Privacy policy

DPR Software Labs (OPC) Private Limited, trading as MailMyCard, is the data controller for the information described here. Our registered address is Innov8 Mantri Commercio, Tower A, 5th Floor, Devarabisanahalli, Bangalore, Karnataka 560103, India.

• Account details — your name and email address.
• Card content — the message and sign-off you write, the template, size, ink and handwriting style you choose, and, if you use the handwriting feature, the pen strokes you capture and any font file you upload.
• Recipient details — the name and full postal address of the person you are writing to, your return address if you supply one, and, for an address in India, their mobile number if you choose to give it. If you choose to tell the recipient about their card, their email address too.
• Order and payment records — what you ordered, when, the price, and the delivery service chosen.

We do not store your card or bank details. Payments are processed by our payment provider; we receive only a confirmation that a payment succeeded and a reference for it.

The person you are writing to has given us nothing — you have. We use a recipient's name, address and any mobile number you give for the single purpose of addressing, posting and delivering that card. We do not market to recipients, do not add them to any list, and do not sell, rent or share their details with anyone other than the postal carrier that has to deliver the item.

Email is the one exception, and only when you ask for it: if you give a recipient's email address and choose to tell them, we send them two emails about that card, when it is posted and when it is delivered, through our email provider. We send them nothing else and use the address for nothing else. Each email says who asked for it and how to have the address deleted, and a recipient's address is cleared from our records when the order's personal details are.

A birthday card sent as a link has a row of candles to blow out. If the person opening it taps “Blow into your phone”, their browser asks to use the microphone, and only then. The sound is measured on their phone to see how hard they are blowing and is never recorded, saved or sent to us or to anyone. The microphone is let go as soon as the candles are out or they leave the page. If they say no, they tap the flames instead.

You can have cards sent for your own customers: by connecting a Shopify or WooCommerce store, a CRM, a spreadsheet or the API. When you do, you decide whose details we receive and why, and we handle them only on your instructions, to write, post and deliver the cards you have set up.

• What we receive. For each order or record that should get a card: the recipient's name and postal address, and what we need to apply your rules (for a shop, the order's number, total and tags). From a Shopify store we ask only for permission to read orders. We do not keep your customer's Shopify customer id or email address.
• What we do with it. We write and post the card, and show you the order and its tracking. We do not market to your customers, build profiles of them, or sell or share their details with anyone but the carrier that delivers the card.
• When your customer asks you to erase their data. Shopify passes the request to us, and we erase the name and address on that customer's cards within 30 days, once any card still being made has been posted or cancelled. The amount paid, the destination country and the tracking number stay as the accounting record the law requires.
• When your customer asks what we hold. We prepare a report of the cards made from their orders and send it to you, the store's owner, within 30 days.
• When you disconnect. The connection and the access your store gave us are removed at once. For a Shopify store, 48 hours after you uninstall the app Shopify asks us to erase the store's data, and we erase the recipient details on every card the store sent.

Recipient details are encrypted in transit and at rest, and the access your store grants us is stored sealed. Only staff who need a recipient's details to make or post a card can open them, and each time they do is recorded.

We process this information to perform the contract you enter into when you place an order, to meet our legal and tax obligations in India, and, where we contact you about your account, on the basis of your consent, which you may withdraw at any time. We measure how the site and the product are used on the basis of our legitimate interest in keeping them working and making them better. Counting visits with Google Analytics and Meta's tools, which set cookies, is done only with your consent, which you may withdraw at any time with “Ad and cookie choices” at the foot of any page.

• Postal carriers and couriers — India Post and, for tracked services, the relevant carrier, which necessarily receive the recipient's name and address. Within India a card may go by India Post's Speed Post, or by courier, booked with Delhivery or through iThink Logistics; either also receives the recipient's mobile number if you gave one, so the person delivering it can reach them.
• Our payment provider, to take payment and handle refunds and disputes.
• Our hosting and infrastructure providers, who store the data on our behalf under contract.
• Our analytics providers, to see how the site and the product are used. PostHog, hosted in the United States, receives the pages you open and the actions you take (for example that a card was started, which design and destination country were chosen, and what an order cost), your browser and device type, your IP address and the approximate location it gives, and, when you are signed in, your account's reference number. Ahrefs Web Analytics counts page visits only. PostHog also records a replay of your visits to our public pages and to your account dashboard: what is on your screen, including the words of a card, recipients' names and addresses, and what you type (but never what you type into a password field), and where you move, click and scroll. We use replays to find what confuses people and to fix faults. We do not record the page a card's recipient opens, or our internal operations pages.
• Google and Meta, only if you press Accept all on our cookie banner, to count visits and measure our advertising. Google Analytics (Google, United States) receives the public pages you open, which buttons you press on them (such as Write a card or Book a call), which card designs you open or choose, whether you stayed on a page for ten seconds and scrolled or touched it, where you came from, your browser and device type, your IP address and the approximate location it gives, and a number held in a cookie that recognises your browser. Meta's Pixel and Conversions API (Meta, United States) are told which public pages and card designs you opened, whether you stayed on a page for ten seconds and scrolled or touched it, and, if you have an account, that you signed up, began a card, started to add money, added it or ordered a card, with the amount, and your account's reference number as a one-way hash, never your name, email address, phone number, address or the words of a card. The Pixel is not used on the sign-in and sign-up pages, inside your account or on a recipient's page, and Google's advertising features are switched off. If you do not accept, neither receives anything. If you accept while signed in, we keep your yes on your account, with the two identifiers Meta's cookies hold, so that a payment which finishes after you have left our site (your bank or PayU confirming it later) can still be reported. Pressing Reject all, or withdrawing with “Ad and cookie choices”, erases both at once.

We do not sell personal data to anyone, in any circumstance.

Card content, including your message and captured handwriting, is kept while your account is open so you can reorder, and is deleted within 30 days of you deleting the card or closing your account. Order and payment records are retained for 8 years as required by Indian tax and company law, after which they are deleted.

Our systems are operated from India. Where a card is posted abroad, the recipient's address is necessarily transferred to the postal service in the destination country in order to deliver it.

You may ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. If you are writing on behalf of a recipient who wants their address removed from our records, tell us and we will delete it, subject to the order records we are legally required to retain.

Email hello@mailmycard.com. We respond within 30 days.

We use cookies and equivalent browser storage only to keep you signed in, to remember a card you are part-way through writing, and to remember your theme preference, and to remember your answer to the cookie banner (a cookie called mmc_marketing, kept for six months). We do not sell browsing data. Our own analytics (PostHog and Ahrefs) set no cookies and keep nothing in your browser.

If you press Accept all on the banner, we also use Google Analytics and Meta's Pixel on our public pages. They set cookies in your browser (Google's begin with _ga; Meta's are _fbp and _fbc), and the Meta cookies are used to measure advertising. If you press Reject all, or never answer, none of them is set and nothing is reported. If you are signed in when you press Accept all, your account also keeps your yes and Meta's two cookie values (not your name, email or anything you wrote), only to report a payment that completes when you are no longer on the site. You can change your mind at any time with “Ad and cookie choices” at the foot of any page: withdrawing removes those cookies, stops both from loading and erases what your account kept.

We also keep one small cookie of our own, called mmc_utm, for 30 days, when the link you followed to reach us carries an advertising tag (such as utm_campaign). It holds only those short tags, which describe the advert and not you, and it needs no yes from you. We keep them with your account when you sign up, add money or order, so we can see which of our adverts worked. They are never sent to Google or Meta. You can delete the cookie in your browser at any time.