Privacy Policy

Personal Information We Collect

Personal information you may provide to us through the Service or otherwise includes:

• Contact data: Your first and last name, email address, billing address, and phone number.
• Communications data: Information from our interactions with you, including when you contact us via the Service, social media, or other channels.
• Profile data: Information you provide when creating an account, such as username, password, profile photo, and any additional details added to your profile.
• Marketing data: Your preferences for receiving marketing communications and information about your engagement with them.
• Payment data: Information required to complete transactions, including payment card or bank account details.
• Recordings and other user-generated content: Photos, images, videos, music, comments, questions, messages, text, works of authorship, and other content or information generated, transmitted, or made available via the Service, including any associated metadata. Recordings may capture your voice and may be used or shared as described herein or as otherwise disclosed at the time of recording.
• Other data: Any additional information not specifically listed above, which will be used in accordance with this Privacy Policy or as otherwise disclosed at the time of collection.

Third-party sources: We may receive personal information from:

• Public sources.
• Marketing and advertising companies for marketing and advertising purposes.
• Service providers.
• Business transaction partners (e.g., mergers, acquisitions, sales, insolvency, bankruptcy, receivership).
• Third-party services.

Automatic Data Collection

We, our service providers, and our business partners may automatically collect and log information about you, your device, and your interactions over time with the Service, our communications, and other online services. Such information may include, but is not limited to:

• Device data: Operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, unique identifiers (including advertising IDs), language settings, mobile carrier, network information (e.g., Wi-Fi, LTE, 3G), and general location information, including city, state, or geographic area.
• Online activity data: Pages or screens viewed, time spent on pages or screens, previously visited websites, navigation paths, interactions on pages or screens, access times and duration, and email interactions (including opens and clicks).
• Communication interaction data: Interactions with emails or other communications, tracked through pixel tags (also referred to as clear GIFs).

For more information regarding automatic data collection, please refer to the "Tracking Technologies" section below.

Tracking Technologies

Cookies and other technologies:

• Cookies: Small text files stored on your device to record browsing activity, form submissions, preferences, and login status. This includes session cookies (deleted at the end of a session), persistent cookies, first-party cookies, and third-party cookies.
• Local storage technologies: Technologies such as HTML5 that provide functionality similar to cookies but allow larger amounts of data to be stored outside the browser in connection with specific applications.
• Web beacons (pixel tags/clear GIFs): Tools used to determine whether a webpage or email was accessed, opened, or whether specific content was viewed or clicked.

For information regarding your options and control over tracking technologies, please see the "Your Choices" section below.

How We Use Your Personal Information

We may use your personal information for the following purposes or as otherwise described at the time of collection:

1. Service delivery and operations:
   • Provide the Service.
   • Enable security features.
   • Establish and maintain your user profile.
   • Facilitate social features.
   • Communicate Service-related updates, announcements, alerts, and support messages.
   • Respond to requests, questions, and feedback.
2. Service personalization:
   • Understand your needs and interests.
   • Personalize your experience and communications.
   • Remember selections and preferences.
3. Service improvement and analytics:
   • Analyze usage to improve the Service and our business.
   • Understand user activity, including page popularity and navigation patterns.
   • Develop new products and services.
4. Marketing and advertising:
   • Collect and use personal information for marketing purposes.
   • Conduct interest-based advertising through third-party partners using cookies and similar technologies.
   • Share information with third-party partners for interest-based advertising on other online platforms.
5. Compliance and protection:
   • Comply with laws, legal requests, and process (e.g., subpoenas, government investigations).
   • Protect rights, privacy, safety, or property of Postal, users, or others.
   • Audit internal processes for compliance.
   • Enforce Service terms and prevent, identify, or investigate fraudulent or illegal activity.
6. Data sharing in corporate events:
   • Share personal information in connection with actual or prospective corporate transactions.
7. Aggregated, de-identified, or anonymized data:
   • Create aggregated or anonymized data from your personal information.
   • Share such data with third parties for lawful business purposes, including analyzing and improving the Service.
8. Further uses:
   • In certain cases, we may seek your consent to use personal information for additional purposes not compatible with the initial purpose of collection.

Music Submissions & Communications

When you submit content through a music submission feature on Postal, we may collect personal information such as your name, email address, and any other details you choose to provide. We process this information to facilitate the submission, review, and collaboration between users.

We use this information to:

• Facilitate the submission and review of your content
• Share your submission and contact information with the intended recipient
• Enable communication between you and the recipient regarding your submission

Information submitted through a music submission feature is shared with the recipient (campaign creator) you are submitting to. Once shared, the recipient may store, organize, and process your information in accordance with their own practices.

