Privacy Policy

Last Updated: Oct 29th, 2026.

Online-Post.ca is a service provided by Davette (Business Number: 79277 2238, BC PST: PST-1498-6273), a sole proprietorship registered in British Columbia, Canada.

1. Introduction

Davette, operating as Online-Post.ca ("we", "us", or "our"), lets individuals and organizations send physical letters online. This Privacy Policy explains what personal information we collect when you visit our website, order as a guest, use an account dashboard, or contact us, and how we use, share, keep and protect it. It also covers information you give us about other people, such as the recipients of your letters.

We follow the Personal Information Protection and Electronic Documents Act (PIPEDA), the British Columbia Personal Information Protection Act (PIPA) and, for people in Quebec, Quebec's Act respecting the protection of personal information in the private sector. Our Privacy Officer is accountable for our compliance (see Section 15).

2. Information We Collect

We collect only the information we need to print and mail your letters, run your account, and meet our legal obligations.

2.1 Information You Provide

Contact and account details: your name and email address. If you create an account, our sign-in provider also holds your sign-in details and the Organizations you belong to.
Sender information: the name and mailing address printed as the sender and return address. For Organization accounts, this is the Organization's return address.
Recipient information: the name and mailing address of each person you send a letter to.
Letter content: the PDF you upload, or the template you fill in, including everything written in it.
Billing information: your billing name, billing address and billing email, used to take payment, calculate taxes, and issue invoices and receipts. Card numbers go directly to our payment processor, Stripe. We only receive the card brand, last four digits and expiry date.
Support messages: your name, email address and the messages you send us through our contact form or by email, including any attachments.
Marketing choice: whether you agreed to receive marketing emails.

2.2 Information Created When You Use an Account

Order records: the options you chose, prices and taxes, status history, tracking numbers, and which Member placed each order.
Organization records: Members and their roles, return and billing addresses, and the billing email.
Billing records: saved cards (brand, last four digits and expiry), prepaid credit balance and transactions, automatic reload settings, pricing tier, invoices, receipts and credit notes.
Authorization records: when an Administrator saves a card, accepts the credit terms, or turns automatic reload on or off, we record the exact text accepted, its version, the date and time, the user, the IP address and the browser's user agent. We keep these as proof of the authorization.

2.3 Information Collected Automatically

Analytics, only with your consent: the pages you view, the links and buttons you click, how you reached our site (referring page and campaign tags), your browser, device type, operating system, and approximate location derived from your IP address. We also record steps in the order flow, such as destination country, price, page count and options chosen, and the searches you type into our Help Center. If you are signed in, these events are linked to your account ID, your Organization ID, and your role in it. Analytics events do not include your name, email address, letter content, the addresses you enter, or your card details. See Section 10.
Error reports and server logs: when something fails in your browser or on our servers, we record technical details such as the page or request, the error, the time, your IP address, and your account ID if you are signed in. Server logs can also contain your email address, for example when we send you an email.
Security signals: we use your IP address to limit repeated requests. Cloudflare Turnstile checks your browser on our order, tracking and contact forms to block automated abuse. Stripe uses payment and device information to screen payments for fraud.
Address suggestions: when you type an address, the text you type is sent to Google to suggest matching addresses.

2.4 Information About Other People

When you send a letter, you give us the recipient's name and address, and your letter may contain information about them or others. When an Administrator invites someone to an Organization, we receive that person's email address. You must have the right to share this information with us for these purposes. We use recipient information only to print, mail and track your letter and to keep the order records described in Section 8. We never contact your recipients other than by delivering your letter.

