1. Scope
This Privacy Policy explains how DirectSnail (“DirectSnail,” “we,” “us,” or “our”) handles information when someone visits directsnail.com, uses the DirectSnail Shopify application, contacts us, or receives a postcard sent through our service.
2. Our role
For customer information supplied by a Shopify merchant, the merchant decides why and to whom a postcard is sent. DirectSnail processes that information as the merchant’s service provider or processor and only on the merchant’s instructions. Merchants remain responsible for their own privacy notices and lawful use of customer information.
Our line is simple: we do not sell recipient information, use one merchant’s customer data for another merchant, or use recipient data to create advertising audiences of our own.
3. Information we handle
| Information | Why we use it |
|---|---|
| Merchant account information | To authenticate the Shopify store, administer the account, provide support, and communicate about the service. |
| Shopify customer names, postal addresses, and limited order attributes | To build merchant-selected audiences, personalize, address, suppress duplicates or opt-outs, mail postcards, and measure campaign results. |
| Designs, images, PDFs, and campaign settings | To render proofs, perform print checks, and produce mail selected by the merchant. |
| Campaign, delivery, and attributed-order records | To show delivery status, maintain financial records, troubleshoot, and report campaign performance. |
| Billing status and mail-credit activity | To manage prepaid mail credit and charges through Shopify. DirectSnail does not receive full payment-card details. |
| Website and security logs | To operate, secure, diagnose, and improve the service. |
| Support and opt-out communications | To answer requests, investigate issues, and maintain suppression records. |
4. How we use information
- Provide and secure the DirectSnail application and public website.
- Create proofs and submit merchant-approved postcards for printing and delivery.
- Validate, deduplicate, and suppress postal addresses.
- Track mail delivery and attribute orders using campaign offer codes.
- Process billing through Shopify, maintain the wallet ledger, and prevent duplicate charges.
- Respond to support, privacy, and recipient opt-out requests.
- Comply with law, enforce our terms, and investigate fraud or security incidents.
5. When information is shared
We share information only as needed to operate the service, follow a merchant’s instructions, comply with law, or protect the service. Service providers currently include:
- Shopify, for the commerce platform, authentication, merchant data access, and billing.
- Lob, for address verification, printing, postal delivery, and delivery events.
- Railway, for application and database infrastructure.
- Cloudflare R2, for storage of merchant artwork and generated assets.
We may also disclose information if required by a valid legal process, during a business transaction subject to appropriate safeguards, or with the relevant person’s direction.
6. Retention and deletion
We keep personal information only as long as needed for the purposes above. DirectSnail is designed to remove recipient names and postal-address fields from completed mail records after 180 days while retaining non-personal operational and financial history. Raw webhook payloads are retained for up to 90 days. Suppression records may be retained longer so an opt-out or undeliverable household is not mailed again.
Shopify privacy webhooks are used to process merchant and customer access, deletion, and store-erasure requests. Legal, security, and financial obligations may require limited records to be kept longer.
7. Security
We use administrative, technical, and organizational safeguards appropriate to the information processed, including encrypted transport, access controls, tenant isolation, signed webhook verification, limited data collection, and audit logging. No security measure can guarantee absolute protection.
8. Cookies and analytics
DirectSnail uses session and security technologies necessary to authenticate merchants and operate the embedded Shopify application. The public website does not currently use advertising cookies or sell browsing activity.
9. Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, or restrict certain personal information. Shopify customers should generally contact the merchant they purchased from first because that merchant controls the customer relationship. You may also contact us and we will route or assist with the request.
To stop receiving postcards sent through DirectSnail, use the recipient opt-out page. We apply verified requests at the household level for the identified sender.
10. Children and international use
The service is intended for businesses and is not directed to children. DirectSnail currently supports United States postal campaigns. Information may be processed in the United States, subject to appropriate contractual and legal safeguards.
11. Changes and contact
We may update this policy as the service evolves. Material changes will be reflected by the date above and, where appropriate, communicated in the application. Questions or requests can be sent to privacy@directsnail.com.