Privacy policy

1. Scope and responsible company

This Privacy Policy explains how Great Lakes Computing Office LLC (“Company,” “we,” “us,” or “our”) handles personal information through the IRIS Postal Forms website, applications, developer portal, API and MCP endpoints, order pages, administrator tools, and related communications (collectively, the “Service”).

This policy does not govern the independent practices of Stripe, Lob, the United States Postal Service (“USPS”), or other websites that publish their own privacy notices.

2. Information we collect

Documents, postcard content, and mailing information

We process PDF letters, generated postcard fronts and backs, messages, sender and recipient names and postal addresses, selected print and mailing options, document page counts, and information needed to suggest an address and produce a mailpiece. When you choose your own postcard photo, the raw JPEG, PNG, or WebP stays in your browser; we receive the resulting private print-ready PDFs. Submitted content may contain personal information that you or another person placed in it.

Order, payment, and delivery information

We maintain order identifiers, prices, payment and fulfillment status, Stripe Checkout session identifiers, Lob mailpiece identifiers, expected delivery dates, USPS tracking numbers, and mail-event history. Stripe collects payment-card details directly. We do not receive or store complete card numbers or card security codes. Stripe provides the checkout email address used for receipts and delivery notices.

Communications and administration

The contact form collects your name, email address, selected topic, message, and an optional order number. It does not accept attachments. IRIS stores the request in its support intake, screens it for spam, and creates a Linear support issue through a server-side worker. Amazon SES sends one acknowledgement to your validated email address. Do not submit card numbers, passwords, full Social Security numbers, document contents, or unnecessary sensitive information. Authorized personnel may also have administrator account information, password hashes, session records, and audit information required to operate the Service.

Developer accounts, API keys, and credits

For developer-platform users, we process account names and email addresses, password hashes, email-verification and password-reset token hashes, session records, API-key names, prefixes, scopes and cryptographic hashes, key-use timestamps, credit purchases and ledger entries, and idempotency records. Complete API-key secrets are displayed once and are not stored by IRIS.

Technical and security information

We and our infrastructure providers may process IP addresses, timestamps, request details, browser or device information, error records, and security signals. The Service uses IP addresses for rate limiting and abuse prevention. Hosting and service providers may keep ordinary request and delivery logs under their own retention practices.

Site analytics and measurement

When Analytics is on (see “Managing your choices” in section 7), we use Google Analytics (operated by Google LLC) to measure aggregate use, traffic sources, and navigation patterns on public marketing, pricing, legal, mailing-guide, and template pages, along with customer document preparation, checkout, order-status, and support interactions. Google Analytics receives a sanitized page location (including allowlisted campaign parameters such as utm_source, utm_medium, utm_campaign, utm_term, and utm_content), the page title, referring-site origin, and standard browser technical characteristics. When enabled, Google Analytics sets host-only cookies (_ga and stream-specific identifiers) with a 180-day lifespan to distinguish unique visits across browser sessions.

Google processes this data as our service provider under Google Analytics terms. We configure Google Analytics with Google signals disabled, ad personalization signals disabled, and advertising data redaction enabled.

We strictly exclude mail content, uploaded PDFs, photos, customer and recipient addresses, form values, private order IDs and links, administrator pages, and API activity from Google Analytics. Customer workflow events use generic screen names, product types, totals, and outcomes. Confirmed purchases use a hashed transaction reference; the private order ID is not sent. An optional session marker connects checkout to its confirmation and is removed after tracking the purchase or turning Analytics off. While Analytics is off, no Google Analytics script loads, no cookies are set, and no cookieless pings are transmitted.

AI applications and automated clients

The Service provides a developer API and an authenticated Streamable HTTP MCP endpoint. An API or MCP client receives the tool definitions, inputs, and results needed for the request. The operator of an AI application and its provider may independently process prompts, tool calls, addresses, document metadata, and results under their own terms and privacy policies. IRIS does not send private PDF contents to the MCP client after upload, but the operator is responsible for information it supplies to that client.

3. Sources of information

We receive information:

• directly from you when you upload a document, create postcard PDFs, complete an order, or contact us;
• from Stripe when a Checkout session is completed;
• from Lob and USPS as a mailpiece is prepared, mailed, scanned, delivered, or returned;
• from administrators who support an order; and
• automatically from the Service and its security infrastructure.

4. How we use information

We use information to:

• suggest addresses, calculate prices, create orders, and process payments;
• store, validate, print, mail, and track letters and postcards at your direction;
• send receipts, delivery updates, return notices, and service communications;
• provide order status, customer support, accounting, and dispute handling;
• authenticate administrators and developer accounts, authorize API keys, maintain credit ledgers, and protect the Service from fraud, abuse, and attacks;
• debug, maintain, and improve reliability and accessibility;
• enforce our Terms of Use and Acceptable Use Policy; and
• comply with legal, tax, regulatory, and recordkeeping obligations.

Where a law requires a legal basis, we rely as applicable on performance of a contract, compliance with law, our legitimate interests in operating and securing the Service, and consent where requested.

5. Information about recipients and other people

If you submit information about another person, you are responsible for having a lawful reason to provide it and for giving any notice or obtaining any permission required by law. Do not upload personal or sensitive information that is unnecessary for the mailpiece.

