Privacy Policy

DirectMailAmerica.com is a print-and-mail software service operated by Rainmaker LLC, a Connecticut limited liability company doing business as DirectMailAmerica.com. Office and mailing address:

Privacy and consumer requests: [email protected]. General support: [email protected].

This Policy applies to personal information we process as a business when you visit the website, create an account, send mail, use the API or MCP tools, or communicate with us. If we process information solely as a service provider to a business customer, that customer’s instructions and privacy notice also apply to the data they submit (for example, their recipient lists).

We collect the following categories, depending on how you use the Service:

Mailing orders include a private security record with the account and workspace at order time, request timestamps, available IP and proxy information, browser or agent metadata, authentication record references, approval events, and a fingerprint of the print document. Orders created from email also record the source email and mailing-rule details. Authorized administrators can review and export this information for support, abuse investigations, and lawful requests described below. These security records are not sent to advertising analytics.

We do not require government ID in the ordinary course. If we ever collect it for verification or legal compliance, we will use it only for that purpose.

We use a first-party referral cookie for up to 30 days to remember a recognized directory or platform that referred you. When you create an account, we save that source with your workspace and compare it with confirmed payments to understand which listings bring customers. This record contains a fixed source label, referral method and timestamp, not the referring page’s full URL. It is used in our private business reports and is not shared with directories.

We use cookies and similar technologies that are necessary to operate the Service, such as session cookies that keep you signed in and preference cookies that remember theme or similar settings. When a measurement ID is configured, we use Google Analytics 4 (GA4) to measure page views and conversion events (for example sign-in, send, and checkout), as well as API/MCP tool outcomes and email-to-mail setup, preparation and notification status. Server events use opaque analytics identifiers; they do not include email addresses, image prompts, tool arguments or responses, or private order-security evidence. GA4 events do not include letter body text, full postal addresses, raw API keys, or other contents of your mailings. Google may set first-party cookies or similar identifiers as described in Google’s documentation. We may also use other performance, session-replay or support tools, and advertising or measurement pixels (for example Firebase or other cloud telemetry). Those tools may set cookies, read device identifiers, or collect usage data.

You can control cookies through your browser settings, including blocking or deleting cookies. Blocking strictly necessary cookies may prevent sign-in or other features from working. Where a service offers an opt-out or consent tool, we will honor it as implemented.

Do Not Track. Some browsers send a “Do Not Track” (DNT) signal. There is no consistent industry standard for responding to DNT. The Service does not currently respond to DNT signals. California residents may use the request methods in Section 16 to exercise CCPA/CPRA rights, including opt-out of sale or sharing if those activities apply.

We use personal information to:

• provide, operate, and maintain the Service, including accounts, APIs, and job status;
• compose, store, transmit, print, and mail documents through third-party printing and mailing services;
• validate or normalize addresses and communicate about jobs;
• process payments, credits, invoices, and fraud screening;
• secure the Service, debug errors, and prevent abuse;
• when enabled, assess User Content and related activity for prohibited content, fraud, abuse, and potential legal concerns using automated or AI review;
• analyze usage to improve reliability and product design;
• communicate support, product, and service messages;
• comply with law, enforce our Terms, and respond to legal process; and
• establish, exercise, or defend legal claims.

In demo mode, documents typically remain on our systems or local store and are not sent to a printer. In live mode, contents needed to fulfill a mailing are transmitted to the print-and-mail service. If content review is enabled, a submission may be processed by a content-safety or AI service even if it is never printed or mailed.

Automated and AI content review

When enabled, review may analyze submitted text, documents, images, text extracted from images, rendered mailing pages, and relevant account and order activity. We may provide the content and context needed for that assessment to AI and specialized content-safety services. User Content may itself contain sender, recipient, or other personal information, including sensitive information. Review results may be used to approve, hold, reject, or reassess an order, investigate abuse, or restrict an account under our Terms of Use.

