Privacy Policy

HomeDrop Mail is operated by [the registered company name], [the entity type and state of formation] (“we”, “us”). This policy covers homedropmail.com and the sending service behind it.

It matters which of two situations you are in, because they give you different rights and a different person to ask:

• You are a customer: you have an account and send mail. We decide how your account data is handled, so requests about it come to us.
• You received mail we printed: one of our customers chose to write to you, using an address list they supplied or an audience they built. For that data we act on our customer’s instructions, not our own. We will still act on a request from you directly, and we will pass it to the customer who sent it; see section 9.

Account information

Your name and email address, your organisation’s name, and who else you have invited. We do not use passwords. You sign in with an emailed link or with Google, and if you use Google we receive your name, email address and profile picture from them.

Billing information

Your subscription status, your credit balance, and a record of every charge and every piece of mail it paid for. We never see or store your card number. Card details are entered on Stripe’s own checkout page and held by Stripe; what reaches us is a customer reference and the card’s brand and last four digits.

Recipient information

Addresses reach the service three ways, and they are not the same:

• Lists you upload. Whatever is in your file: typically addresses, sometimes names, email addresses, or your own custom fields used in the message.
• Neighbours of an address. Drawn from a public address dataset assembled from government address records. It contains street addresses and locations only. No names, no phone numbers, nothing about who lives there. That is why letters to a neighbour audience are addressed to a generic name rather than a person.
• Recently-sold homes. Property records from a third-party data provider, sourced from public filings.

What you write and design

Message templates, the finished message sent to each recipient, uploaded artwork, and your return address.

Technical information

A sign-in cookie so you stay signed in. Ordinary server logs. When someone opens a personalised preview link we printed, we record that it was opened, when, roughly what kind of browser it was, and a one-way hash of the IP address rather than the address itself, which is enough to tell one reader from ten, not enough to work out where anyone is. We use it to separate genuine readers from link scanners and our own staff.

There are no advertising cookies and no third-party analytics on this site. Nothing here tracks you across other websites.

• Running the service: building audiences, rendering messages, and posting mail.
• Taking payment, maintaining your credit balance, and preventing double-charging.
• Telling you things you need to know: mail that could not send, a card that was declined, a balance about to run out.
• Preventing abuse: rate limits, bot checks, and fraud prevention.
• Keeping records we are required to keep, such as financial records.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in California law. We do not use your address lists or your mail content to build audiences for anyone else.

Printing and posting a letter means handing it to someone with a printer. These are the companies involved and what each one receives:

We also disclose information where the law requires it, and to a buyer if the business is sold, in which case this policy continues to apply until you are told otherwise.

• Account and organisation records: while your account is open, and for up to 30 days after you close it.
• Address lists and audiences: until you delete them, or until 30 days after your account closes. Ask us at support@homedrop.io and we will remove a list for you.
• Mail records: what was sent, to which address, and what it cost. Kept for seven years, because they are financial records and evidence that mail we were paid for was actually posted.
• Link-open records: 24 months.

Backups lag deletion by up to 30 days. Records we are required by law to keep, such as invoices and tax records, are kept for the period the law specifies regardless of a deletion request.

Everything travels over encrypted connections and is stored encrypted at rest by our hosting and database providers. Access is limited to the people who need it to run the service. API keys are stored hashed. Card numbers never touch our servers.

No service can promise it will never be breached. If personal information is exposed, we will tell affected customers and, where required, the relevant authorities, without undue delay.

Depending on where you live, you may have the right to know what we hold about you, to get a copy, to correct it, to have it deleted, and to not be discriminated against for asking. California residents have these rights under the CCPA/CPRA; several other states have close equivalents.

Ask at support@homedrop.io or write to [a postal address for rights requests and notices]. We will verify that the request is really yours, usually by replying to the address on file, and respond within 45 days. An authorised agent may act for you with written permission.

If you are in the UK or EU: we rely on performing our contract with you for account and billing data, on legitimate interests for security, abuse prevention and measuring whether printed links get opened, and on our customers’ instructions for their address lists. The service is operated from and hosted in the United States.

This is a business tool. It is not directed at anyone under 18, and we do not knowingly collect information from children. If you believe a child’s information has reached us, tell us at support@homedrop.io and we will delete it.

Email support@homedrop.io with the address as it appeared on the envelope. We will add it to the suppression list of the customer who sent it, so that customer’s future campaigns skip it, and we will pass your request on to them.

Be aware of what that does and does not do. Suppression is recorded against the customer who wrote to you, not across every customer of the service, so a different business using HomeDrop Mail could still write to you. If you want to reduce advertising mail generally, the DMAchoice service run by the Association of National Advertisers covers many senders at once, and your local authority may run its own scheme.

Mail already handed to the printer cannot be recalled. A suppression request stops what has not gone out yet.

If we change this policy in a way that matters, we will update the date at the top and email account holders before it takes effect. Continuing to use the service after that means the new version applies.

Questions, requests, or complaints: support@homedrop.io, or [a postal address for rights requests and notices].