Privacy policy

When you book, we collect:

• Your name, email address, and mobile number, and whether you agreed to text messages.
• The street address of the mailbox and its map location.
• Your HOA name, gate or community code, and any notes you add, if you give them.
• A photo of your mailbox, if you upload one, and the before-and-after photos the crew takes.
• Which services you chose, your preferred date, and what you paid. Stripe keeps the card details; we keep a payment reference.
• If you ask us to come back next year, Stripe keeps your card on file for that one charge. We never see or store the card number, and cancelling the visit ends our use of it.

When you use the site, we also record:

• The code printed on a postcard you scanned, and any campaign tags in the link, so we know which mailing brought you here.
• For each scan of a printed QR code: the time, a one-way hash of your network address (we do not keep the address itself), your browser type, and the rough city and region Cloudflare reports. This tells us how a mailing performed, not who you are.
• Which steps of the booking flow were reached, tied to a random session id, so we can see where people give up.

If you leave your email to hear when booking opens or to ask us to come to your neighborhood, we keep that email, the neighborhood, and the printed code if you scanned one.

Once you have booked and paid, we email you a link to confirm your email and open your account, and the account exists only once you confirm. There is no password: you sign in with a link we email you, so we never hold a password of yours at all. The account holds your sign-in email and any earlier sign-in emails you have confirmed, when you last signed in, and, for each device that is signed in, a short label such as “Safari on iPhone” so you can recognize it. We never store your IP address with your account.

• To do the job: route the crew and get through the gate.
• To take your payment and issue refunds.
• To send your confirmation, the day-before notice, and, with your text consent, the same notices by text.
• To schedule the crew’s route and, when a job is billed by invoice instead of paid online, to send you that invoice.
• To decide whether your address qualifies for the neighborhood price.
• To measure which mailings and neighborhoods lead to bookings.
• We plan to email you once, about eleven months after your visit, to ask whether you want a refresh. We don’t send that email yet; when we do, you will be able to opt out of it.

We use before-and-after photos of your mailbox in marketing only if you checked that box at booking. Email us to withdraw consent at any time.

If you opt in, we text you about a booking you made: a confirmation, a reminder the day before your visit, and a notice if your date changes. Message frequency varies. Message and data rates may apply. Consent to receive text messages is not a condition of purchase, and you can book without ever opting in.

Reply STOP to any message to stop them, or email us at hello@mailboxspa.com. Reply HELP for help. Our full messaging terms are in our SMS terms.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are excluded from every category of sharing described below.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.

These services process your information on our behalf. Each one sees only what it needs for its job.

• Stripe takes your payment. Your card details go to Stripe directly and never touch our servers.
• Resend sends our email (confirmation, day-before notice, booking links).
• Twilio sends our text messages, only if you opted in.
• Railway hosts the site and runs its scheduled jobs.
• Supabase hosts our database, where bookings and customer records live. It runs in the United States.
• Cloudflare carries every request to this site, so it sees the network address of each visit and the pages you load, and it shields us from attacks. It also stores the photos and serves them from photos.mailboxspa.com.
• Google Places turns the address you type into a verified street address and map location. Our server makes that lookup, so Google never sees your browser or your network address.
• Meta runs our Facebook and Instagram ads and measures them. What it receives is set out under Advertising below.

We do not sell your information, and we do not share it with data brokers. Meta is the one advertising company we work with.

We advertise on Facebook and Instagram, which Meta runs. To see whether an ad worked, most of our public pages and the payment step load a small piece of code from Meta. On those pages it sends Meta the address of the page, including any campaign tags in the link, the page you came from, your network address, and your browser and device type. It also tells Meta when you view one of our neighborhood pages, when you press Start booking, with the price shown but never the address you typed, and when you press Pay, with the amount.

It does not run on the booking steps where you give your name, email address and mobile number, on the confirmation page, on sign-in, on your account, or on the booking and sign-in links we email or text you. We never give Meta your name, phone number or street address, and your email address only in the scrambled form described next.

When your payment goes through, our server tells Meta that a booking was made and what it cost. With it we send a scrambled copy (a one-way hash) of your email address and of your ZIP code, your network address and browser type, and Meta’s cookie ids described under Cookies, so Meta can match the booking to a Facebook or Instagram account with the same email address and to an ad you saw. We never send your phone number, in any form.

Meta uses what it receives to measure our ads and to choose who sees them, and its own privacy policy covers what else it does with it. You can stop the code with your browser’s tracking protection or an ad blocker, and you can limit ads based on other websites in your Meta ad preferences.

The site sets a few cookies of its own, and Meta sets one for our advertising. One remembers the printed code you scanned for 60 days so your booking is credited to that mailing. One points to your booking in progress so you can come back to it later. It holds a random code, not your details. One keeps you signed in for a day after you open a “find my booking” link. If you create an account, one more keeps you signed in to it: it ends after 30 days without a visit, and after 90 days in any case, or when you sign out. For a day after you ask us to send the account link again from the confirmation page, another short-lived cookie lets that link open your account in one tap on that same browser. The owner’s admin sign-in uses one more.

Meta’s cookie, called _fbp, holds a random number so Meta can tell a return visit from a new one. It is set only on the pages where Meta’s code runs and lasts 90 days. If you arrive from one of our ads, a second one, _fbc, records which ad it was, for the same 90 days.

• Booking and customer records: for as long as we operate, so we can honor the HOA fix promise and handle refunds.
• Booking-in-progress data (what you enter before paying): kept so you can pick up where you left off, including if you leave the payment page without paying, and deleted once your payment goes through, after seven days without activity, or after 30 days in any case.
• Accounts: until you delete yours. Deleting it removes the sign-in email and every signed-in device. Your bookings, receipts and any return visit are kept as business records, and you can still reach them with an emailed link from Find my booking.
• QR scan records: kept in hashed form as mailing statistics; they cannot be traced back to you.
• Emails left to hear about booking: until you ask us to remove them or booking in that neighborhood has opened and closed.
• Photos: for as long as the booking record, or until you withdraw marketing consent for any marketing copies.

The site runs over HTTPS. Card details never reach us. Booking links and sign-in links are signed and expire. We keep street addresses and contact details out of web addresses and logs. Access to the database is limited to the owner. Accounts have no password to steal, sign-in links work once and expire in 15 minutes, and asking for them is slowed down after repeated tries without ever locking you out.

Email us to see what we hold about you, to correct it, or to have it deleted. We will delete everything except what we must keep for tax and payment records. To stop text messages, reply STOP. To stop marketing use of your photos, email us.

Mailbox Spa, LLC
hello@mailboxspa.com

See also our terms of service.