Our administrative tools expose review metadata without flagged content, and routine content decisions use AI. Third-party safety processes and legally required disclosures may involve human access outside those tools. A provider may retain or review flagged material under its applicable safety and legal requirements, including suspected child sexual abuse material. We do not promise zero retention or immediate deletion by every provider.

Review records are used for service operation, safety, support, and legal compliance, not advertising analytics. Before enabling a materially different use of previously collected content, we will provide any additional notice and obtain any consent required by law. For questions or to request reconsideration, contact [email protected] with an order reference; do not attach suspected illegal imagery or resend prohibited content.

We share personal information with:

• Printing and mailing services and, through them, USPS or other carriers, so they can print and deliver your mail;
• Payment providers and facilitators (card processors, x402 facilitators, blockchain networks);
• Cloud hosting, authentication, and infrastructure providers, including Firebase / Google Cloud when those services are configured;
• Analytics, security, and operations services that process data on our behalf;
• AI and content-safety services, if enabled, to assess User Content and relevant account and order information for the purposes described in Section 5;
• Professional advisers (legal, accounting, insurance) under confidentiality obligations; and
• A buyer or successor if we are involved in a merger, acquisition, financing, or sale of assets, subject to this Policy or a successor notice.

We also disclose information to courts, law enforcement, and other authorities when legally required or as described in Section 7. We do not sell your documents as a product mailing list.

We cooperate with all valid, lawful requests from courts, law enforcement, regulators, and other competent authorities, and comply with legally binding process. We review each request’s authenticity, legal basis, jurisdiction, and scope. We disclose personal information, account and billing data, mailing documents and artwork, addresses, email-source information, IP and request metadata, available content-review results, and related order records only as required or permitted by applicable law. Different records may require different legal process, such as a valid subpoena, court order, or warrant; a request alone does not authorize disclosure that the law prohibits.

We preserve relevant records when required by a valid preservation request, legal hold, or other legal obligation, and may retain records for abuse investigations as permitted by law. We will report activity that we reasonably suspect is unlawful to appropriate law enforcement, regulators, or legally designated reporting bodies to the extent disclosure is permitted by applicable law. We will make all reports required by law, including reports of apparent child sexual exploitation when the applicable reporting requirements are met. A policy violation or an AI flag alone is not a legal finding. Applicable reporting requirements may require action without a criminal conviction or a completed internal review.

Where permitted by law, we may disclose relevant information in a qualifying emergency involving danger of death or serious physical injury, to protect the security of the Service, or to establish, exercise, or defend legal claims. Lawful cybersecurity requests, including those associated with CISA, are subject to the same verification and disclosure limits.

We may disclose without prior notice when notice is legally prohibited, impracticable, or would risk interfering with an investigation. Where legally permitted and consistent with the request, we may notify the affected customer. We can provide only records in our possession or control and do not guarantee that every record exists or can be recovered.

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, “CCPA/CPRA”) provides additional rights. This section is designed to meet those disclosure requirements in plain language. In the prior 12 months we have collected the categories listed in Section 3 as applicable to the features used. Categories expressly described as future or conditional processing do not mean those records have already been collected. We collect information from you, your devices, authentication and payment providers, and (for recipient data) from the files you upload.

California residents may request to:

• Know / access the categories and specific pieces of personal information we have collected, the categories of sources, our business or commercial purposes, and the categories of third parties with whom we disclose it;
• Delete personal information we collected from you, subject to legal exceptions (for example, completing a transaction, security, or legal compliance);
• Correct inaccurate personal information we maintain;
• Opt out of sale or sharing of personal information, as those terms are defined by CCPA/CPRA (see Section 9);
• Limit use of sensitive personal information to purposes permitted by CPRA if we use it beyond those purposes; and
• Not be discriminated against for exercising these rights.

We will verify requests using the email on your account and additional information reasonably necessary to confirm your identity. We will respond within the time CCPA/CPRA requires, generally 45 days, with one extension when reasonably necessary.

We do not sell personal information for money. We do not currently share personal information for cross-context behavioral advertising as those terms are defined by CCPA/CPRA. If we begin to sell personal information or to share it for cross-context behavioral advertising, we will update this Policy and provide a “Do Not Sell or Share My Personal Information” method.

