Privacy Policy

1Operating Identity & Scope

This Privacy Policy explains how Aster & Blanche Press, operating the website located at sendmynotes.com (“we”, “us”, “our”, or the “Service”), collects, uses, processes, discloses, and safeguards personal information when you visit our website, design greeting cards, utilize our artificial intelligence generation tools, or order physical robotic pen handwritten mailings.

Aster & Blanche Press operates as an independent commercial venture conducted by its sole proprietor owner, with principal editorial and administrative studio operations based in Lake Forest, Illinois, and specialized physical robotic printing and fulfillment operations dispatched via our production partner Handwrytten, Inc. in Phoenix, Arizona. As our business expands, we reserve the right to organize or assign this service to an affiliated successor entity (such as a Limited Liability Company or Corporation) without diminishing your privacy rights under this policy.

By accessing or using sendmynotes.com, you acknowledge the data collection, use, and disclosure practices described in this policy. You may manage optional tracking and advertising preferences as detailed in Section 6.

2Information We Collect

To manufacture and physically deliver custom greeting cards, process payments, and measure website performance, we collect the following categories of information:

• Purchaser Contact Identifiers: Your email address and phone number (if provided during checkout or account creation) to deliver transaction receipts, order status updates, and customer support notifications.
• Physical Mailing & Delivery Information (Recipient): The recipient's full name, street address, secondary unit/suite/apartment number, city, state, and postal code. This information is used strictly to print physical envelope address labels and induct mailings into the USPS mail stream. Recipient addresses and recipient names are never provided to advertising platforms or data brokers.
• Return Address Information (Purchaser/Sender): The sender name, street address, city, state, and postal code provided to appear on the upper-left corner of the envelope. Purchaser city, state, and postal code may also be used in hashed form for conversion matching where permitted by law and your privacy choices.
• Custom Card Content & Correspondence: The custom prompts submitted to our AI artwork generators, chosen cover images, pre-printed sentiments, and personal handwritten messages typed for physical reproduction by robotic plotting pens. Your card correspondence and handwritten text are treated as private personal communications and are never provided to advertising platforms.
• Payment & Billing Information: Payment card details (card number, expiration date, CVV, and billing zip code) are collected and processed directly by our third-party payment gateway, Stripe, Inc. We never receive, process, or store full credit card numbers or CVV codes on our application servers.
• Technical & Telemetry Data: Standard internet log information, including your IP address, browser type, operating system, referring URL, device type, timestamp of visits, and sliding-window rate-limiting tokens used to prevent automated abuse.
• Advertising, Analytics & Cookie Telemetry: When you browse our website, we and our service partners (including Meta and Google) utilize browser cookies, web beacons, and local/session storage tokens (such as smn_attribution). These capture advertising click parameters (such as fbclid and gclid), referring marketing campaigns, and site engagement events.
• Hashed Customer Identifiers (Customer Matching): Where permitted by applicable law and your privacy choices, we send Meta certain customer contact details in hashed form to match website activity with information Meta holds, measure advertising results, and support advertising optimization. Hashing transforms these details before transmission using cryptographic SHA-256 algorithms, but does not make them anonymous or prevent Meta from matching them to an individual. The specific contact fields transmitted in hashed form are purchaser email, purchaser first and last name, purchaser phone (if provided), and purchaser city, state, postal code, and country from your return address. We do not include card messages or recipient information in this advertising data.
• Optional Account Data: If you voluntarily sign in via Google OAuth or create an email account, we store your Firebase User ID (UID), display name, email, and any addresses you choose to save to your personal address book.

