Privacy policy | Unopost

1. Introduction

This Privacy Policy explains how Unopost ("we", "us" or "our") collects, uses, discloses and protects personal information when you use unopost.com.au and our online postal mail service, including the business portal, the Business API and the x402 API at https://unopost.com.au/x402 ("the Service"). The Service is operated by AWS, CYY & Co. Pty Ltd (ACN 686 116 245) as Trustee for Mumu, Lulu & Co. (ABN 54 837 123 965), from Melbourne, Australia.

We handle personal information in accordance with the Privacy Act 1988 (Cth) (https://www.legislation.gov.au/C2004A03712/latest) and the Australian Privacy Principles. Section 13 explains the rights you may have if the EU General Data Protection Regulation (GDPR) or UK GDPR applies to you.

This Privacy Policy is a notice explaining how we handle personal information. It does not form part of our Terms of Service (https://unopost.com.au/terms) or any other contract with you.

2. Information we collect

Information you provide when you send a Letter:

The document you upload, and anything contained in it, which may include personal information about you, the recipient or other people
The file name of your document
The recipient's name and postal address and, for a Letter to China, the recipient's mobile telephone number, which China Post requires for delivery
Your name and return address
Your email address
The Service Level and options you choose
When we post your Letter, a photo of its addressed envelope, which shows the recipient's name and address, any telephone number written on it and the tracking number. Our staff take it to record the tracking number and as a record of how the Letter was addressed. We may email a copy of it to you with the tracking number. It records the date and time it was taken, if the camera recorded them, but not where it was taken

Information collected automatically:

Your IP address, used to protect the Service from abuse and to limit use of the support chat. We also use it to estimate roughly where you are, to tell whether you are in regional Australia so the home page can show wording suited to you. When you start a Letter, we also use it to estimate the timezone you are in, as described below. We do not store either estimate
The address you type into the address search on our website, sent as you type it to Amazon Location Service to suggest matching addresses in Australia or, for an address outside Australia, in the country you have chosen, together with that country's code. We do not keep what you type or the suggestions returned. Amazon Location Service uses them to return suggestions, as described in Section 8
Your browser's timezone, read on your device to show wording suited to visitors from overseas and an estimate of prices in your local currency and, where it indicates that you are outside Australia, to select the corresponding country in the return address, which you may change. When you start a Letter, the timezone is sent to us and kept with the Letter, to show times in our emails to you in your local time and to note, by comparing it with the timezone estimated from your IP address and with your browser type, whether the Letter was likely started by an AI assistant or other automated software. That note is for our records only and does not change how we handle your Letter. Our servers obtain the exchange rates for that estimate from a third-party rates provider, and send it no information about you. When you start a Letter, the language you are reading our website in and your browser's language setting are also sent to us and kept with the Letter, to understand which languages our customers use. Whether our website was shown in light or dark mode is kept with the Letter for the same purpose
Technical information such as your browser type and the pages you request, recorded in our server and security logs
How you use our website, such as the pages you visit, how long you stay, the site that referred you, and your device, browser and approximate location, collected by Google Analytics (see Section 10). Google Analytics does not see your documents, addresses, email address or payment details. When you pay for a Letter, Google Analytics is told that a Letter was paid for, with its price and postage service, but not who paid or how. Google Analytics is also told which steps of posting a Letter you reach, such as adding a document or completing an address, and when a business enquiry or sign-up request is sent, but not what you entered
How you found us, recorded in your browser when you arrive (see Section 10) and kept with your Letter or business account application when you submit it: the campaign tags and any advertising click identifier in the link you followed, the name of the website that referred you (not the full address of the page), the page you first landed on and when. We use it to understand which advertising and other channels bring customers to us

Information you provide when you contact us:

Your email address and the contents of any email you send to support@unopost.com.au
Any messages you type into the support chat on our website
Your name, email address, business name, ABN, industry, how many letters you send and what you need, if you use the enquiry form on our business page
Your ABN, name, role, email address, phone number, the email address of the account's owner and the email address for its billing, if you give us either, how many letters you send and anything else you tell us, if you apply for a business account using the application form on our website, together with the business name and other details that the Australian Business Register publishes for that ABN, or the business name you give us if the Australian Business Register cannot be reached

