Privacy Policy | Maily Pop

1. Who we are

Maily Pop is operated by Houston Automation Lab, a USPS-registered Commercial Mail Receiving Agency (CMRA) at 7814 Laurel Gem Dr, Houston, TX 77016. This policy explains what personal information we collect, why, who we share it with, and the choices you have. Contact us at hello@mailypop.com.

2. What we collect

Account details: your name, email address, password (stored only as a secure hash), plan and PMB number.
Identity documents: your notarized USPS Form 1583 and the identification it requires, plus any document you send to verify a custom mailbox name.
Addresses: the home or forwarding addresses you give us.
Your mail: photos of the outside of each envelope, the sender and recipient we read from it, and, when you request a scan, images of the contents.
AI-generated data: summaries and categories of your scanned mail, and the questions you ask the mail assistant.
Payments: handled by Stripe. We keep your Stripe customer and subscription IDs and a record of transactions, but never your full card number.
Usage and device data: login times, and data collected by the analytics and advertising tools described below.

3. How we use it

to receive, photograph, scan and shred your mail, and show it to you in your dashboard;
to verify your identity and meet USPS requirements for CMRAs;
to bill you and manage your subscription and scan credits;
to email you about new mail, completed scans, your account and security (for example password resets and cancellation confirmations);
to generate summaries of your mail and answer your assistant questions;
to provide support, prevent fraud and abuse, and keep the service secure; and
to measure our advertising (see section 5).

We do not sell your personal information.

4. Who we share it with

We share information only with service providers that help us run Maily Pop, and only what each one needs:

Supabase: database and file storage for your account and mail images.
Vercel: hosting for our website and app.
Stripe: payment processing and subscriptions.
Resend: sending our emails to you, and receiving emailed documents such as your Form 1583.
OpenAI: when you use the mail assistant, your question and the summaries, senders and dates of your recent mail are sent to generate an answer.
Adobe PDF Services: combining scanned pages into PDF documents.
AI providers: the summaries and categories shown for scanned mail are generated by third-party AI providers, which we may change from time to time.

We also disclose information to the U.S. Postal Service as CMRA rules require, and to law enforcement or others when required by law or to protect our customers and service.

5. Cookies, analytics and advertising

We use a secure session cookie to keep you logged in. Our website also uses:

Vercel Analytics to understand how the website is used;
Google Ads (Google tag) to measure the results of our ads; and
LinkedIn Insight Tag to measure the results of our LinkedIn ads.

Google and LinkedIn may use cookies and similar technologies under their own privacy policies. You can limit ad personalization in your Google and LinkedIn settings and by blocking third-party cookies in your browser.

6. How long we keep it

We keep your account information and mail images while your account is open.
When you shred a piece of mail, the physical item is destroyed. Its images stay in your dashboard for 30 days and are then deleted.
When you cancel, we remove your name, email, password, custom name, Form 1583 file references and notes from your account. We keep your PMB number, addresses, transaction history and Stripe references because CMRA and financial record-keeping rules require it. We keep those records for at least one year.
Your mail images, Form 1583 documents and identification documents are deleted from our storage 30 days after you cancel.

7. Security

Passwords are hashed, connections use HTTPS, and staff access to customer accounts is limited and logged. No system is perfectly secure, so please use a strong, unique password and tell us right away if you suspect unauthorized access.

8. Your choices and rights

You can see your mail and account details in your dashboard at any time.
You can update your address and request scans or shredding from your dashboard.
You can cancel your account at any time, which removes your personal details as described above.
To request a copy of your data or ask a privacy question, email hello@mailypop.com. Depending on where you live, you may have additional rights under state privacy laws, such as the Texas Data Privacy and Security Act or the California Consumer Privacy Act.

9. Children

Maily Pop is not intended for anyone under 18, and we do not knowingly collect information from children.

10. Changes to this policy

If we make significant changes to this policy, we will email you before they take effect.