Privacy Policy

1. Who is responsible

The controller for PenPost website visitor data and for PenPost accounts is:

LinkDaddy LLC (company website, opens in a new tab)
509 N Prescott Avenue, Suite B
Clearwater, Florida 33755
United States
Florida document number L20000168051
Email: privacy@penpost.io
Telephone: +1 727 350 8520

LinkDaddy LLC is established in the United States. We have not appointed an EU or UK representative. If we are required to do so, we will publish those details here.

2. Roles when you send mail

If you are a business customer and you upload recipient names and mailing addresses, you are the controller of that recipient data. LinkDaddy LLC acts as a processor: we use the list to write, quality-check, mail, and attribute responses according to your instructions.

Scribes receive only the information needed to complete an assigned mailpiece. They do not receive your full customer database.

Business customers who need a data processing agreement can request one at privacy@penpost.io. We do not publish a live DPA until the paid product is offered.

3. Information we collect

Website visitors

• Technical logs such as IP address, browser, and request time
• Cookie consent choices
• Pages requested and referring URLs in server logs
• Messages you send us (email, phone, or forms)

Accounts and campaigns (when those features launch)

• Name, email, organization, and role
• Recipient lists you upload, including postal addresses
• Message content, templates, and campaign settings
• Payment records processed by a payment provider (not stored as card numbers on PenPost)

Scribe applicants and scribes

• Contact details, location/state, availability, and writing samples
• Quality, reliability, and assignment records
• Payout details when writer payments exist

We do not ask for religion. Qualification is based on objective work criteria.

Mail recipients

• Name and postal address supplied by the customer
• Optional personalization fields the customer includes
• Unique tracking tokens, QR scans, and short-URL visits

Public tracking URLs use random tokens. They are not sequential IDs and do not include the recipient’s name.

4. How we use information

• To operate, secure, and improve the PenPost website and services
• To produce, quality-check, and mail handwritten correspondence
• To allocate work to scribes and pay them when that program exists
• To record engagement on unique QR codes and short URLs
• To communicate with you about your account, applications, or inquiries
• To meet legal, tax, and accounting duties

We do not use robotic pens or handwriting fonts for the core human-written service. Software runs the campaign. A person writes the letter.

5. Legal bases (GDPR and UK GDPR)

Where European or UK data protection law applies, we rely on:

• Contract — to provide a requested account, campaign, or scribe engagement
• Legitimate interests — to secure the site, prevent abuse, and understand how public pages are used, balanced against your rights
• Consent — for non-essential cookies, and where we ask for it on a form
• Legal obligation — tax, accounting, and lawful requests

You may withdraw consent without affecting processing that occurred before withdrawal.

6. Cookies

Necessary cookies remember your cookie choice and help the site run. Analytics and marketing cookies are not loaded unless you accept those categories. Details are in the Cookie Policy.

7. Sharing

We share personal information only with:

• Infrastructure providers, currently Cloudflare (Workers, D1, R2, and related edge services)
• Scribes, limited to assignment data
• Postal services when a piece is mailed
• Professional advisers and authorities when required by law
• Payment processors when billing exists

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

8. International transfers

LinkDaddy LLC is in the United States. Information is processed in the US and on Cloudflare’s global network. Where GDPR or UK GDPR requires a transfer mechanism, we will use appropriate safeguards such as standard contractual clauses.

9. Retention

We keep information only as long as needed for the purpose collected, including legal and accounting periods. Campaign and mailpiece records are kept so quality, mailing, and attribution can be audited. You may ask us to delete information where the law allows.

10. Security

We use access control, encrypted transport, and least-privilege design. No method of transmission or storage is perfectly secure. Report a suspected issue to privacy@penpost.io.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your information; to restrict or object to processing; to withdraw consent; and to lodge a complaint with a supervisory authority. California and other US state laws may also include rights to know, delete, correct, and opt out of sale or sharing.

To exercise a right, email privacy@penpost.io or write to the address above. We may need to verify you. Authorized agents may submit requests where state law allows.

Global Privacy Control (GPC) signals are treated as a request to reject non-essential cookies and as an opt-out of sale or sharing.

12. Children

PenPost is a business service. It is not directed at children. We do not knowingly collect personal information from children under 16.

13. Changes

We will update this page when our practices change. The effective date above will change. Material changes will be posted here.