unopost
Send a letter

Privacy policy

Last updated: 18 September 2026

1. Introduction

This Privacy Policy explains how unopost ("we", "us" or "our") collects, uses, discloses and protects personal information when you use unopost.com.au and our online postal mail service, including the x402 API at unopost.com.au/x402 ("the Service"). The Service is operated by AWS, CYY & Co. Pty Ltd (ACN 686 116 245) as Trustee for Mumu, Lulu & Co. (ABN 54 837 123 965), from Melbourne, Australia.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where the EU General Data Protection Regulation (GDPR) or UK GDPR applies to you, we also handle your personal information in accordance with those laws (see Section 13).

This Privacy Policy forms part of our Terms of Service. By using the Service, you acknowledge that you have read and understood this Privacy Policy.

2. Information we collect

Information you provide when you send a Letter:

  • The document you upload, and anything contained in it, which may include personal information about you, the recipient or other people
  • The file name of your document
  • The recipient's name and postal address
  • Your return address
  • Your email address
  • The Service Level and options you choose

Information collected automatically:

  • Your IP address, used to protect the Service from abuse and to limit use of the support chat. We also use it to estimate roughly where you are, only to tell whether you are in regional Australia so the home page can show wording suited to you. We do not store that estimate
  • Your browser's timezone, read on your device to show wording suited to visitors from overseas. It is not sent to us
  • Technical information such as your browser type and the pages you request, recorded in our server and security logs
  • How you use our website, such as the pages you visit, how long you stay, the site that referred you, and your device, browser and approximate location, collected by Google Analytics (see Section 10). Google Analytics does not see your documents, addresses, email address or payment details

Information you provide when you contact us:

  • Your email address and the contents of any email you send to support@unopost.com.au
  • Any messages you type into the support chat on our website

Information we collect when you use our x402 API:

  • The wallet address you pay from, and the payment authorisation you sign
  • The record of the payment, and of any refund, on the Base blockchain, including the transaction hash, the amount and the time
  • The IP address the API requests come from, used to protect the Service from abuse

Letters ordered through the API have no email address: we do not ask for one, and we do not send email about them.

Payment information: payments are processed by Square AU Pty Ltd. Square collects your card details and billing information directly. We receive only a payment confirmation, the amount paid and a payment reference. We never see or store your full card number. Letters ordered through the x402 API are paid in USDC on the Base network, verified and settled through Coinbase. Payments and refunds are recorded on a public blockchain, which is outside our control: once a record is on the blockchain, we cannot change it, delete it or make it private.

3. Information we do not collect

  • We do not require you to create an account or provide a password
  • We do not require government-issued identification
  • We do not store your full card details
  • We do not use advertising cookies, and we do not use third-party advertising or social media tracking tools

4. How we use your information

We use personal information only for the following purposes:

  • To convert, preview, print and post your Letter
  • To calculate the price of your Letter and process your payment
  • To send you transactional emails, including your receipt, tracking number, delivery updates, problem notifications and refund notices
  • To issue refunds and resolve billing disputes and chargebacks
  • To respond to your support requests
  • To understand how our website is used and improve it, using Google Analytics
  • To detect, prevent and investigate fraud, abuse, security incidents and breaches of our Terms of Service
  • To comply with our legal obligations, including tax and record-keeping obligations

We do not sell, rent or trade your personal information. We do not use your documents or addresses for marketing, profiling or to train artificial intelligence models.

5. Recipients' information

When you send a Letter, you give us the name and address of the recipient, and your document may contain information about them. You must only provide information about another person where you are lawfully entitled to do so.

We use recipients' information only to print, address, post and track the Letter, and to handle any support request or dispute about it. We do not contact recipients, and we do not add them to any list.

6. Your documents

We take the confidentiality of your documents seriously. The following practices apply:

  • Documents are encrypted in transit using TLS, and encrypted at rest by our cloud infrastructure provider
  • Documents are stored temporarily in Amazon Web Services' Sydney region solely for the purpose of conversion, printing and posting
  • Documents are processed automatically by our systems. No one at unopost reads your document unless required by law, legal process, or to resolve a problem with your Letter, a billing dispute or a support request you have initiated
  • Your document and the print-ready copy of your Letter are permanently deleted, including every stored version, once your Letter is despatched, which means once it is lodged with Australia Post. We do not keep a copy while it is in the post
  • Documents for Letters that are not paid for or cannot be posted are permanently deleted after 14 days

Once printed, a Letter is a physical item in the care of our print and mail provider and then Australia Post. We cannot control who opens or reads a Letter after it has been delivered.

7. Who we share your information with

We share personal information only with the following service providers, and only to the extent needed to provide the Service:

  • Amazon Web Services Australia Pty Ltd: hosting, storage, databases, transactional email (Amazon SES) and content delivery, primarily in the Sydney region
  • Our print and mail provider: your document, the recipient's name and address and your return address, to print, envelope and lodge your Letter
  • Australia Post: the recipient's name and address and your return address, as they appear on the envelope, to deliver and track your Letter
  • Square AU Pty Ltd: payment processing, refunds and fraud prevention
  • Google (Google LLC): website analytics, through Google Analytics
  • Amazon Bedrock (Anthropic's Claude models provided through Amazon Web Services): to generate answers to messages you type into the support chat
  • Coinbase (Coinbase Technologies, Inc. and its Developer Platform): for Letters paid for through our x402 API, your wallet address and signed payment, to verify and settle the payment and to send any refund

Our service providers are bound by contractual obligations of confidentiality and may use your information only to provide services to us.

