Skip to content

Privacy Policy

What we keep, why we keep it, and when it goes. Every period on this page is a setting in the software, not an intention.

Effective 6 September 2026.

Your letter

We never store the printed PDF. It is not kept anywhere — it is rebuilt from your text at print time and checked against a hash to prove it is the same document you approved.

We do keep the text, for 90 days. Your letter’s text is held for 90 days after the letter is mailed, cancelled or blocked, and then deleted. We keep it that long for one reason: if you dispute the charge, or someone makes a legal demand about a letter, the text is the only thing that answers it. A letter under an open legal hold is kept until the hold is released.

A draft you never send, and any preview PDF made from it, is deleted after 24 hours.

Who you wrote to

The recipient’s name and full address are kept for two years, so that a receipt still says who a letter went to. After that we cut the record down to the ZIP code and blank the name.

One thing survives that: a one-way fingerprint of the address. It is not an address and cannot be turned back into one, and we keep it permanently on purpose — it is how someone who has told us never to write to them again stays unwritable-to after we have thrown the address itself away.

What we keep for as long as we operate

Each of these is kept for a specific reason, and the reason is the limit on its use.

  • Your email address — it is how you sign in and how we tell you what happened to a letter.
  • Payment and tax records — amounts, refunds, and the sales tax on each letter. These are accounting records we are required to be able to produce.
  • The mailing record — the letter ID, the service tier, the mail date and the USPS scan events for that piece. This is what makes a receipt worth having, which is most of the point of the product.
  • Your return address — it is printed on the envelope, so undeliverable mail comes back to you.
  • The authorisation record — when an order is confirmed we record which client and which agent confirmed it, when, and the IP address and browser or client it came from. This is the proof of who authorised a charge, and it is what we would use to answer a chargeback. We keep it for that, and we do not use it to build a profile of you — it is never sent to the analytics described below, and nothing joins the two.

Letters we refused, and why that record is long

Every letter is checked against a list of things we will not mail. That check runs on our own servers using fixed rules — no outside service sees your letter, and no AI model reads it.

We keep the decision for seven years, including approvals. Where a rule matched, the record holds a short excerpt — at most a sentence — of the words that matched it. Social security numbers, dates of birth and labelled record or account numbers are masked out of those excerpts as they are written. We keep these because being able to show we were not wilfully blind about what we put in the mail is the record that matters if we are ever asked.

Our own operations log

We record the calls your assistant makes to us — which tool, whether it worked, and the identifiers involved — for 90 days, so we can see what went wrong when something does.

Your letter’s text is stripped out of that log on every path, whether the call succeeded or failed; what is stored in its place is a reference and a hash. The recipient address you passed does appear in these records, and is deleted with them after 90 days.

Who else sees your data

We print and mail your letters ourselves, in New York. There is no print vendor and no mailing house — your letter is not handed to another company to produce. Beyond PaperAgent, five parties are involved, and only the first four are involved in sending a letter at all:

  • Stripe takes the payment. Stripe receives the amount, a description of what was bought, and our order reference. It does not receive your name, your address, your recipient, or your letter.
  • Postmark delivers our email — sign-in codes and letter updates. It receives your email address and the message.
  • Google’s Address Validation service checks that a destination address is real and deliverable. It receives the address only — no name, and never any part of your letter.
  • USPS carries the mail, and receives the physical envelope: the recipient, your return address, and the letter inside it.
  • Google Analytics counts how the service is used — visits to this website, and which tools your assistant called and what a letter cost. It is a second, separate Google service from the address check above and it receives none of what that one does: no addresses, no recipients, nothing from a letter. See Analytics below for exactly what it does receive.

If you use PaperAgent through an AI assistant, that assistant’s operator sees whatever you type into it. That relationship is between you and them and is covered by their privacy policy, not this one.

Analytics

This site uses Google Analytics to count visits and to see which pages people read before they connect. It sets cookies in your browser so Google can recognise the same browser across visits. Google receives the pages you view, the site that referred you, your approximate location from your IP address, and your device and browser.

We also count the part of the service that happens inside your AI assistant, where there is no website to measure: that a tool was called and which one, whether it failed, how long it took, which assistant it came from, how far a letter got through printing and posting, and — when a letter is paid for — the amount and our order reference. This is sent from our own servers, not from your browser.

Google receives nothing about your letters, your recipients, or your addresses. Not the recipient’s name, not a line of an address, not a word of what you wrote, and not the error message when an address is rejected — that sentence quotes the address, so it is withheld too. What we send is written out field by field in our code rather than copied from a record with parts removed, and a test fails the build if any of it appears in what would go to Google.

We do not connect a visit to this site with a customer account. The two halves above are counted separately and nothing joins them: the website measurement is tied to a browser cookie, the service measurement to a one-way hash of your session, your key, or — before you have signed in — the connection the call arrived on, and neither is ever given the other. So we cannot tell you that a particular visitor became a particular customer, and neither can Google. That is a choice, and it costs us the most useful marketing report there is.

Your account identifier is never sent as itself. Where the service measurement needs to group one conversation’s events together it uses a hash, which lets Google count sessions without holding anything that could be matched back to you or to an order.

Fonts are still served from this domain rather than fetched from someone else’s, and the letter-preview PDFs an assistant hands you carry no analytics of any kind. Until 21 August 2026 this site ran no analytics at all and this page said so.

Your choices, stated honestly

You can change which updates we email you, and anyone can ask us never to mail them again — that request is permanent and applies across every customer.

For anything else — a copy of what we hold, a correction, or deletion — write to [email protected] and a person will handle it. We would rather say that plainly than advertise a self-service button that does not exist. Two limits are worth knowing before you ask: records we are required to keep for tax, or that are under a legal hold, we cannot delete on request; and our database backups are kept for about eight weeks, so deleted records persist in those backups until they age out.

Security

Letters and their contents are held on our own server, in files readable only by the service account that needs them. Sign-in codes, access tokens and API keys are stored only as hashes — we cannot read yours back, which is why a lost key is replaced rather than recovered.

Contact

PaperAgent is a service operated as a sole proprietorship. Write to [email protected] with any privacy question. If we change this policy we will change the effective date at the top.