Information you provide when you open a business account:

Your business name, ABN, contact name, email address and billing details
The email address you sign in to your business account with, the one-time codes we email you to sign in, and a record of when you sign in
If you set up an authenticator app for your business account, the secret key it shares with us, which we use only to check its codes when you sign in, and a record of when it was set up or reset
The email address of each team member you invite to your business account, the name they give when they accept the invitation, their notification settings, and a record of when they sign in
Any profile photo you or a team member upload to your business account, instead of choosing one of our default pictures
The return address, printing defaults, approval setting and billing email address set for your business account, and which team members are its administrators
The documents you and your team members store in your business account, with each document's name, including any new name a team member gives it, size, who stored it and when
The Letters you and your team members send from your business account: the documents and list of recipients uploaded for them, each recipient's name and address, and which team member sent them and when, any return address given for a particular send and, where a send waits for approval, which team member approved, rejected or withdrew it and when
When an owner or administrator accepts our Business Agreement: their name, position and email address, the date and time, their IP address and browser, and your business's name, ABN and capacity (for example, company or trustee of a named trust)
The amount of Business Credit you have purchased and used, and, for each purchase, the amount, the date, the team member who made it or that it was an automatic top-up, and the brand and last four digits of the card used
If you save a card to your business account: the card's brand, last four digits and expiry date, the references Square gives us for the card and for your business as its customer, and your automatic top-up settings. Square stores the card itself
The name of each API key your administrators or developers issue, who issued it and when, the version of the Business API Terms they accepted in issuing it, and whether it is turned on. We keep only a one-way digest of each key, never the key itself
A record of the use of each API key, which your owners, administrators and developers can see in the business portal: when it was last used; for each request made with it, including a request we refuse, the date and time, the request made, its result, and the IP address and software (user agent) it came from; each system (IP address and user agent) that has used it, when first and last, and how many times; and when it was issued, turned off or turned on, and by whom, with their IP address and browser. We use this record to show your business how its keys are used, and to protect the Service and your Business Credit from misuse
For each Letter sent through the Business API: which API key created it, any reference your software gives it, the IP address and country the request came from, the Business Credit used for it, and any Business Credit restored for it. We keep a Letter's details for the same periods as other Letters
For each test Letter made in the Business API's sandbox, which is never printed or posted: the same details as for a Letter sent through the Business API, and the document uploaded for it. We delete a test Letter's details 30 days after it is created and its document within 14 days. Team members your administrators make developers can issue API keys, including the sandbox's, turn them off and on, and see the record of their use
If your business sets a webhook URL for the Business API, for each of its production and sandbox environments: the URL, the secret we use to sign the events we send to it, who set it and when, and when we last tried to send an event to it, with the HTTP status it returned and any error

Information we collect when you use our x402 API:

The wallet address you pay from, and the payment authorisation you sign
The record of the payment, and of any refund, on the Base blockchain, including the transaction hash, the amount and the time
The IP address the x402 API requests come from, used to protect the Service from abuse

Letters ordered through the x402 API have no email address: we do not ask for one, and we do not send email about them.

When you ask an AI assistant to prepare a Letter through our connector at https://unopost.com.au/api/mcp, the assistant's provider sends us your document, or a link from which we download it, the addresses and options you give the assistant, and the IP address its requests come from. We use and keep them as we do the same information given on our website. We do not receive your conversation with the assistant, which its provider handles under its own privacy policy.

The assistant may also give us your email address, which we keep with the Letter and suggest to you on our website; we use it only if you pay for the Letter with it. The assistant may also tell us it is preparing the Letter for a business and give that business's email address. We show you both before you pay. If you pay for the Letter, we send that business a copy of each email we send you about it, with the details those emails include, such as the recipient's name and address, the tracking number and the delivery status. We keep the business's email address with the Letter and remove it with the addresses.