We may also disclose personal information where required or authorised by law, including in response to a court order, subpoena or lawful request from a government or law enforcement agency, or where we reasonably believe disclosure is necessary to prevent fraud or a serious threat to a person's life, health or safety.

If our business is sold, merged or restructured, personal information may be transferred to the successor entity, subject to this Privacy Policy.

8. Overseas disclosure

We store documents and letter records in Australia. Some of our service providers, including Square and Amazon Web Services, are part of groups headquartered in the United States, and may process or access limited personal information outside Australia, including in the United States, for purposes such as payment processing, fraud prevention, email delivery, support chat responses and technical support. Google, which provides Google Analytics, may process website usage information in the United States and other countries. We take reasonable steps to ensure these providers handle personal information consistently with the Australian Privacy Principles.

Coinbase, which verifies and settles x402 payments, is based in the United States. A payment or refund made through the API is recorded on the Base blockchain, which is public and is copied worldwide by the computers that run the network. That is inherent in how the network works and cannot be limited to Australia.

Where the GDPR or UK GDPR applies to you, sending a Letter involves transferring your personal information to Australia, which is not covered by an adequacy decision of the European Commission or the UK government. We make that transfer because it is necessary to perform the contract you have asked us to perform, namely to print and post your Letter, and we protect the information as described in this Privacy Policy.

9. Data retention

We keep personal information only for as long as we need it for the purposes described in this Privacy Policy:

  • Uploaded documents and print-ready Letters: deleted once the Letter is despatched, or after 14 days as described in Section 6
  • Letter records (the recipient's name and address, your return address and email address, the file name, page count, price, payment reference, tracking number and status): kept for receipts, support, refunds, billing disputes and for as long as Australian tax and record-keeping law requires, generally five years from the date of the transaction, and then deleted or de-identified
  • Support chat: the conversation is sent to Amazon Bedrock to generate a reply. We keep a copy of each message and reply, with a one-way hash of your IP address, for 90 days to review and improve the answers, and then delete it. The hash is also kept for no more than 2 hours to apply usage limits
  • Support emails: kept for as long as needed to resolve your request and any related dispute
  • Server and security logs: kept for as long as needed for security, troubleshooting and fraud prevention. We design our logs not to record the contents of your documents, your email address or the recipient's name and address
  • Payments through the x402 API: the wallet address and payment reference are kept with the Letter record. The blockchain record of the payment itself is public and permanent, and we cannot delete it

10. Information stored in your browser

Our website uses Google Analytics, which sets cookies (such as _ga) to tell visits apart and measure how the website is used. You can block these cookies in your browser settings, or opt out of Google Analytics on every website with Google's opt-out browser add-on at tools.google.com/dlpage/gaoptout. The Service works the same without them.

To make the Service easier to use, our website also stores some information in your browser's local storage, on your device only:

  • The details you have entered for a Letter you haven't paid for yet (the recipient's address, your return address, email address, Service Level and options), so they are still there if you leave and come back. These are removed once the Letter is paid for
  • A list of Letters sent from that browser in the last 14 days (the file name, recipient's name, suburb, state, postcode and status), so you can check their progress
  • Your light or dark theme preference

This information is not sent to us except when you submit a Letter. You can remove it at any time by clearing your browser's site data for unopost.com.au. If you use a shared or public device, we recommend clearing your browser's site data after use.

11. Security

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These include encryption in transit and at rest, HTTPS-only access to our website and storage, short-lived signed upload links, access controls that limit our systems and staff to the information they need, and automatic deletion of documents.

No method of transmission or storage is completely secure. If we become aware of an eligible data breach, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

12. Access and correction

You may request access to the personal information we hold about you, or ask us to correct it, by emailing support@unopost.com.au. To protect your privacy, we may ask you to verify your identity, for example by confirming the email address and reference of a Letter.

We will respond within 30 days. We may decline a request where permitted by law, and if we do, we will explain why. Because documents are deleted automatically, we may no longer hold a copy of a document you uploaded. Once a Letter has been posted, its address can no longer be changed. For a Letter ordered through the API, we may ask you to prove that you control the wallet that paid for it, and we cannot correct or delete a payment recorded on a public blockchain.

13. Rights for EU, EEA and UK residents

If the GDPR or UK GDPR applies to you, AWS, CYY & Co. Pty Ltd is the data controller. We process your personal information on the following legal bases: performance of a contract (to print and post your Letter and process your payment); legitimate interests (to secure the Service, prevent fraud and abuse, and resolve disputes); and compliance with legal obligations (such as tax and record-keeping).

You have the right to request access to, rectification, erasure or restriction of your personal information, to object to its processing, and to data portability. To exercise these rights, email support@unopost.com.au with the subject line "GDPR Data Request". We will respond within 30 days. Erasure does not extend to a record on a public blockchain, which we cannot change or delete, or to information we are required by law to keep. You also have the right to lodge a complaint with your local data protection authority.

14. Marketing

We do not send marketing emails. We send only transactional emails about Letters you have sent and replies to support requests you have made.

15. Children

The Service is not directed to individuals under 18 years of age, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date at the top of this page and, for material changes, post a summary of changes on our website. Your continued use of the Service after an update constitutes acceptance of the revised Privacy Policy.

17. Contact and complaints

If you have any questions about this Privacy Policy, or wish to make a complaint about how we have handled your personal information, please contact us at:

Email: support@unopost.com.au. Location: Melbourne, Victoria, Australia.

We will acknowledge your complaint within 1 Business Day and aim to resolve it within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.