6. How we disclose information

We disclose information only as reasonably needed for the following purposes:

• Printing and delivery: Lob and its print network receive the letter PDF or postcard front and back PDFs, addresses, and print options. USPS receives the information required to transport and deliver the mailpiece.
• Payments: Stripe receives Checkout and transaction information and processes payment credentials under its own terms and privacy policy.
• Cloud and email services: Amazon Web Services provides private S3 PDF storage and SES transactional email delivery.
• AI applications and automated clients: If you use the developer API or the authenticated MCP endpoint, your client or AI provider receives the request inputs and results needed to perform your instructions. Private PDFs upload directly to IRIS storage and are not returned through MCP. You are responsible for configuring and authorizing the client and for reviewing every mailing before submission.
• Analytics and measurement: When Analytics is on, Google LLC receives aggregate public-page navigation signals as described above.
• Operations: Hosting, database, security, professional-adviser, and support providers may process limited information to perform services for us.
• Legal and safety: We may disclose information when reasonably necessary to comply with law, protect rights or safety, investigate abuse, or respond to valid legal process.
• Business transactions: Information may transfer as part of a merger, financing, acquisition, reorganization, or sale of assets, subject to applicable law.

We do not sell personal information, rent mailing lists, or share personal information for cross-context behavioral advertising. We do not use uploaded letters, postcard photos, generated postcard PDFs, addresses, or support messages to train generative AI models.

7. Cookies, local storage, and attribution

The public customer ordering flow does not require an IRIS customer account. The Service uses the following browser storage and cookie categories:

• Essential browser storage: Strictly necessary, HTTP-only session cookies are used for authorized administrator and developer-portal access. Local storage is used to remember your cookie consent preferences (iris:consent:v1, stored for 180 days) and in-progress draft content. Essential storage cannot be disabled because the service cannot function securely without it.
• Analytics cookies: When Analytics is on, Google Analytics sets host-only cookies (_ga and related stream cookies) with a 180-day lifespan on public pages to measure visitor journeys.
• Marketing click attribution: If you arrive through an online advertisement (such as Google Ads or Microsoft Advertising) while Marketing attribution is on, we store the ad click identifier (gclid or msclkid) in temporary browser session storage. If you complete a mailing purchase, this click identifier is associated with your order so we can measure advertising campaign effectiveness and report offline conversions. We do not install third-party advertising pixels, retargeting tags, or social-media trackers on the Service.

Managing your choices: If your IP address places you in the United States or a U.S. territory, Analytics and Marketing attribution are on by default and no cookie banner appears. Everywhere else, both stay off until you turn them on in the cookie banner. Wherever you are, you can change your choices at any time by clicking Cookie settings in the website footer. Turning Analytics off immediately disables analytics measurement and deletes Google Analytics cookies from your browser; turning Marketing attribution off clears stored ad click identifiers.

If your browser sends a Global Privacy Control signal, Analytics and Marketing attribution stay off by default; a choice you save in Cookie settings replaces that default. Browser “Do Not Track” signals do not change behavior on the Service.

8. Retention

We retain information for the time reasonably needed to fulfill orders, provide tracking and support, maintain developer accounts, credit and security ledgers, meet tax and accounting duties, resolve disputes, and enforce agreements. Revoked API-key hashes and idempotency records may be retained to prevent reuse and support security or accounting. Contact-form fields and related support correspondence are retained according to the support issue, legal obligations, and operational need. Retention varies by record type and legal obligation. Aggregate analytics may be retained to compare public-site use over time and may be deleted when no longer useful. Uploaded documents may be deleted after fulfillment or earlier when operationally and legally permitted. Backup copies may persist for a limited period before being overwritten.

9. Security

We use administrative, technical, and organizational safeguards designed for the nature of the information, including private object storage, encrypted transport, restricted administrator access, password hashing, signed sessions, write-once upload keys, and time-limited document URLs. No storage or transmission method is completely secure, and we cannot guarantee absolute security.

10. Your choices and privacy rights

Depending on your location and subject to legal exceptions, you may have rights to request access, correction, deletion, restriction, objection, or a portable copy of personal information. You may also have a right to appeal a denied request or complain to a privacy regulator.

We may need to verify your identity and authority before acting. We may retain limited records when required by law or needed to prevent fraud, honor an opt-out, or establish, exercise, or defend legal claims. We will not discriminate against you for exercising an applicable privacy right.

11. United States processing

The Service is operated from the United States and is designed for United States postal mail. Information may be processed and stored in the United States, where privacy laws may differ from those in your location.

12. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information directly from a child under 13. A person placing an order must satisfy the eligibility requirements in the Terms of Use.

13. Third-party services and links

A link to or integration with another service does not make us responsible for that service’s privacy, security, content, or availability. Review the provider’s notices before submitting information directly to it.

14. Changes to this policy

We may update this policy when the Service, providers, or legal requirements change. The effective date above identifies the current version. Material changes apply prospectively unless applicable law requires another form of notice or consent.

15. Contact us

Submit privacy questions or requests through the IRIS Postal Forms contact page. Include enough information for us to identify the relevant order or record, but do not send payment-card numbers, passwords, full Social Security numbers, document attachments, or unnecessary sensitive information.