Marketing and Communications Consent

If you choose to opt in to receive updates or communications, you provide your explicit, informed consent for the campaign creator or recipient to:

• Contact you using the information you provided
• Add your information to their mailing lists or customer relationship management systems
• Send you updates, opportunities, marketing communications, and other related messages

This consent serves as the legal basis for processing your personal data for marketing purposes, where required by applicable law.

Use and Retention of Information by Recipients

You acknowledge and agree that recipients may:

• Retain your submission and contact information for their records
• Store and manage your information outside of Postal
• Use your information for purposes related to reviewing submissions, contacting you, and managing ongoing communications

Postal does not control how recipients use your information once it has been shared. Recipients are solely responsible for complying with applicable data protection, privacy, and marketing laws.

Your Rights

Depending on your location, you may have rights under applicable data protection laws, including the right to:

• Access your personal data
• Request correction or deletion of your data
• Withdraw your consent at any time
• Object to or restrict certain processing

To exercise these rights, you should contact the campaign creator or recipient directly, as they control your information once it has been shared.

Music submissions are also subject to Postal's Terms of Use.

Withdrawal of Consent

You may withdraw your consent to receive marketing communications at any time by:

• Using the unsubscribe link included in communications
• Contacting the campaign creator or recipient directly

Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Retention

We generally retain personal information to fulfill the purposes for which we collected it, including satisfying legal, accounting, or reporting requirements, establishing or defending legal claims, or preventing fraud. To determine the appropriate retention period for personal information, we may consider:

• The amount, nature, and sensitivity of the personal information.
• The potential risk of harm from unauthorized use or disclosure.
• The purposes for which we process the personal information and whether those purposes can be achieved through other means.
• Applicable legal requirements.

When we no longer require personal information, we may delete it, anonymize it, or isolate it from further processing.

How We Share Your Personal Information

We may share your personal information with the following parties and as otherwise described in this Privacy Policy, in other applicable notices, or at the time of collection. We make commercially reasonable efforts to ensure parties we share information with provide protections consistent with this Privacy Policy, except that parties other than service providers and affiliates may use personal information according to their own privacy policies.

• Affiliates: Our corporate parent, subsidiaries, and affiliates.
• Service providers: Third parties that provide services on our behalf or help operate the Service or our business (e.g., hosting, IT, customer support, email delivery, marketing, research, and analytics).
• Payment processors: Any payment information you provide to make a purchase on the Service is collected and processed directly by our payment processors, such as Stripe (Stripe Privacy Policy) or Apple Pay (Apple Privacy Policy).
• Third parties designated by you: Parties you instruct or consent to share your personal information with.
• Partners: Third parties with whom we partner or collaborate, including event co-sponsors, joint product or service providers, and marketing or advertising partners.
• Linked third-party services: If you choose to link your Service account to a social media or other third-party service, we may share personal information with that service. Use of such information will be governed by that service's privacy policy and your account settings.
• Professional advisors: Lawyers, auditors, bankers, insurers, and other advisors, to the extent necessary in the course of providing professional services.
• Authorities and others: Law enforcement, government authorities, and private parties as necessary or appropriate for compliance with legal obligations or protection purposes.
• Business transferees: In connection with actual or prospective business transactions, including investments, financing, public stock offerings, or the sale, transfer, or merger of all or part of our business, assets, or shares. This includes acquirers, successors, or assignees, as well as in cases of insolvency, bankruptcy, or receivership.
• Other users and the public: Your profile information and user-generated content (excluding private messages) may be visible to other users or the public, including recordings you create through the Service. Such information may be collected, copied, or stored by others, including search engines, and we disclaim any responsibility for such uses.

Your Choices

• Access or update your information: If you maintain an account with us, you may review and update certain personal information by logging into your account.
• Opt-out of communications: You may opt-out of receiving marketing emails by following the unsubscribe instructions included in the communication or by contacting us directly. Please note that service-related or non-marketing communications may still be sent.
• Cookies and other technologies: Most web browsers permit you to remove or reject cookies. Disabling cookies may affect your ability to use certain features of the Service. For more information, please visit www.allaboutcookies.org.
• Blocking images/clear GIFs: Most browsers and devices allow you to prevent images from loading, which may disable certain tracking technologies such as web beacons (pixel tags/clear GIFs).
• Privacy settings: Certain privacy settings are available through the Service. For example, Apple Face ID stores facial recognition data locally on your device and is not accessible to us.
• Advertising choices: You may limit the use of your information for interest-based advertising through the following mechanisms:
  • Browser settings to block third-party cookies.
  • Privacy-focused browsers or ad-blocking plug-ins.
  • Platform-specific settings, including Google Ads Settings and Facebook Ad Preferences.
  • Industry opt-out programs, including the Network Advertising Initiative (link), Digital Advertising Alliance (link), and the AppChoices mobile application (link).
  • Mobile device settings to restrict the use of advertising identifiers.

