What we do with your information.

Post Timely Inc. (the "data controller" in privacy language) is incorporated in Alberta, Canada and operates Kind Post at kindpost.cards. If you have questions or a privacy request, reach us at bekind@kindpost.cards.

When someone sends you a card through Kind Post, theyare the sender, not us. Post Timely Inc. is the messenger — we draft, print, and deliver the card on the sender's behalf. Outbound messages we send to you identify the sender by name (unless they chose anonymous outreach, in which case the message says a friend sent the card). Your relationship is with them.

We honor opt-outs and STOP signals against the sender, and we won't share your information with anyone other than the subprocessors below who help us actually mail the card.

• Email address (for sign-in)
• Optionally a phone number (if you sign in with phone)
• The card content you create — the brief, draft messages, photos you upload
• Optional notes about the recipient (gender, visual description, things about them) you add to help us draft the card. These are private to your account and never shown to the recipient.
• The recipient's first name and any contact info you give us
• Payment method details (handled by Stripe; we never see your card number)
• Logs of what you did and when, for support and audit

• Name and mailing address (when needed to mail a card)
• Phone or email, only when the sender asked us to reach you to ask for the address or to send you a digital card
• Replies to our messages, including STOP / HELP responses
• Logs of when we contacted you and how

We rely on the sender's attestation that they have a real reason to contact you (a personal or family relationship, an existing business relationship, or your prior consent). If they don't, you can tell us by replying STOP, by not responding, or by deleting your information using the link below.

Signers are people the sender invites to add a note to a card. We collect the signer's first name, the contact info the sender provides, the signer's note + signature, and logs of the invite + reply.

We use sender data to operate Kind Post: signing you in, saving your work, charging you when we mail or send digital cards, and responding when you contact support.

We use recipient and signer data to do exactly what the sender asked: ask for an address, mail a card, send a digital version, or invite someone to sign. We use the minimum amount of information needed to accomplish that.

If you choose to create your own card (as opposed to picking from the gallery), we use AI models to draft three card directions for you to choose from. We send the brief you wrote, the recipient's first name, and any optional notes you added to a third-party AI provider for that draft. We don't keep a separate copy of those API calls beyond the cards table, and we don't use your data to train external models.

• Show recipients' addresses to senders
• Sell your information
• Use your information to train external AI models
• Share data with anyone other than the service providers below, who need it to make the card flow work

The companies below help us operate Kind Post. They process data on our behalf under data processing agreements that include the standard contractual clauses required for any transfer of personal data outside Canada or the EU.

• Supabase — database + storage hosting (United States)
• Stripe — payment processing (United States / Canada)
• Twilio — SMS delivery (United States)
• SendGrid — email delivery (United States)
• Thanks.io — print + mail fulfillment (United States)
• OpenAI — AI drafting for the brief flow (United States)
• Google Maps — address validation + autocomplete (United States)
• Vercel — application hosting (multiple regions)

Different data classes have different retention periods. Here's the plain version:

• Sender accounts: kept while your account exists. Delete your account from the dashboard or by emailing us, and we'll remove your account data.
• Recipient mailing addresses and contact info: kept for 2 years after the card is mailed, sent digitally, or cancelled. After that, we anonymize or delete it.
• Signer notes and contact info: kept for 2 years after the card the signer was on completes. After that, we anonymize or delete it.
• Referral activity: if Kind Post's referral feature is on, we keep referral touchpoints and attributions for 2 years from when they happen. Unmatched touchpoints expire at 2 years.
• Financial records: we keep payment records, tax records, and the audit trail of charges for 6–7 years, as required by Canadian accounting and tax rules.
• Communication logs: records of when we sent or received messages on your behalf are kept for the same 6–7 year window, then summarized.

You can ask us to delete data sooner if there's no legal reason for us to keep it. We'll do our best — for some records (like the tax-required ones above) we have to keep minimum records by law, but we'll redact what we can.

If you're a recipient or signer (non-account holder):

• You can delete your data by emailing bekind@kindpost.cards. We respond within 7 days.
• Replying STOP to any SMS opts you out of future messages immediately. Note: STOP suppresses sends but doesn't erase data we already have — for full deletion, email us using the line above.
• You can ask us for a copy of what we hold about you by emailing the address above.
• You can correct anything we have wrong.

If you're a sender (account holder):

• You can export, correct, or delete your account from the dashboard, or by emailing us.

