Privacy Policy · notecardHQ

notecardHQ (notecardhq.com) is run by Canary Canary LLC, 6 W 18th St, Suite 2C, New York, NY 10011, USA ("we", "us"). We write cards by robot, with a real pen, and mail them. Businesses send us cards through our API, our web portal (app.notecardhq.com and each workspace's own address), and our apps for Shopify, HubSpot and Zapier.

Questions or requests: inquiry@notecardhq.com.

1. Two roles

Our customers are businesses that open a notecardHQ workspace. For their own account data (who signs in, billing), we decide how the data is used. Under the GDPR we are the controller of that data.
Card recipients are the people our customers send cards to. Our customer decides who gets a card and what it says. For that data we act on our customer's instructions: under the GDPR we are a processor, and under the CCPA a service provider. Our Data Processing Addendum sets out those terms. If you received a card and want to know why, the business that sent it is the right first contact; we will also help (section 8).

2. What we collect

Customer account data

Sign-in email address. We sign people in with an 8-digit code sent to their email, valid for 15 minutes. There are no passwords.
Workspace details: company name, the workspace address, the emails allowed to sign in, the return address for envelopes, and settings.
Sign-up request: email and company name, kept as a sign-up record.
Billing: prepaid balance, top-ups, invoices and their amounts. A payment card is saved with our payment processor, Whop; we keep only the card brand and last four digits, never the full card number.
API keys: we store a SHA-256 hash and the last four characters, never the key itself.
Activity records: an audit log of actions in the portal (for example a note's status changing, or a webhook being changed), with who did it.

Card recipient data, sent to us by our customers

Name and mailing address: first name, last name (optional), company (optional), street, city, state, postal code and country. We keep both the address as sent and the corrected address after verification.
The note text we write on the card (up to 500 characters).
Context: any extra fields the customer sends with a note (for example an order number, or details to write the note from). It is stored as sent.
Identifiers the customer chooses: an external id and an idempotency key.
Production records: status (created, written, mailed, cancelled), dates, postage cost, and a tracking number when there is one.
The rendered handwriting of each note (a file of the pen paths).

Shopify app

When a merchant installs our Shopify app, Shopify sends us each new order. We read only what we need to address a card: the customer's name, company, shipping address (or billing address if there is no shipping address), the order number and id, the first product name if the merchant uses it in the note, and the customer's order count (for the "first order" trigger). We do not request customers' email or phone access from Shopify. The app keeps a send record per order.

The app also stores the merchant's shop domain, settings, note template, and their notecardHQ API key, encrypted with AES-256-GCM.

HubSpot app

When a HubSpot workflow reaches our "Send a handwritten card" action, HubSpot sends us the contact properties mapped in that action: first name, last name, company, street, city, state, ZIP and country, plus the message. The app keeps a send record per workflow run, and the portal's OAuth tokens and notecardHQ API key, encrypted with AES-256-GCM.

Zapier

Our Zapier integration passes the fields a customer maps in their Zap straight to our API. Zapier stores the customer's connection (workspace and API key) under Zapier's own policies; the integration stores nothing on our side beyond the notes it creates.

Public handwriting preview

Anyone can try a handwriting preview on our website. We store the preview text and a keyed hash (HMAC) of the visitor's IP address, used only for rate limits; we never store the IP address itself.

Our website and the portal

We do not use advertising trackers. On notecardhq.com we use PostHog, a product analytics service, to learn how people find and use the website: the pages you view, the links and buttons you click, the website that sent you, your browser, device and approximate location, and a session replay (a recording of how the page moved, scrolled and was clicked, with anything you type hidden). PostHog sets a cookie (on notecardhq.com and its subdomains) and a local storage entry so it can recognize your browser when you come back, and we have set PostHog not to keep IP addresses. If your browser sends Do Not Track or Global Privacy Control, none of this happens. If you create a workspace, the visits this browser made before can be linked to your account, so we can see how you found us. The portal does not use analytics. The portal keeps your sign-in session in your browser so you stay signed in. To learn how people find us, notecardhq.com keeps a small first-party record in your browser's local storage for up to 30 days: the website that linked you here (for example google.com or chatgpt.com, never the full address), any campaign tags in the link, and the first page you opened. It is sent to us only if you create a workspace, together with your optional answer to "How did you hear about us?", and is kept with that workspace. This website loads its fonts from Google Fonts, so your browser sends your IP address to Google when a page loads.

Server logs

Our hosting providers keep standard request and function logs, which can include IP addresses, under their own retention schedules. For notecardhq.com we also record each page request in PostHog, so we can see which search engines and AI assistants read the website: the page, the full browser identification string (user agent, which names the browser or bot), the referring website and the country. We do not store the IP address; requests from the same browser on the same day are grouped by a keyed hash that changes daily, and requests sending Do Not Track or Global Privacy Control are not recorded. We do not keep our own log of API requests beyond what is stored with each note (above) and outgoing webhook deliveries (section 6). We do keep an access log of reads of recipient data: who read which notes, when, and through which part of the service. It holds note ids and the reader's account id or the last four characters of their API key, never names, addresses or note text.

3. Why we use it, and our legal bases (GDPR)

Purpose	Data	Legal basis
Write, address, stamp and mail the cards our customers order	Recipient data, note text, context	On our customer's instructions, as processor (the customer needs its own basis, usually legitimate interests or contract)
Verify US addresses before accepting a note	Recipient name and address	Same as above
Review notes before they are written (a new workspace's first 10 notes, notes that fail our handwriting check, and notes we write from context)	Note text, context, recipient name	Same as above
Write a note from the context sent, only where this is switched on for a workspace	Context sent with the note	Same as above
Run customer accounts, sign-in and support	Account data	Contract with the customer
Billing and accounting	Billing data	Contract; legal obligation (tax and accounting records)
Security, abuse prevention and rate limits	Account data, IP hash for previews, audit log	Legitimate interests (keeping the service safe)
Learn how people find and use our website	Website analytics, session replays and page-request records (section 2)	Legitimate interests (understanding and improving our website and marketing)

We do not use recipient data for our own marketing, and we do not sell it or share it for cross-context behavioral advertising.

Handwriting word bank. Our handwriting system keeps a bank of single written words (pen strokes) that passed its quality check, so it can reuse good handwriting. It stores single words only, with no note text, order, customer or recipient attached, but a word can be a first name.

4. Who helps us (subprocessors)

We use these providers to run notecardHQ. Each receives only what it needs for its job.

Provider	What it does for us	Personal data it handles
Convex	Database, file storage and backend functions	All account and recipient data
Vercel	Hosts the portal, the API endpoints and this website	Requests passing through, request logs
Fly.io	Hosts our Shopify and HubSpot apps	Send records from those platforms; encrypted keys and tokens
EasyPost	US address verification	Recipient name, company and US address
Resend	Sends sign-in code emails	Sign-in email address
Google Workspace	Our email	Whatever you email us
Whop	Payment processing for saved cards, top-ups and invoices	Payer name, email and card details (held by Whop, not by us)
Slack	Internal new-note alerts to our team. Only if enabled for your workspace.	Recipient name, city and country; for notes we write from context, the first 120 characters of that context
Anthropic	Writes a note from the context you send. Only if enabled for your workspace.	The context sent with that note
Postal services	Deliver the card: the US Postal Service, and for international cards the destination country's postal operator	Name and address on the envelope

Rendering and handwriting checks run on our own computers in New York; text recognition uses Apple's on-device Vision framework, not a cloud service. Finished card files are copied over an encrypted connection on our private network to the office computer that drives the robots.

We will update this list before adding or replacing a subprocessor, and give customers 14 days' notice as our DPA describes.

5. Where data is stored

Our providers process data on their US infrastructure, and our Shopify and HubSpot apps run in the United States. If you are in the EU, the UK or Switzerland, your data is transferred to the United States. Customers who need a transfer mechanism can ask us to sign the EU Standard Contractual Clauses, with the UK Addendum where needed (see our DPA).

