Privacy Policy

1. Who We Are

This website is operated by PostNet Denver CO149, an independently owned and operated PostNet center located at 1312 17th Street, Denver, CO 80202. You can reach us at co149@postnet.com or (303) 595-0500.

This policy explains what personal information we collect when you use postnetdenver.com, place an order, request a quote, rent a mailbox, or visit our center, and how we use and protect it. We are the controller of the personal data described here. PostNet International Franchise Corporation (the franchisor) is a separate company; where we share business data with them, it is described below.

2. What We Collect

Information you give us

• Account details: name, email address, phone number and password. Google sign-in shares your name, email and profile photo only.
• Order details: billing and shipping addresses, order contents, job specifications and the files you upload for printing. Card numbers go directly to Stripe and are never stored on our systems.
• Quote, contact and chat requests: whatever you type into a form, email, text message or the website chat assistant.
• Mailbox rental: USPS® regulations require two forms of government-issued ID (USPS Form 1583).
• Marketing preferences: whether you opted in to email or SMS updates.

Information collected automatically

• Always (strictly necessary): server logs with IP address, browser type and requested page for security and error diagnosis; cookieless, first-party page-view and performance counts from Vercel.
• Only after you click Accept on the cookie banner: analytics and advertising identifiers, page interactions, session replays and ad-click data collected by the tools listed in Section 4.

3. How We Use It

• Producing and delivering your print orders, packing and shipping jobs, and mailbox services.
• Sending proofs, order confirmations, shipping updates and receipts (transactional messages).
• Answering quotes, questions and support requests.
• Keeping your account working and your cart saved between visits.
• Preventing fraud, securing the site, and meeting legal, tax and USPS® record-keeping obligations.
• With your consent, understanding how the site is used and measuring and personalizing our advertising.
• With your consent, sending marketing email or SMS about our services and offers.

4. Cookies & Tracking Technologies

When you first visit, only strictly necessary technologies run. Every analytics and advertising tool below is off by default and loads only after you click Accept on the cookie banner. Clicking Decline keeps them off. Your choice is saved in your browser and you can change it at any time in Section 5.

Loaded only after you click Accept

Strictly necessary / first-party (always on)

• Vercel Analytics & Speed Insights: Cookieless, first-party page-view counts and performance timings. No cookies, no cross-site identifiers, no personal profile.
• Supabase authentication session: Keeps you signed in to your account. Only set when you log in.
• Stripe: Payment processing and fraud prevention on the checkout page. Your card details go directly to Stripe; our servers never see them.
• Cart and site preferences (localStorage): Remembers your cart, your cookie choice, and dismissed notices. Stored only in your browser and never sent to an advertising network.

Blocking strictly necessary cookies in your browser may prevent sign-in, checkout and cart persistence from working.

5. Your Choices

• Cookie banner: choose Accept or Decline on your first visit. Analytics and advertising tools load only if you accept.
• Change your mind: use the control below to switch your choice or clear it and see the banner again.
• Browser settings: every major browser lets you block or delete cookies and site data.
• Google: manage ad personalization at adssettings.google.com or install the Google Analytics opt-out add-on.
• Meta: manage ad preferences at facebook.com/adpreferences.
• Microsoft Advertising: declining cookies here keeps the Bing Ads tag off; manage Microsoft ad personalization at account.microsoft.com/privacy/ad-settings.
• Microsoft Clarity: declining cookies here keeps Clarity off; Microsoft's own controls are at account.microsoft.com/privacy.
• Industry opt-outs: optout.aboutads.info and optout.networkadvertising.org.

6. Global Privacy Control

We honor the Global Privacy Control (GPC) browser signal. If your browser or extension sends GPC, we treat it as a request to opt out of targeted advertising and of any sale of personal data: the cookie banner is set to Decline automatically and no analytics or advertising tag loads. You may still opt in on this page if you want to. Learn more at globalprivacycontrol.org.

7. Colorado Residents (Colorado Privacy Act)

If you are a Colorado resident, the Colorado Privacy Act (CPA) gives you the right to:

• Access the personal data we hold about you and confirm whether we process it.
• Correct inaccurate personal data.
• Delete your personal data (subject to legal retention requirements, such as tax and USPS® records).
• Data portability: receive a copy of your data in a portable, readily usable format.
• Opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not sell personal data or perform such profiling; you can opt out of targeted advertising by declining cookies, using the control in Section 5, or sending a GPC signal.

How to exercise your rights

Email co149@postnet.com with the subject line "Privacy request", or call (303) 595-0500. Tell us which right you are exercising. We may ask for information needed to verify your identity (for example, confirming the email on your account). We respond within 45 days; if a request is complex we may extend once by a further 45 days and will tell you why. An authorized agent may submit an opt-out request on your behalf.

Appeals

If we decline to act on your request, you may appeal by replying to our decision or emailing co149@postnet.com with the subject line "Privacy request appeal". We will respond to the appeal within 45 days with a written explanation. If your appeal is denied, you may contact the Colorado Attorney General at coag.gov. We will never discriminate against you for exercising these rights.

Residents of other states with similar laws (for example California, Virginia, Connecticut, Utah, Oregon or Texas) may use the same process.

8. We Do Not Sell Personal Data

We do not sell your personal data and we do not share it with data brokers. Advertising tools (Google Ads, Meta) receive data only after you accept cookies, and only for measuring and showing our own ads. We share personal data only with the service providers in Section 12 who process it on our behalf, with shipping carriers to deliver your package, with PostNet International Franchise Corporation for franchise-level reporting under our agreement, with a buyer if our center is ever sold, or when required by law.

9. Data Retention

• Account data: as long as your account exists; deleted within 30 days of a verified deletion request.
• Order and invoice records: 7 years (tax requirement).
• Uploaded print files: up to 12 months after the job is complete so you can reorder, unless you ask us to delete them sooner.
• Emails, chats and support threads: 3 years.
• Mailbox records (USPS® Form 1583): 3 years after the mailbox closes, as required by the Postal Service.
• Analytics and advertising data: Google Analytics event data is kept for no more than 14 months (the GA4 maximum for standard properties); other providers follow the retention schedules in their policies linked in Section 4.

10. Security

All pages are served over HTTPS (TLS). Payments are processed by Stripe, a PCI DSS Level 1 provider; card numbers never touch our servers. Passwords are hashed by Supabase. Access to customer records inside our center is role-based, so team members only see what their job requires. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as required by Colorado law.

11. Children

Our website and services are not directed to children under 13 and we do not knowingly collect personal data from them. If you believe a child has provided us information, email co149@postnet.com and we will delete it.

12. Third-Party Services & Links

These providers process data on our behalf to run the site and fulfill your orders. Each receives only what it needs for its role.

Links to carrier tracking pages, Stripe, Canva, Anytime Mailbox, PostNet.com or social networks take you to sites governed by their own privacy policies. We are not responsible for their practices.

13. SMS & Email Marketing

We send marketing email or text messages only if you opted in. Reply STOP to any text message to opt out of SMS, or click the unsubscribe link in any marketing email. You will still receive transactional messages such as proofs, order confirmations and shipping updates, because those are part of fulfilling your order. Message and data rates may apply to SMS.

14. Changes to This Policy

When we update this policy the date at the top changes. Material changes (a new category of data, a new tracking tool, or a new purpose) will be announced on this page and, for registered customers, by email before they take effect.

15. Contact