You have additional rights under the GDPR / UK GDPR. Specifically, you can:

• Access the personal data we hold about you
• Have it corrected if it's wrong
• Have it deleted (subject to the retention rules above)
• Restrict or object to how we're using it
• Receive a copy in a portable, machine-readable format
• Withdraw any consent you previously gave
• Lodge a complaint with your local data protection authority

Our lawful basis for processing varies by data class: we process sender data to perform the contract you entered when you signed up; we process recipient and signer data on the basis of legitimate interests(delivering the card the sender asked us to send) and on the sender's attestation of an existing relationship with you; we process payment data to comply with our legal obligations around accounting and tax.

Email bekind@kindpost.cards for any of the above. We aim to respond within 30 days.

Note for transparency: Post Timely Inc. is a Canadian corporation. Canada is on the European Commission's adequacy list for data transfers, which means data flowing from the EU/UK to us in Canada is permitted without additional safeguards. We have not yet appointed an EU representative under GDPR Article 27. If you're an EU resident and that matters for your request, please email us and we'll handle it directly.

Kind Post uses a small set of cookies and browser-storage entries to make the service work. We don't use any third-party advertising or marketing cookies.

Essential (always on, no consent needed):

• Sign-in session — Supabase sets a session cookie when you sign in so we can recognize you across pages.
• Card draft preservation — your in-progress brief is stored in your browser's localStorage so it survives the magic-link round-trip.
• Phone-number country preference — if you've picked a country code in our phone-number input, we remember it locally so the next form starts in the right country.
• Referral attribution — if you arrived via someone's referral link, we set a short-lived cookie so we can credit them when you sign up.

Analytics (with your consent in the EU/UK):

We use Google Analytics to understand which pages get used and where the flow breaks down. This is the only non-essential tracking we run. If you're in the EU, the UK, or the EEA, we'll ask for your consent before Google Analytics fires; you can decline and the rest of Kind Post still works identically. Outside the EU/UK we follow the relevant local rule (Quebec's Law 25, California's opt-out, etc.).

You can clear cookies any time in your browser's privacy settings. Clearing the sign-in cookie just signs you out. Clearing the brief-draft entry clears any unsaved card brief you started.

Kind Post is operated from Canada by Post Timely Inc. Data is hosted on Supabase (Postgres + Storage in the United States), with payments processed by Stripe and messaging by Twilio + SendGrid. Data may be transferred to and processed in the United States by these subprocessors. We work with vendors whose data processing agreements meet the standards required by PIPEDA, GDPR, and the UK GDPR.

We send transactional messages: receipts, status updates, password / sign-in emails, and the messages senders ask us to send to recipients. We don't send marketing email unless you opt in separately.

Recipients can opt out of all Kind Post messages by replying STOP to any SMS or by clicking the unsubscribe link in any email.

Kind Post is built for adults. Senders need to be at least the age of majority in their jurisdiction (typically 18 in Canada and the US, 16 in much of the EU). The Terms require senders to confirm they're not inviting anyone under 13 as a signer or recipient, and that they have parent or guardian permission for any signer aged 13–17.

We don't ask for anyone's age, and we don't knowingly collect personal information from children under 13. If we discover that we have, we delete it. We don't sell or share children's data with third parties, and we don't use it to train external AI models.

If you're a parent or guardianand you've discovered we have your child's information — because someone invited them to sign a card, asked for their address, or added them to a Circle — email us at bekind@kindpost.cardsand we'll remove it. We respond within 7 days.

If Post Timely Inc. is acquired, merges with another company, or goes through a reorganization, your information may transfer to the new owner as part of that transaction. We'll let you know in advance — by email and by a notice on this page — and any new owner will be bound by this Privacy Policy or one that is materially the same. If you don't want your data to transfer, you can delete your account before the transition.

If Kind Post shuts down entirely, we'll give you at least 30 days' notice to download or delete your data before we delete it ourselves.

We'll post material changes here and stamp the new effective date at the top. For senders, we may require you to re-consent before the next card if the changes affect what we do with recipient data.

Privacy questions, requests, or complaints:
bekind@kindpost.cards
Post Timely Inc., Canada

We aim to respond within 30 days. If you're not satisfied with how we handle your privacy, you can file a complaint with the Office of the Privacy Commissioner of Canada or, if you're in the EU/UK, your local data protection authority.