3. How We Use Your Information

We use your personal information for the following purposes:

3.1 To Provide the Service

Printing, mailing and tracking your letters
Calculating taxes, taking payment, and issuing receipts, monthly invoices and credit notes
Running Organization accounts: Members and roles, saved cards, prepaid credits, automatic reload and pricing tiers
Keeping authorization records for card and credit charges

3.2 To Communicate With You

Order confirmations and mailing notices, sent to the person who placed the order, or to the Organization's billing contact if we cannot reach them. These include the recipient's name and address so you can check them.
Account notices to Administrators, such as low credit balance alerts, failed automatic reload notices and Credit+ reminders
Member invitations and sign-in codes, sent by our sign-in provider
Replies to your support requests

3.3 To Provide Support

We use your messages and order details to answer your requests. Our team is notified of new messages in a private workspace chat, and we use an AI tool to suggest draft replies (see Section 6).

3.4 To Keep the Service Secure and Working

Detecting and preventing fraud, abuse and automated attacks
Finding and fixing errors, and monitoring performance

Product analytics show us which pages and steps work well and where people get stuck. We use them only if you accept analytics (see Section 10).

See Section 12.

3.7 To Meet Legal Obligations

Keeping tax and accounting records, responding to lawful requests, and establishing or defending legal claims.

We do not sell or rent your personal information, and we do not use it for targeted advertising. We do not make decisions about you based solely on automated processing, except that Stripe automatically screens payments for fraud and may decline a payment it considers high-risk. If this happens to you, contact us and a person will review it.

We rely on your consent to collect, use and disclose your personal information. Depending on how sensitive the information is and what you would reasonably expect, consent may be express or implied.

Necessary uses: when you place an order or use an account, you consent to the uses in Sections 3.1 to 3.4 and 3.7, which we need to provide the Service.
Optional uses: analytics (Section 3.5) and marketing emails (Section 3.6) require your express opt-in. Saying no does not affect your use of the Service.
Withdrawing consent: you can withdraw consent at any time, subject to legal or contractual limits. If you withdraw consent for a necessary use, we may not be able to process your orders or keep your account open, and we will explain the consequences.

We may also collect, use or disclose information without consent where the law allows it, for example to investigate fraud or to comply with a court order.

5. Disclosure of Your Information

We share personal information only as described below. We do not sell or rent it.

5.1 Within Your Organization

All Members of an Organization can see its orders, including recipient names and addresses, letter files while they are kept, and who placed each order. They can also see its credit balance and activity, invoices and receipts, and saved cards (brand, last four digits and expiry). Administrators also manage the Organization's Members and their roles.

5.2 Postal Services

Canada Post, and the postal service of the destination country for letters sent abroad, receive your letter in its envelope with the sender and recipient names and addresses.

5.3 Service Providers

We use the service providers below to operate the Service. They may use your information only to provide services to us, and our agreements with them require them to protect it.

Clerk: sign-in, accounts and Organizations. Information: name, email, sign-in details and Organization memberships. Location: United States.
Stripe: payments, saved cards, tax calculation and fraud screening. Information: card details, billing name, email and address, and payment history. Location: United States.
Amazon Web Services (S3): storage of letter files. Information: letter files. Location: United States.
Railway: application servers, database and job queue. Information: account, order and billing records. Location: United States.
Vercel: website hosting, and relaying analytics to PostHog. Information: website requests and IP address. Location: United States.
PostHog: product analytics (with your consent), error tracking, server logs, our support inbox, and records of AI requests. Information: analytics events, error details, server logs, and support messages with your name and email. Location: United States.
Better Stack: server performance monitoring and our service status notice. Information: technical traces, which can include stored values such as names and addresses, and IP address. Location: United States.
Resend: sending our emails and managing our marketing list. Information: email address, name, and email content, including recipient details in order emails. Location: United States.
Zoho Books: accounting, invoices and receipts. Information: name, email, billing address, Organization name, order numbers and amounts. Location: Canada.
Google Maps Platform: address suggestions. Information: the address text you type, IP address and browser details. Location: United States.
Google Workspace: notifying our team of new support messages. Information: your name, your message and a draft reply. Location: United States.
Cloudflare Turnstile: blocking automated abuse on forms. Information: browser and device signals, and IP address. Location: United States.
Anthropic: drafting suggested support replies (see Section 6). Information: support messages and our team's notes, with email addresses, North American phone numbers and Canadian postal codes removed, and basic order status. Location: United States.

