In force since 21 August 2026
Here we explain, plainly, what data we collect, what for, who we share it with and what you can demand of us. It applies to the person who buys and to the person who receives a letter. Written to comply with the European Union General Data Protection Regulation (GDPR) and Colombia’s Law 1581 of 2012.
The data controller is Hugo Echeverri Jaramillo, identified by C.C. 98.665.959, with address at Medellín, Colombia. For any privacy matter or to exercise your rights, write to hello@postalforever.com.
| Data | From whom | What for |
|---|---|---|
| Buyer’s email | Whoever pays | Send the copy, the link and the safekeeping warnings |
| Recipient’s email(s) | Provided by whoever pays | Deliver the letter to the person who receives it |
| Recipient’s WhatsApp | Optional | Let them know by WhatsApp that the letter arrived |
| Letter content: text, photo, video, audio | Whoever creates it | Compose and deliver the letter |
| Country, language, device type and the pin of origin | Whoever visits | Know which content works; it never identifies anyone |
| Payment data | — | Handled by the merchant of record; we never see your card |
Cookies: only what is needed
We use no tracking cookies, no third-party analytics and no advertising pixels: we do not follow you around other sites. Visit measurement uses an identifier that lives in your browser until you close the tab; all that remains in our database is one anonymous line — country, language, device type and the pin that brought you — that cannot be tied back to you. That is why we do not greet you with a cookie banner: browsing the site there is none to consent to. The one exception is music from other services, and we cover it under Music from other services.
Read this if you leave a legacy letter
We do not ask you for health data or any special category of data. If you decide to include them in your letter — for example, in a message about an illness — you do so of your own will and expressly authorise us to store and deliver them for the sole purpose of carrying out your instruction (art. 9.2.a GDPR). We use them for nothing else.
We do not sell your data and we do not pass it on for commercial purposes. It is processed only, on our behalf and under contract, by the providers needed for the service to work:
| Provider | Where | What for |
|---|---|---|
| Lemon Squeezy, LLC | United States | Charging the payment and taxes (merchant of record) |
| Vercel, Inc. | United States / global network | Serving the site: it handles every visit and runs the daily tasks |
| Supabase (base de datos) | Brazil (São Paulo) | Storing the order, the emails and the letter content |
| Cloudflare R2 | United States / global network | Storing the files you upload: video, audio and photo |
| Resend | United States | Sending the emails |
You can give the letter a song from YouTube, Vimeo, Dailymotion or Spotify. When that happens the player is served by that company, not by us: as it loads it receives the IP address and browser details of whoever opens the letter, and it may store information on their device. That is beyond our control and is governed by each company’s own privacy policy.
If you would rather no third party took part, choose one of the house melodies: we serve those ourselves and they never leave here.
Some of those providers store data outside the European Union (for example, the database is in Brazil and other services are in the United States). When an international transfer takes place, we require it to be covered by adequate safeguards — such as the standard contractual clauses approved by the European Commission — so that your data stays just as protected.
At any time and free of charge, you may:
Write to us at hello@postalforever.com and we answer within the legal deadline. If you believe we did not handle your request properly, you may turn to the supervisory authority: in Colombia, the Superintendency of Industry and Commerce; in the European Union, the data protection authority of your country.
There are two ways to ask, both equally valid: write to hello@postalforever.com, or use the requests, complaints and claims form choosing “A request about my data”. If you ask us to delete a letter, it is removed from the database together with the video, audio and photos that go with it, and we confirm in writing once it is done. Deletion is final: the letter will stop opening for the person who received it too.
The service is for adults. A letter addressed to a child (for a birth or a birthday) is always created and managed by an adult.
We encrypt connections, the letter links are impossible to guess and the database is not publicly accessible. Even so, no system is infallible: that is why we recommend you download and keep your letter.
If we change this policy, we will publish the new version here with its date.
These texts protect your relationship with the people who buy from you and meet the frameworks applicable on the date of their last revision. They are not a substitute for review by a qualified lawyer, which is advisable before operating at high volume or in a country with its own requirements.
These terms apply exactly as you read them. We publish them in eight languages and all of them are equally binding: the one that applies to you is the one in your language.
Postal Forever · In force since 21 August 2026