Important Note: Opt-out settings must generally be applied individually to each device or browser. We cannot guarantee that all third parties with whom we share information participate in these programs or honor these settings.

Do Not Track

Some Internet browsers can be set to send "Do Not Track" signals when you visit online services. At this time, we do not respond to these signals. To learn more about "Do Not Track," please visit allaboutdnt.com.

Declining to Provide Information

We require certain personal information to provide specific services. If you do not provide information that we identify as required or mandatory, we may be unable to provide those services.

Linked Third-Party Platforms

If you connect to the Service through a social media account or another third-party platform, you may be able to use your account settings to control what information we receive. Revoking access will not affect information we have already received from that third party.

Delete Your Content or Close Your Account

You can delete certain content directly through your account. If you wish to close your account, please contact us and we'll help you with the process.

Other Sites and Services

The Service may include links to third-party websites, mobile apps, or online services, or our content may appear on third-party platforms. These links and integrations are not endorsements, and we are not responsible for the actions of these third parties. We encourage you to review the privacy policies of any third-party services you use.

Security

We use technical, organizational, and physical safeguards designed to protect the personal information we collect. While we strive to protect your personal information, no method of transmission over the internet or electronic storage is 100% secure. Therefore, we cannot guarantee the absolute security of your information.

International Data Transfer

We are headquartered in Canada and may use service providers that operate in other countries. Your personal information may be transferred to Canada or other locations where privacy laws may not be as protective as those in your state, province, or country.

Users in Europe should review the information below about the transfer of personal information outside of Europe.

Children

The Service is not intended for use by anyone under 18 years of age. If you are a parent or guardian and believe that we have collected personal information from your child in a manner not permitted by law, please contact us immediately.

If we become aware that we have collected personal information from a child without the consent of their parent or guardian where required by law, we will take steps to delete that information in accordance with applicable legal requirements.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Last Updated" date at the top of this Privacy Policy and, where appropriate, by other means such as posting a notice on the Service.

Any modifications will be effective upon posting, unless we indicate otherwise. Your continued use of the Service after the effective date of a modified Privacy Policy constitutes your acknowledgment and acceptance of the updated Privacy Policy.

How to Contact Us

If you have questions, requests, or concerns about this Privacy Policy or how we handle your personal information, you may contact us as follows:

Email: legal@postal.music

Notice to European Users

General

This section applies only to individuals located in the United Kingdom and the European Economic Area (EEA, collectively "Europe").

European data protection laws, including the EU General Data Protection Regulation (GDPR) and the UK GDPR, provide you with certain rights regarding your personal information.

Controller: Postal is the controller of your personal information under the GDPR (EU General Data Protection Regulation 2016/679 and UK GDPR). See "How to Contact Us" above for our contact details.

Personal information: References to "personal information" include "personal data" under the GDPR, i.e., information that directly or indirectly identifies you.

Our Legal Bases for Processing Your Personal Information

Our legal bases for processing your personal information described in this Privacy Policy are listed below:

• Where we need to perform a contract, we are about to enter into or have entered into with you ("Contractual Necessity").
• Where it is necessary for our legitimate interests and your interests and fundamental rights do not override those interests ("Legitimate Interests"). More detail about the specific legitimate interests pursued in respect of each Purpose we use your personal information for is set out in the table below.
• Where we need to comply with a legal or regulatory obligation ("Compliance with Law").
• Where we have your specific consent to carry out the processing for the Purpose in question ("Consent").

We have set out below, in a table format, the legal bases we rely on for each relevant purpose, including the categories of personal information involved. For more information on these purposes and the data types involved, see "How we use your personal information."

Purpose: Service Delivery and Operations

Categories of personal information involved:

• Contact data
• Profile data
• Communications data
• Payment data
• Recordings and other user-generated content
• Device data
• Data about others

Legal basis: Contractual Necessity

Purpose: Service Personalization

Categories of personal information involved:

• Profile data
• Recordings and other user-generated content

Legal basis: Legitimate Interests

• We have a legitimate interest in enhancing our users' experience by tailoring services to meet individual preferences.

Purpose: Service Improvement and Analytics

Categories of personal information involved:

• Profile data
• Recordings and other user-generated content
• Device data
• Online activity data
• Location data
• Communication interaction data

Legal basis: Legitimate Interests

• We have a legitimate interest in analyzing how users use the Service to identify issues, streamline operations, and optimize the overall user experience.
• Consent is obtained for optional cookies used for this purpose.

Purpose: Direct Marketing

Categories of personal information involved:

• Contact data
• Profile data
• Communications data
• Payment data
• Marketing data

Legal basis: Legitimate Interests

• We have a legitimate interest in promoting our operations and goals and sending marketing communications for that purpose.
• Consent is obtained where required under applicable data protection laws for sending marketing communications.

Purpose: Interest-Based Advertising

Categories of personal information involved:

• Device data
• Online activity data
• Location data

Legal basis: Consent

Purpose: Compliance and Protection

Categories of personal information involved:

• Any and all data types relevant in the circumstances

Legal basis: Compliance with Law; Legitimate Interests

• Where Compliance with Law does not apply, we have a legitimate interest in supporting legal processes, cooperating with authorities, and ensuring the protection, maintenance, and enforcement of our rights, property, and/or safety.

Purpose: Data Sharing in the Context of Corporate Events

Categories of personal information involved:

• Any and all data types relevant in the circumstances

Legal basis: Legitimate Interests

• We have a legitimate interest in sharing personal information in the context of corporate events to ensure continuity of the Service and business operations.

Purpose: To Create Aggregated, De-Identified, or Anonymized Data

Categories of personal information involved:

• Any and all data types relevant in the circumstances

Legal basis: Legitimate Interests

• We have a legitimate interest in creating aggregated, de-identified, or anonymized data for research purposes without infringing on users' privacy.

Retention

We retain personal information as long as necessary to fulfill the purposes for which it was collected, including:

• Satisfying legal, accounting, or reporting requirements
• Establishing or defending legal claims
• Compliance and protection purposes

Factors considered in determining retention include the type of information, sensitivity, potential risks, processing purposes, and legal requirements.

When no longer needed, we will delete or anonymize personal information. If immediate deletion is not possible (e.g., due to backup storage), information will be securely stored and isolated until deletion is feasible. Anonymized information may be used indefinitely without further notice.

Other Information

No Sensitive Personal Information: We ask that you do not provide sensitive personal information (e.g., social security numbers, racial or ethnic origin, political opinions, religious beliefs, health, biometrics, genetic characteristics, criminal background, or trade union membership) unless you consent to its processing in accordance with this Privacy Policy.

No Automated Decision-Making or Profiling: We do not engage in automated decision-making or profiling that produces legal or similarly significant effects.

Your Rights under European Data Protection Laws

If you are located in Europe (including the United Kingdom), European data protection laws provide you with certain rights regarding your personal information. You may ask us to take the following actions with respect to your personal information:

• Access: Provide you with information about how we process your personal information and give you access to it.
• Correct: Update or correct any inaccuracies in your personal information.
• Delete: Delete your personal information where there is no legitimate reason for us to continue processing it. You also have the right to request deletion if you have exercised your right to object to processing (see below).
• Transfer: Provide you, or a third party of your choice, with a machine-readable copy of your personal information.
• Restrict: Restrict processing of your personal information, for example, if you want us to verify its accuracy or understand the reason for processing.
• Object: Object to our processing of your personal information when we rely on Legitimate Interests. You may also object when we process your personal information for direct marketing purposes.
• Withdraw Consent: If we process your personal information based on your consent, you can withdraw that consent at any time.

Exercising Your Rights

Submit requests via email at contact@postal.music or by mail. We may request additional information to verify your identity. Whether we can fulfill a request depends on several factors, including why and how we process your personal information. If we cannot fulfill your request in full or in part, we will provide our reasons at the time, subject to any legal restrictions.

Right to Lodge a Complaint

If you are not satisfied with our response or how we process your information, you may file a complaint with the data protection authority in your habitual place of residence:

• European Economic Area users: EDPB Member Authorities
• United Kingdom users: ICO Complaint Form

Data Processing Outside Europe

Postal is a Canada-based company, and many of our service providers, partners, and advisors are also based in Canada or other countries. This means your personal information may be accessed, stored, or processed outside Europe, including in countries that may not provide the same level of protection as your home country.

Where we transfer your personal information outside Europe, we take steps to ensure it is adequately protected:

1. Transfers to countries with an adequacy decision: We may transfer your personal information to countries recognized by the European Commission or UK Government as providing an adequate level of protection.
2. Transfers to countries without an adequacy decision (e.g., Canada or other jurisdictions):
   • We may implement specific safeguards, such as standard contractual clauses approved by relevant authorities, to ensure your personal information is protected.
   • In limited circumstances, we may rely on a legal exception or "derogation," such as obtaining your explicit consent for the transfer.

You may contact us if you would like further information about the mechanisms we use to transfer your personal information outside Europe.