6. How long we keep it

Data	How long
A note's recipient data: name, company, address, note text, the context sent with it, the address-verification id and the tracking number	For self-serve workspaces, 12 months after the card is mailed, then replaced with `[redacted]` by a daily job. A cancelled note: 12 months after it was created. Workspaces on a custom agreement follow that agreement.
What stays after that	The note's id, status, dates, price, postage, billing links, the business's own recipient id and idempotency key, and the recipient's country (it sets the price and appears on statements). None of these is a name or address; they are kept for accounting.
Notes still being written or mailed	Kept until they are mailed or cancelled, then as above.
Rendered handwriting files for notes	Deleted when the note's data is cleared.
Card files on our production computers	Removed once the card is no longer waiting to be written.
Outgoing webhook deliveries, with their payload	30 days, deleted daily. When a note's data is cleared sooner, the stored payloads of its events are cleared too.
Public handwriting previews and their image	24 hours. Rate-limit records: about 1 hour.
Account, billing and audit records	For as long as the account is open, then as long as tax and accounting rules require. Billing records hold no recipient names or addresses.
Access log (who read which notes)	12 months, deleted daily.
Website analytics (PostHog): page views, clicks, page-request records	Up to 12 months. Session replays: up to 30 days.
Encrypted backups of the database and files	30 days. Data cleared from the database stays in the backups taken before it was cleared until they are deleted, at most 30 days later.
Sign-up requests	Kept, with no automatic deletion today. Ask us and we will delete yours.
Shopify app send records	The name, address and note are dropped as soon as notecardHQ accepts the card; the record keeps only ids and status. A Shopify `customers/redact` request removes the rest of that customer's data from the app and asks notecardHQ to delete the notes sent for them. A `shop/redact` request, 48 hours after uninstall, deletes everything for the shop and asks notecardHQ to delete the shop's notes.
HubSpot app records	Tokens and API key are deleted on uninstall. When HubSpot reports a contact deleted, the app wipes that contact's data and asks notecardHQ to delete the notes sent for them.
Handwriting word bank	Single words only, kept indefinitely (section 3). Not linked to any note or person; we remove a word on request.

Deleting sooner. A self-serve workspace can delete a recipient's data at any time through our API's redaction endpoint, by note id, its own idempotency key or its own recipient id. A card not yet prepared for our robots is cancelled and never mailed; a card already prepared or written is mailed and its data cleared at that moment. We do not store recipients' email addresses, so we cannot search by email; send us the name and mailing address instead (section 8).

Copies outside our database. Internal Slack alerts, where enabled, keep a recipient's name, city and country under Slack's retention. Our hosting providers' logs follow their own schedules. Our own daily backups are encrypted and kept 30 days (above).

7. Security

See our Security page. In short: everything travels over HTTPS; API keys are stored only as hashes; the keys and tokens our apps store are encrypted; and access to each workspace is limited to its own members and to named notecardHQ staff.

8. Your rights

Depending on where you live, you can ask us to:

tell you what personal data we hold about you and give you a copy;
correct it;
delete it;
restrict or object to how we use it;
move it to another service (portability);
withdraw consent where we rely on consent.

If you are a card recipient, we handle your data for the business that sent the card. Send your request to that business, or to us at inquiry@notecardhq.com with your name and mailing address; we will pass it on and help them answer. We can stop a card that has not been written yet.

If you are a customer, write to inquiry@notecardhq.com from your workspace email.

We answer within 30 days (45 days under the CCPA, extendable as the law allows). We may need to confirm your identity first. We will not treat you differently for using your rights. You can also complain to your data protection authority.

9. California privacy rights

If you live in California, the California Consumer Privacy Act (as amended by the CPRA) gives you these rights over personal information a business holds about you:

Right to know what personal information is collected, used and disclosed, and to get a copy.
Right to delete personal information, subject to legal exceptions.
Right to correct inaccurate personal information.
Right to opt out of sale or sharing. We do not sell personal information or share it for cross-context behavioral advertising, including of anyone under 16.
Right to limit use of sensitive personal information. We do not collect sensitive personal information on purpose and do not use it to infer characteristics about you.
Right not to be discriminated against for using these rights.

To make a request, email inquiry@notecardhq.com. You can use an authorized agent; we may ask the agent for proof of authority and ask you to confirm your identity. For card recipient data we act as a service provider to the business that sent the card, and we will pass your request to that business and help it answer.

What we collected in the last 12 months:

Categories: identifiers (name, email, postal address); commercial information (orders and payments); internet activity (an IP hash for previews only). Inferences: none.
Sources: our customers and the platforms they connect (Shopify, HubSpot, Zapier), and you directly.
Purposes: section 3.
Disclosed for a business purpose to: the providers in section 4.
Retention: section 6.
Sensitive personal information: not collected on purpose. Note text and context are whatever our customers send.

10. Children

notecardHQ is a service for businesses. We do not knowingly collect personal data from children under 13 (or under 16 in the EU) through our sites. Our customers must not send us cards for children without any permission the law requires.

11. Changes

We will post changes here and update the date at the top. If a change is significant we will email customers before it takes effect.

12. Contact

Canary Canary LLC (notecardHQ)
6 W 18th St, Suite 2C, New York, NY 10011, USA
inquiry@notecardhq.com