Privacy policy

1. Scope and responsible company

This Privacy Policy explains how Great Lakes Computing Office LLC (“Company,” “we,” “us,” or “our”) handles personal information through the IRIS Postal Forms website, applications, order pages, administrator tools, and related communications (collectively, the “Service”).

This policy does not govern the independent practices of Stripe, Lob, the United States Postal Service (“USPS”), or other websites that publish their own privacy notices.

2. Information we collect

Documents and mailing information

We process PDFs and generated letters you submit, sender and recipient names and postal addresses, selected print and mailing options, document page counts, and information needed to verify an address and produce a mailpiece. A document may contain personal information that you or another person placed in it.

Order, payment, and delivery information

We maintain order identifiers, prices, payment and fulfillment status, Stripe Checkout session identifiers, Lob mailpiece identifiers, expected delivery dates, USPS tracking numbers, and mail-event history. Stripe collects payment-card details directly. We do not receive or store complete card numbers or card security codes. Stripe provides the checkout email address used for receipts and delivery notices.

Communications and administration

The contact form collects your name, email address, selected topic, message, and an optional order ID. It does not accept attachments. Amazon SES delivers the internal notification to support@irispostalforms.com and sends the acknowledgement to your validated email address. The IRIS support alias may forward the internal notification to the operator's support mailbox. Do not submit card numbers, passwords, full Social Security numbers, document contents, or unnecessary sensitive information. Authorized personnel may also have administrator account information, password hashes, session records, and audit information required to operate the Service.

Technical and security information

We and our infrastructure providers may process IP addresses, timestamps, request details, browser or device information, error records, and security signals. The Service uses IP addresses for rate limiting and abuse prevention. Hosting and service providers may keep ordinary request and delivery logs under their own retention practices.

Browser-integrated assistants

The Service exposes WebMCP tools to compatible browser-integrated assistants. Tool names, descriptions, and input schemas can be discovered while a supported page is open. If you direct an assistant to use a tool, the assistant and its provider may process your prompt, tool inputs and results, and visible page information under their own terms and privacy policies.

3. Sources of information

We receive information:

• directly from you when you upload a document, complete an order, or contact us;
• from Stripe when a Checkout session is completed;
• from Lob and USPS as a mailpiece is prepared, mailed, scanned, delivered, or returned;
• from administrators who support an order; and
• automatically from the Service and its security infrastructure.

4. How we use information

We use information to:

• verify addresses, calculate prices, create orders, and process payments;
• store, validate, print, mail, and track documents at your direction;
• send receipts, delivery updates, return notices, and service communications;
• provide order status, customer support, accounting, and dispute handling;
• authenticate administrators and protect the Service from fraud, abuse, and attacks;
• debug, maintain, and improve reliability and accessibility;
• enforce our Terms of Use and Acceptable Use Policy; and
• comply with legal, tax, regulatory, and recordkeeping obligations.

Where a law requires a legal basis, we rely as applicable on performance of a contract, compliance with law, our legitimate interests in operating and securing the Service, and consent where requested.

5. Information about recipients and other people

If you submit information about another person, you are responsible for having a lawful reason to provide it and for giving any notice or obtaining any permission required by law. Do not upload personal or sensitive information that is unnecessary for the mailpiece.

6. How we disclose information

We disclose information only as reasonably needed for the following purposes:

• Printing and delivery: Lob and its print network receive the document, addresses, and print options. USPS receives the information required to transport and deliver the mailpiece.
• Payments: Stripe receives Checkout and transaction information and processes payment credentials under its own terms and privacy policy.
• Cloud and email services: Amazon Web Services provides private S3 document storage and SES transactional email delivery.
• Browser assistants: If you choose to invoke a WebMCP tool, your browser or assistant provider receives the tool inputs and results needed to carry out that request. IRIS WebMCP tools do not provide uploaded PDF contents or payment-card credentials to the assistant. A tool may prepare mailing details and, when offered, create a pending order and open Stripe Checkout. You enter payment credentials directly into Stripe and personally submit its payment interface.
• Operations: Hosting, database, security, professional-adviser, and support providers may process limited information to perform services for us.
• Legal and safety: We may disclose information when reasonably necessary to comply with law, protect rights or safety, investigate abuse, or respond to valid legal process.
• Business transactions: Information may transfer as part of a merger, financing, acquisition, reorganization, or sale of assets, subject to applicable law.

We do not sell personal information, rent mailing lists, or share personal information for cross-context behavioral advertising. We do not use uploaded documents to train generative AI models.

7. Cookies and tracking

The customer ordering flow does not require an IRIS customer account. The Service uses a strictly necessary, HTTP-only session cookie for authorized administrator access. Stripe and other linked services may use their own cookies when you visit their pages. We do not operate advertising pixels or cross-site behavioral advertising on the Service.

Because we do not sell or share personal information for targeted advertising, browser Global Privacy Control and “Do Not Track” signals do not change advertising behavior on the Service.

8. Retention

We retain information for the time reasonably needed to fulfill orders, provide tracking and support, maintain security and audit records, meet tax and accounting duties, resolve disputes, and enforce agreements. Contact-form fields and related support correspondence are retained according to the support issue, legal obligations, and operational need. Retention varies by record type and legal obligation. Uploaded documents may be deleted after fulfillment or earlier when operationally and legally permitted. Backup copies may persist for a limited period before being overwritten.

9. Security

We use administrative, technical, and organizational safeguards designed for the nature of the information, including private object storage, encrypted transport, restricted administrator access, password hashing, signed sessions, write-once upload keys, and time-limited document URLs. No storage or transmission method is completely secure, and we cannot guarantee absolute security.

10. Your choices and privacy rights

Depending on your location and subject to legal exceptions, you may have rights to request access, correction, deletion, restriction, objection, or a portable copy of personal information. You may also have a right to appeal a denied request or complain to a privacy regulator.

We may need to verify your identity and authority before acting. We may retain limited records when required by law or needed to prevent fraud, honor an opt-out, or establish, exercise, or defend legal claims. We will not discriminate against you for exercising an applicable privacy right.

11. United States processing

The Service is operated from the United States and is designed for United States postal mail. Information may be processed and stored in the United States, where privacy laws may differ from those in your location.

12. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information directly from a child under 13. A person placing an order must satisfy the eligibility requirements in the Terms of Use.

13. Third-party services and links

A link to or integration with another service does not make us responsible for that service’s privacy, security, content, or availability. Review the provider’s notices before submitting information directly to it.

14. Changes to this policy

We may update this policy when the Service, providers, or legal requirements change. The effective date above identifies the current version. Material changes apply prospectively unless applicable law requires another form of notice or consent.

15. Contact us

Submit privacy questions or requests through the IRIS Postal Forms contact page. Include enough information for us to identify the relevant order or record, but do not send payment-card numbers, passwords, full Social Security numbers, document attachments, or unnecessary sensitive information.