3How We Use Your Information

We use the information we collect for legitimate commercial, operational, and marketing purposes:

• Physical Manufacturing & Fulfillment: Printing card artwork on cardstock, using automated equipment holding real pens to write your message, preparing envelopes, applying postage stamps, and mailing via USPS First Class.
• Payment Processing: Facilitating secure credit/debit card transactions and fraud prevention through Stripe.
• Customer Communications: Sending transactional order receipts, production milestones, shipment notices, and responding to feedback inquiries.
• Address Book Management: Allowing registered users to retrieve previously saved recipient and return addresses for faster repeat checkout.
• System Reliability & Abuse Prevention: Enforcing fair-use limits on our AI image generators, preventing fraudulent card testing, and investigating software anomalies.
• Marketing & Advertising Optimization: Evaluating advertising effectiveness, calculating conversion rates, attributing orders from online campaigns, and optimizing marketing delivery.

4Parties to Whom Information is Disclosed & Methods of Disclosure

To operate the Service, physically mail greeting cards, and measure website performance, we disclose specific customer data to trusted service providers through encrypted programmatic interfaces (APIs) or physical delivery channels:

5Security Practices & Safeguards

We implement industry-standard administrative, physical, and technical safeguards designed to protect personal information against unauthorized access, loss, alteration, or misuse:

• Encryption in Transit: All communication between your browser and our servers is secured using modern Transport Layer Security (TLS 1.3 / HTTPS) with strict certificate validation.
• PCI-DSS Compliance: All credit card transactions are handled through Stripe Elements using client-side tokenization. Raw cardholder data never touches our application servers or database storage.
• Automated Redaction: Our server diagnostic routines and error logging engines automatically sanitize and redact API tokens, machine keys, and private credentials before any system incident records are generated.
• Access Controls: Access to backend order repositories and database consoles is strictly restricted using multi-factor authentication and role-based permissions.

While we use commercially reasonable measures to protect your data, no method of transmission over the Internet or electronic storage is 100% secure. Consequently, we cannot guarantee absolute security.

6Data Retention & Your Choices

We retain customer order records, transaction receipts, and correspondence content for as long as necessary to complete physical fulfillment, provide customer support, comply with legal, tax, and accounting obligations (typically up to 7 years for financial records), and resolve disputes. Session attribution records and temporary marketing cache tokens are retained for up to 90 days or until cleared.

Depending on your jurisdiction (including under the California Consumer Privacy Act / CPRA and other applicable state laws), you may have the following rights regarding your personal data:

• The right to know what personal information we collect, use, disclose, and sell or share.
• The right to request access to and a copy of the personal data we hold about you.
• The right to request correction or updating of inaccurate account information.
• The right to request deletion of your account and personal data, subject to legal recordkeeping exceptions.
• The right to opt out of the “sale” or “sharing” of your personal information for cross-context behavioral advertising.
• The right not to receive discriminatory treatment for exercising your privacy rights.

7Sole Proprietor Status, Business Transfers & Liability

Aster & Blanche Press operates as a sole proprietorship. To the fullest extent permitted by applicable law, neither the individual sole proprietor, nor Aster & Blanche Press, shall be liable for indirect, incidental, special, punitive, or consequential damages arising from:

• Any security breach, data compromise, or interruption occurring on the networks of third-party vendors (including Stripe, Handwrytten, Google Cloud, Meta, or USPS).
• Postal carrier delays, lost mail, delivery errors, or mailbox thefts occurring once envelopes are in the custody of the United States Postal Service.
• User-submitted content, unauthorized account access resulting from compromised user credentials, or customer-provided inaccurate recipient addresses.

In the event that Aster & Blanche Press reorganizes into an LLC, corporation, or merges with another business entity, customer records and rights under this policy may be transferred to the successor operating entity.

8Children's Online Privacy Protection (COPPA)

Our Service is directed to general consumer audiences capable of entering into binding payment contracts. We do not knowingly solicit or collect personal information from children under the age of 13. If you believe a child under 13 has provided personal data to us without parental consent, please contact us immediately so we can remove the information.

9Changes to this Privacy Policy

We may revise this Privacy Policy periodically to reflect changes in our operational procedures, fulfillment practices, or statutory requirements. When updates are published, the “Effective Date” at the top of this page will be revised. Previous versions of this policy are archived and available upon written request. We encourage you to review this policy periodically.