Payment information: card and digital wallet payments are processed by our payment processor, Square AU Pty Ltd (ABN 38 167 106 176). Square collects your card details and billing information directly and handles them under its Buyer Privacy Notice (https://squareup.com/au/en/legal/general/buyer-privacy). We give Square the email address you enter, and the name on your card that you enter or that Apple Pay or Google Pay provides, so that they are recorded with your payment and tax invoice. When a business saves a card to its business account, we give Square the business's name and billing email address, so that Square can keep the card on file for that business; Square stores the card, and we can charge it but never see its full number. We receive only a payment confirmation, the amount paid and a payment reference. We never see or store your full card number. Letters ordered through the x402 API are paid in USDC on the Base network, verified and settled through Coinbase. Payments and refunds are recorded on a public blockchain, which is outside our control: once a record is on the blockchain, we cannot change it, delete it or make it private.

You can browse our website without telling us who you are. To send a Letter, you must give us a document and the recipient's name and address and, on our website, an email address. Without them, we cannot print, post or track your Letter or send you its tracking number.

3. Information we do not collect

We do not require you to create an account, unless you open a business account, and we never ask for a password: business accounts sign in with a one-time code we email to them and, once the business holds Business Credit, a code from an authenticator app
We do not require government-issued identification
We do not store your full card details
We do not use social media tracking tools. The only advertising measurement we use is described in Section 10
We do not receive what you enter into our postage calculator at https://unopost.com.au/postage-calculator: your browser works out the prices on your device
We do not receive the files you add to our PDF merger at https://unopost.com.au/merge-pdf: your browser reads and joins them on your device. We receive the merged PDF only if you choose to post it as a Letter, and then handle it like any other document you upload
We do not receive the text you paste to send a Letter to several people: your browser reads the addresses from it on your device. We receive only the names and addresses you confirm and pay for, and handle them like any other recipient's name and address
We do not receive the answers you type into our letter templates at https://unopost.com.au/letter-templates: your browser writes the letter on your device and keeps your answers there, in its local storage, until you clear the form. We receive the letter only if you choose to have us post it as a Letter, and then handle it, and the addresses it passes to our letter form, like any other document and addresses you give us

4. How we use your information

We use personal information only for the following purposes:

To convert, preview, print and post your Letter, including photographing its addressed envelope when we post it, to read its tracking number from the photo and check that the envelope is addressed as your Letter's record says
To calculate the price of your Letter and process your payment
To assess your application for a business account, including checking your ABN against the Australian Business Register, and to contact you about it, including by email to confirm that we have received it
To set up and administer your business account and Business Credit, including verifying you when you sign in
To send the details of each Letter made through the Business API to the webhook URL your business sets, as described in Section 7
To help your business with a support request, or investigate a problem or security concern with its business account, which may include our staff viewing the account, read only, as its team sees it, including its stored documents. Each view is opened from our internal admin system, lasts no more than 30 minutes and is recorded
To send you transactional emails, including your payment confirmation, tracking number, delivery updates, problem notifications and refund notices
To email you, now and then, a discount code to use on a Letter, if you have given us your email address when ordering one. You can ask us to stop at any time, as described in Section 15
To issue refunds and resolve billing disputes and chargebacks
To email a receipt for each purchase of Business Credit to the business account's billing email address and to each of its owners
To ask you, in an email about your Letter, for feedback on our Service, and, only where you have told us that we may, to publish what you wrote to us as a testimonial on our website, credited in the way you ask. You can withdraw that permission at any time by contacting us, and we will remove the testimonial
To respond to your support requests
To understand how our website is used and improve it, and to measure whether our Google advertisements lead to paid Letters, using Google Analytics
To understand which advertising and other channels bring customers to us, using the record of how you found us described in Section 2
To understand how the Service is used and improve it, using our records of paid Letters: how many are sent and by which postage service, the kind of device and the country they were ordered from, and how often customers return. For this we tell customers apart only by their email address or business account
To detect, prevent and investigate fraud, abuse, security incidents and breaches of our Terms of Service
To record the acceptance of our Business Agreement, to email a copy of it as accepted to the person who accepted it and to each owner of the business account, and to establish, exercise or defend legal claims
To show wording suited to where you are, as described in Section 2
To comply with our legal obligations, including tax and record-keeping obligations

We do not sell, rent or trade your personal information. We do not use your documents or addresses for marketing, profiling or to train artificial intelligence models.

5. Recipients' information

When you send a Letter, you give us the name and address of the recipient, and your document may contain information about them. You must only provide information about another person where you are lawfully entitled to do so.

A document may contain sensitive information, such as health information, about you or other people. You should include it only where you are entitled to, and where any consent the law requires has been given. We handle it only to print, post and track your Letter, as described in this Privacy Policy.

We use recipients' information only to print, address, post and track the Letter, and to handle any support request or dispute about it. We do not contact recipients, and we do not add them to any list.

6. Your documents

We take the confidentiality of your documents seriously. The following practices apply:

Documents are encrypted in transit using TLS, and encrypted at rest by our cloud infrastructure provider
Documents are stored in Amazon Web Services' Sydney region, only for conversion, printing and posting, including documents uploaded to a business account
Each business account's stored documents are kept in a separate private folder that only that business's signed-in team members, and our staff as described in Section 4, can open. Documents and recipient lists uploaded to send Letters from a business account are stored under names that cannot be guessed, and are reached only through our systems or short-lived signed links, never by another business
Documents are converted automatically by our systems. Letters are then printed, placed in envelopes and lodged with Australia Post by hand, by us, so the person at Unopost who prints and posts your Letter may see your document while doing so. They handle it only for that purpose, and do not copy or keep it. Otherwise, no one at Unopost reads your document unless required by law, legal process, or to resolve a problem with your Letter, a billing dispute, a support request you have initiated or a security concern
Your document and the print-ready copy of your Letter are permanently deleted, including every stored version, once your Letter is despatched, which means once it is lodged with Australia Post. We do not keep a copy while it is in the post. If you cancel your Letter before we start to print it, they are deleted when you cancel it. We keep only the size and a SHA-256 digest of each file you upload and of the print-ready copy. A digest identifies a file but cannot be turned back into it, and does not reveal what the file says. We keep it so that, if there is a dispute about what was posted, we can confirm whether a copy that you or anyone else produces is the file you sent. For that, keep a copy of your document as it was sent: a copy that has been changed will not match.
Documents for Letters that are not paid for or cannot be posted stop being available no later than 14 days after upload and are permanently erased from our storage within 3 days after that. Any print-ready copy of such a Letter is erased within 17 days after it is made

Once printed, a Letter is a physical item in our care and then in Australia Post's. We cannot control who opens or reads a Letter after it has been delivered.

7. Who we share your information with

We disclose personal information to the following kinds of organisations, and only to the extent needed for the purposes in Section 4:

Cloud hosting and infrastructure providers: hosting, storage, databases, business account sign-in, the emails we send, address suggestions, delivery of our website and replies in the support chat. Your documents and Letter records are stored in Australia
Australia Post: the recipient's name and address and your return address, as they appear on the envelope, to carry, deliver and track your Letter, and, for a Letter to China, the recipient's mobile telephone number, which China Post requires for delivery. For a Letter posted outside Australia, Australia Post may give these details to the postal service and customs authorities of the destination country.
Payment providers: our card payment processor, which collects your card details directly and handles them under its own privacy notice, and, for Letters paid for through our x402 API, a payment facilitator that verifies and settles USDC payments and sends refunds
Email hosting providers: the provider that hosts our unopost.com.au mailboxes, which holds the emails you send us and the enquiries and applications you submit through our website forms
Website analytics providers: information about how you use our website, but not your documents, addresses, email address or payment details
Artificial intelligence service providers: to generate replies to messages you type into the support chat, and to read the tracking number from the photo of a Letter's envelope taken when we post it and check the address on it. The model runs within our cloud hosting provider in Australia, and neither your messages nor the photos are used to train it
Government registers: the Australian Business Registrar, to which we send only the ABN you give us, to look it up on the Australian Business Register
Your business's own systems: when the status of a Letter made through the Business API changes, including a test Letter in its sandbox, we send the Letter's details, as the Business API gives them, to the webhook URL your business sets, at its direction and over HTTPS. Your business chooses that endpoint and is responsible for it and for how the information it receives is handled

The organisations that currently handle personal information for these purposes, what each does and where, are listed below. This list is the Provider List referred to in our Business Agreement. We print, place in envelopes and lodge Letters ourselves, in Melbourne, Australia. If that changes, we will update this list and this Privacy Policy first.