Google Analytics 4 cookies are used for first-party product analytics, not for running cross-context ads. Some interpretations of California law could treat analytics cookies as “sharing.” You may use browser controls and the request methods in Section 16 to opt out. We do not have actual knowledge that we sell or share the personal information of consumers under 16.

Depending on what you upload, User Content or addresses could include sensitive information (for example, contents of a legal or medical letter). We use that information to provide the Service you requested — transmitting it to third-party printing and mailing services so the piece can be produced and delivered — and for security, fraud prevention, and legal compliance. We do not use sensitive personal information to infer characteristics for cross-context advertising.

Account log-in credentials are processed to authenticate you. Payment card data, when collected, is handled by payment processors; we receive tokens or limited metadata, not full PAN/CVV.

We retain personal information for as long as needed to provide the Service, maintain your account, and fulfill the purposes in this Policy, then for a longer period if required or permitted by law (tax, accounting, dispute resolution, security, and legal holds).

• Account and billing records: for the life of the account and a commercially reasonable period afterward.
• Mailing jobs, addresses, and documents: as needed to fulfill, track, support, and evidence a mailing, then deletion or archival according to our then-current retention schedule.
• Order security records: retained with the corresponding order for support, abuse prevention, and evidence of the mailing, subject to applicable deletion requests and legal holds.
• Content-review records and associated content, if review is enabled: as needed for assessment, reconsideration, support, abuse prevention, and applicable reporting or preservation duties, subject to our retention schedule and applicable deletion rights.
• Security and server logs: for a limited operational period unless needed for an investigation.
• Demo workspaces: may be reset or deleted as we operate the demo environment.

Rejection, cancellation, or a deletion request does not require destruction of records we must preserve under applicable law, a valid preservation request, or a legal hold. Access to preserved material is limited to authorized purposes. Information disclosed to a safety service or an authority may be subject to that recipient's applicable legal and retention requirements.

When we delete information, residual copies may remain in backups for a limited time until those backups cycle.

We use administrative, technical, and organizational measures designed to protect personal information, including access controls, hashed API keys, and a practice of not logging fulfillment credentials, wallet private keys, or payment-signature secrets. No method of transmission or storage is completely secure. We cannot guarantee absolute security.

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. We do not knowingly sell or share personal information of consumers under 16. If you believe a child has provided us information, contact [email protected] and we will take appropriate steps to delete it, subject to applicable reporting and preservation obligations.

The Service is operated from the United States. If you access it from another country, you understand that your information will be processed in the United States, where privacy laws may differ from those in your jurisdiction. By using the Service, you acknowledge that transfer. We do not represent that the Service complies with every non-U.S. privacy regime (including GDPR) unless we have agreed in a separate written addendum.

• Update profile and organization fields in account settings.
• Revoke API keys from the developers page.
• Control cookies in your browser.
• Opt out of non-essential promotional email using the unsubscribe link or by writing us. Transactional mail about jobs, security, and billing may still be sent.
• California residents may exercise the rights in Sections 8–10 using Section 16.

Email [email protected] with the subject line “Privacy Request,” or write to:

Tell us which right you want to exercise and the email on the account. We may need additional information to verify you. If we deny a request, we will explain the reason and how to appeal by replying to our decision.

You may designate an authorized agent to submit a CCPA/CPRA request. The agent must provide written authorization signed by you, and we may still require you to verify your identity directly and confirm that you authorized the agent, unless the agent presents a valid power of attorney under California law.

We will not discriminate against you for exercising CCPA/CPRA rights, including by denying goods or services, charging a different price, or providing a different level of quality, except as permitted by law (for example, a reasonably related difference if you ask us to delete data that is required to provide a feature).

We may update this Privacy Policy from time to time. The effective date at the top will change when we do. Material changes will be posted on this page and, where appropriate, communicated by email or in-product notice. This Policy is effective November 5, 2026.

Privacy questions and consumer requests: