privacy policy.

When you ask the assistant to prepare a letter, it sends Postmarkr your letter text, recipient and return postal addresses, and a request reference used to recognize retries. Preparation saves an unpaid draft and a visible letter template, and may add entries to your address book. We return the letter reference, review link and next step to the assistant. Status requests use a letter reference to return status information for your account. Connecting or preparing a draft does not authorize payment or mailing; you review the proof and current price and pay on Postmarkr.

During connection, temporary connection identifiers (external_auth_id and client_state) can appear in browser referrer information sent by our WorkOS-hosted sign-in service to that service, forwarder.workos.com and persistent.oaistatic.com. WorkOS also sends those identifiers in telemetry request bodies to its forwarder. We have observed one-time authorization codes and connection state in referrers on requests within ChatGPT and within OpenAI Platform, each staying on its own website. We do not know how long these providers retain this information or whether they forward it onward.

These observations concern the specific connection information and destinations above; they do not authorize sending passwords, access or refresh tokens, letter text or postal addresses in connection telemetry. Postmarkr-owned logging and analytics are designed to exclude credentials, temporary connection identifiers, letter text and postal addresses.

You can disconnect an assistant in Settings → Connected apps. Disconnect removes that app's access for your account across its connections, rather than only on the current device. It does not delete saved letters, templates or addresses, or recall information already shared with your assistant provider. For deletion requests, see Your Rights below.

Documents: Your uploaded PDF files are encrypted in transit and at rest. Uploaded documents and generated mailing proofs follow different retention lifecycles.

Mailing history: We retain records of your mailings (addresses, dates, tracking) for your reference and potential support needs.

Account data: Your account information is retained until you delete your account.

Attribution events: Detailed attribution event records are retained for up to 13 months.