Legal
Privacy Notice
Last updated 24 July 2026
Who controls your data
Pixel Goblin Ltd (company number 17201045), trading as PostOwl, is the controller. Our registered office is 12 Gloucester Drive, London, United Kingdom, N4 2LN. Privacy enquiries can be sent to hello@postowl.org.
What we collect
We process your email address, recipient name and postal address, uploaded PDF, order and service choices, price, provider references, tracking events, support messages and limited technical records needed to operate and secure the site. Stripe gives us a payment status and transaction reference, not your full card number. A private tracking code is generated for each letter; anyone who has that code can see its limited status view, so do not share it publicly.
Why we use it
We use order data to take payment, fulfil the contract, send receipts and status messages, support cancellations and refunds, prevent abuse and keep accounting and legal records. These uses rely on performance of our contract, compliance with legal obligations and our legitimate interests in operating and securing the service. Where the law requires consent, we ask for it separately.
Who receives it
We disclose only what is needed to service providers involved in the order: Stripe for payment, our print-and-post providers (currently Pingen and Intelliprint) and their postal partners, Amazon SES for transactional email, and Cloudflare for hosting and object storage. We also use self-hosted Plausible for aggregate, cookie-free site measurement. Information may be disclosed to professional advisers, regulators or authorities where legally required. Providers may process data outside the UK; where required, we rely on recognised adequacy arrangements or contractual safeguards.
How long we keep it
The uploaded PDF is deleted from PostOwl storage after successful dispatch. If production fails, it may be kept while the problem is investigated or retried, then deleted. Order, payment, refund and support records are kept only as long as reasonably needed for customer service, fraud prevention, disputes, contracts, tax and accounting—generally no longer than six years where those obligations apply. Print, payment, hosting and email providers retain their own service records under their privacy and retention terms.
Your rights
Depending on the circumstances, you can ask for access, correction, deletion, restriction, portability or object to processing. You can complain to the UK Information Commissioner’s Office at ico.org.uk. Contact us first if you would like us to investigate. We may need to verify your identity and some records must be retained where the law requires it.
Our use of browser storage is explained in the Cookie Notice.