Privacy policy

Who handles your information

Soxoa LLC operates Postedly and is responsible for the personal information we collect to operate the service. Contact john@soxoa.com about privacy, access, correction or deletion. This policy covers our website, orders, APIs and connectors; an assistant or other service you use has its own privacy policy.

Information we collect

We collect the sender and recipient details you supply, including names, contact information, fax numbers, delivery and return addresses; submitted documents, images and messages; selected products and delivery options; approval records; order and payment references; delivery events; and support communications.

Stripe processes payment credentials. Postedly stores payment identifiers and limited payment-status information rather than full card numbers or security codes. We also process security and service data such as IP address, browser information, request times, session identifiers and error events. Recipient information usually comes from the person placing the order.

Why we use it

We use information to prepare previews and prices, process payment, produce and deliver orders, provide receipts and status, answer support requests, prevent duplicate sends, investigate fraud or abuse, maintain service security, resolve disputes and meet legal obligations.

We do not sell uploaded documents, use them for targeted advertising, or use their contents to train a general-purpose AI model. Documents are not public by default. Staff access is limited to operational needs such as fulfillment troubleshooting, support, security or a valid legal requirement.

Providers and recipients

Cloudflare provides application hosting, private file storage, database and network services. Stripe provides payments and related fraud and tax services. Resend provides transactional email. We provide these services only the information needed for their functions.

Your selected delivery service determines the fulfillment provider. These may include Telnyx for fax; PostGrid or Click2Mail for mail; Prodigi and its production partners for printed products; or Handwrytten for handwritten cards. We send the selected provider the document, artwork or card message, recipient and sender details, product options and order references necessary to complete your order. Postal carriers, couriers and the intended recipient also receive information as necessary for delivery.

Providers may have their own record-retention and legal obligations. Deleting a file from Postedly does not retrieve a fax already transmitted, remove a delivered item, or automatically erase records a provider is required to retain. We may also disclose relevant information to comply with valid legal process, protect legal rights or investigate fraud and threats, subject to applicable law. If our business is transferred, information may transfer with it under appropriate protections.

Sessions, cookies and analytics

We use essential browser storage or cookies to maintain a secure session, preserve the order you are working on and protect the service. Payment and infrastructure providers may use their own necessary technologies. Clearing session storage can remove access to a guest order on that device; contact support if you need help recovering it.

With your permission, we use Google Analytics on assistant guides, developer documentation and policy pages to understand visits. Analytics is off until you allow it in Analytics preferences in the footer, where you can also withdraw permission. We honor Global Privacy Control by leaving optional analytics off. Analytics uses cookies when enabled; Google receives technical connection data and public page information. We remove URL query strings and fragments, send only the referring site’s origin, and do not measure private order, document, connection, approval or payment pages. We do not send document contents, recipient details or email addresses to Google Analytics. We do not use advertising pixels or document session replay in the sending flow. With the same optional consent, we retain only allowlisted campaign and source labels for up to 30 days and link them to first-party service milestones. We do not infer a directory source from an OAuth client name. Withdrawing permission deletes the campaign attribution for your current account; operational records remain separate. We separately record first-party operational activity to diagnose connection and sending problems. These activity logs contain request, account and connection identifiers, service endpoints, methods and tool names, timestamps, duration, outcomes, error codes and deployed version. They exclude raw request and response bodies, access tokens and other credentials, verification codes, document contents and postal address text. We do not sell personal information or share it for cross-context behavioral advertising. Global Privacy Control does not reduce the functionality of the service.

Retention and deletion

When you explicitly save a contact or correspondence draft, we retain it privately for reuse: contacts for one year and drafts for 30 days after their last save. You can retrieve, update or delete these saved items through a connection you authorize for those permissions. Saving a draft does not extend the retention of an attached PDF or authorize payment or sending. Deleting a saved item does not erase the original details in existing orders.

We keep uploaded files while they are needed for an active order. Our standard document-retention period is up to 30 days after an order reaches a final state; unused uploads expire sooner. An unresolved delivery, support issue, dispute or legal preservation requirement may require longer retention. We retain order, payment and approval records separately where needed for accounting, fraud prevention, disputes and legal obligations.

Detailed operational activity logs are retained for up to 90 days. Daily aggregate counts are retained for up to 365 days and contain only the day, service endpoint, method, tool, outcome and count, without account, connection or request identifiers. These retention periods are separate from order, payment and approval records.

You can ask us to delete information by emailing john@soxoa.com. We verify that you are entitled to the information before acting. We may retain information required for legal obligations, security, completing an active transaction or resolving a dispute. Backup copies may persist for a limited recovery period before normal rotation removes them. We will explain a material exception when responding to a request, unless law prevents us from doing so.

Your choices and rights

You may request access to your personal information, correction of inaccurate information, a copy where available, or deletion. Depending on applicable law, you may also have rights to restrict or object to processing, withdraw consent, appeal a decision or complain to a privacy regulator. We respond within the applicable legal time limits and do not discriminate against you for exercising a protected right.

California residents may have rights to know the categories and specific information collected, its sources, purposes and recipients, and to request correction or deletion, subject to the law’s scope and exceptions. An authorized agent may make a request where permitted; we may require proof of authority and identity verification. We do not sell personal information or share it for cross-context behavioral advertising.

A recipient may contact us to report an unwanted delivery or inquire about their information. We may need enough information to locate the order and protect the privacy and safety of the people involved. Please do not email full payment-card details or unnecessary sensitive documents.

Security, location and children

We use access controls, private storage, encrypted connections and scoped access to protect information. No transmission or storage system can be guaranteed perfectly secure. Protect order links and integration credentials, and report suspected unauthorized access to john@soxoa.com.

Postedly is operated from the United States, and providers may process information in the United States or other locations where they operate. Applicable protections and contractual requirements govern those transfers. Postedly is intended for adults and does not knowingly offer accounts to children under 18. If you believe a child has provided information improperly, contact us.

Updates

We may revise this policy as the service changes. The date above identifies the current version. We will provide additional notice or obtain consent when required by law. Material changes will not retroactively authorize an unrelated use of previously collected document contents.