5.4 Legal Requirements and Advisers

We may disclose your personal information if required to do so by law or in response to valid requests by public authorities, such as a court order. We may also share it with our professional advisers, such as lawyers and accountants, who must keep it confidential.

5.5 Business Transfers

If Davette is involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you by email or with a prominent notice on our website of any change in ownership or in the uses of your personal information.

6. Artificial Intelligence

We use Claude, an AI model provided by Anthropic, to draft suggested replies to support messages. When you write to us, Claude receives the recent messages in your conversation, our team's internal notes on it, and basic facts about your order, such as its status and delivery option. We automatically remove email addresses, North American phone numbers and Canadian postal codes first, but names, street addresses and other details written in your messages may remain.

A member of our team reviews every draft and decides what to send. The AI never replies to you directly and makes no decisions about you. The requests and drafts are stored in PostHog so we can check their quality. Under its commercial terms, Anthropic does not use this information to train its models.

We never send the content of your letters, your uploaded files, or the recipient details stored with your orders to an AI provider.

7. International Data Transfers

We are based in British Columbia, Canada. Most of our service providers store or process personal information in the United States (see Section 5.3). Zoho Books stores our accounting records in Canada. Letters sent abroad are handled by the postal service of the destination country.

Information stored or processed outside Canada is subject to the laws of that country, and may be accessed by its courts, law enforcement and national security authorities. We use contracts and other measures so that our providers protect your information at a level comparable to the protection it would receive in Canada. If you live in Quebec, this also means your information is communicated outside Quebec.

8. Data Retention

We keep personal information only as long as we need it for the purposes in this policy, then delete or anonymize it:

Letter files: automatically and permanently deleted 30 days after they are uploaded, including files from orders that were never paid. After that, they cannot be viewed or downloaded from the dashboard.
Order, billing and tax records, including recipient names and addresses, invoices, receipts and authorization records: 7 years after the end of the tax year they relate to, for tax and accounting purposes.
Account and Organization details: while the account is open. After it closes, we keep only the records listed above.
Support conversations: 2 years after your last message.
Analytics data: 7 years after it is collected.
Error reports: 7 years after they are collected.
Server logs: 90 days.
Marketing list: until you unsubscribe. After that, we keep your email address on a suppression list so we do not email you again.

Information we use to make a decision about you, such as refusing an order or closing an account, is kept for at least one year after the decision. Deleted information may remain in our providers' backups for a limited time before it is overwritten.

9. Data Security

We use technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption of all connections to our website and services using TLS (HTTPS)
Private, encrypted storage for letter files, with download links that expire after 5 minutes
Card numbers handled only by Stripe, a PCI DSS Level 1 certified provider, and never stored on our servers
Access to customer information limited to authorized members of our team
Separation between Organizations, so Members of one Organization cannot see another Organization's orders
Bot protection and rate limits on order, payment, tracking and contact forms
Automatic deletion of letter files after 30 days

No method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security. If a breach of our safeguards creates a real risk of significant harm to you, we will notify you and the relevant privacy regulators as the law requires.

10. Cookies, Analytics and Similar Technologies

We use the cookies and browser storage needed to run the Service. We use analytics cookies only if you accept them.

10.1 Strictly Necessary

These are needed for the Service to work and are always on:

Clerk: keeps you signed in and secures your session.
Stripe: helps prevent fraud on pages where you can pay.
Cloudflare Turnstile: checks that our forms are used by a person, not a bot.
Our own storage: remembers your analytics choice, your dashboard sidebar preference, and that an order confirmation was already shown.

When you first visit, we ask whether you accept analytics. Until you accept, or if you decline, PostHog only counts page visits and records errors, without storing cookies or identifiers on your device, and cannot recognize you from one day to the next.

If you accept, PostHog stores an identifier in a cookie and in your browser's local storage for up to one year. This lets it link your visits and actions over time, and to your account when you sign in, so we can collect the analytics described in Section 2.3. Session recording is turned off: we do not record your screen or what you type.

You can change your choice at any time using Cookie settings at the bottom of the page, or in your account menu in the dashboard. We do not use advertising cookies, and we do not share analytics with advertisers.

11. Your Privacy Rights

You have the right to:

Access: ask what personal information we hold about you, how we have used it, and to whom we have disclosed it, and receive a copy.
Correction: ask us to correct information that is inaccurate or incomplete. Account users can update most details directly in the dashboard.
Withdraw consent: at any time, as described in Section 4.
Deletion: ask us to delete your information. We will delete what we no longer need, except records the law requires us to keep (see Section 8).
Complain: challenge our compliance with this policy, as described in Sections 15 and 16.

If you live in Quebec, you also have the right to:

Receive the computerized personal information you gave us in a structured, commonly used technological format, or have it sent to another organization
Ask us to stop disseminating your personal information, or to de-index a link to it, where the law allows
Be informed of any decision about you based exclusively on automated processing, and submit your observations to a member of our team who can review it

To make a request, contact our Privacy Officer (see Section 15). We may need to verify your identity first. We respond within 30 days, and will tell you if we need more time as the law allows. Requests are free of charge. If we refuse a request, we will explain why and how you can complain.

To close an Organization account or delete your user profile, contact us. If you received a letter sent through our Service, its sender chose its content and recipients, and we acted on the sender's behalf. You can still contact us about any information we hold about you.

12. Marketing Communications

We send marketing emails only to people who asked for them, in compliance with Canada's Anti-Spam Legislation (CASL).

When you order as a guest, you can tick an optional box, unchecked by default, to receive occasional emails about new features and offers. If you tick it, after your payment we add your name and email address to our mailing list, which is managed by Resend. We also let Resend know when your order is placed and when it is mailed, so our follow-up emails are relevant. We never add anyone who did not tick the box.

12.2 How to Opt Out

You can unsubscribe at any time by:

Clicking the "unsubscribe" link at the bottom of any marketing email
Emailing us at contact@online-post.ca

We process unsubscribe requests promptly, and in any case within 10 business days. Every marketing email identifies Online-Post.ca as the sender and includes our mailing address and contact information.

12.3 Service Emails

Unsubscribing from marketing does not stop the emails we need to send to provide the Service: order confirmations, mailing notices and receipts, account notices such as low-balance alerts, failed automatic reload notices and Credit+ reminders, Member invitations, sign-in codes, and replies to your support requests.

13. Children's Privacy

Our Service is not intended for individuals under the age of 18 or the age of majority in their province or territory of residence. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately, and we will take steps to delete such information.

14. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

Update the "Last Updated" date at the top of this Privacy Policy
Post a notice of the change on our website
Email Organization Administrators and our marketing subscribers about significant changes

If a change involves using your personal information for a new purpose, we will ask for your consent first.

15. Contact Us and Privacy Officer

Our Privacy Officer is responsible for our compliance with this Privacy Policy and with privacy laws. Because Davette is a sole proprietorship, this role is held by its owner. For any question, concern, or request about your personal information, contact:

Email: contact@online-post.ca, with "Privacy" in the subject line
Mail: Privacy Officer, Davette (Online-Post.ca), 905-828 Howe St, Vancouver, BC, V6Z 2X2

We will respond to your inquiry within 30 days.

16. Complaints

If you are not satisfied with our response to your privacy concerns, you have the right to file a complaint with the privacy regulator that applies to you:

Office of the Privacy Commissioner of Canada: www.priv.gc.ca
Office of the Information and Privacy Commissioner for British Columbia: www.oipc.bc.ca
Commission d'accès à l'information du Québec, for Quebec residents: www.cai.gouv.qc.ca