Amazon Web Services Australia Pty Ltd: hosting, storage and databases for the Service, including your documents, print-ready letters and letter records; business account sign-in (Amazon Cognito); the emails we send (Amazon SES); address suggestions (Amazon Location Service); delivery of our website (Amazon CloudFront); and replies in the support chat and reading the photo of each Letter's envelope taken when we post it (Amazon Bedrock, using Anthropic's Claude models run by Amazon Web Services in Australia; Anthropic does not receive your messages or the photos). Sydney region, Australia. Some technical support may be provided from the United States, address suggestions may use a map data provider outside Australia, and visitors outside Australia may be served from a location near them (https://aws.amazon.com/privacy/)
Australia Post: the recipient's name and address and your return address, as they appear on the envelope, to carry, deliver and track your letter, and, for a letter to China, the recipient's mobile telephone number, which China Post requires for delivery. For a letter posted outside Australia, Australia Post may give these details to the postal service and customs authorities of the destination country. Australia (https://auspost.com.au/privacy)
Square AU Pty Ltd (ABN 38 167 106 176): card and digital wallet payments, refunds, tax invoices and fraud prevention. Australia, with some processing in the United States (https://squareup.com/au/en/legal/general/buyer-privacy)
Fastmail Pty Ltd: hosting of our unopost.com.au mailboxes, including email you send to support@unopost.com.au or legal@unopost.com.au, and the enquiries and applications you submit through our website forms. It does not receive your documents unless you email them to us. The United States (https://www.fastmail.com/policies/privacy/)
Google Australia Pty Ltd (ABN 33 102 417 032): website analytics through Google Analytics. It does not receive your documents, addresses, email address or payment details. The United States and other countries (https://policies.google.com/privacy)
Coinbase Technologies, Inc.: for letters paid for through our x402 API only, your wallet address and signed payment, to verify and settle the payment and send any refund. The United States (https://www.coinbase.com/legal/privacy)
Discord Inc.: a notification to our own staff that a letter has been paid for, giving only the letter's reference, page count, service and options and how it was paid for, and never a name, address, email address or document. For a letter paid for with Business Credit, it is told only that a business letter was paid for, and nothing about the letter or the business. The United States (https://discord.com/privacy)
The Australian Business Registrar: the ABN you enter when you apply for a business account, to look it up on the Australian Business Register. We send it only the ABN. Australia (https://abr.business.gov.au/Home/PrivacyPolicies)

We require the providers that handle personal information for us, such as Amazon Web Services and Fastmail, to keep it confidential and secure and to use it only to provide services to us, and we remain responsible for how they handle it. Square, Google, Coinbase, Discord, Australia Post and the Australian Business Registrar also handle the information they receive under their own privacy policies and legal obligations, which are linked above.

We may add, remove or replace a service provider as the technology and suppliers we use change. When we do, we update the list above and its change history below before the new provider starts to handle personal information. We do not change this Privacy Policy for such a change unless it would mean collecting a new kind of personal information, using or disclosing it for a new purpose, disclosing it to a new kind of organisation, or disclosing it to a country not named in Section 8. In that case, we will update this Privacy Policy before the change takes effect. We will not use or disclose personal information we already hold for a new purpose unless the law allows it, for example because you consent.

If you have a business account, our Business Agreement also requires us to email your administrators at least 14 days before a new provider starts to handle your stored documents, the content of your Letters or your Letter records (or, where a change is urgently needed for security or to keep the Service running, as soon as practicable afterwards), and lets your business end the agreement if it reasonably objects.

Change history of the Provider List:

27 September 2026: first published, at https://unopost.com.au/service-providers
30 September 2026: moved into this Section 7, with no change to the providers listed
11 October 2026: Discord Inc. added, for the staff notification described above
15 October 2026: Amazon Web Services' role extended to reading the photo of each Letter's envelope taken when we post it, as described above

We keep each earlier version of the list and will give you a copy of the version in force on any date if you ask.

We may also disclose personal information where required or authorised by law, including in response to a court order, subpoena or lawful request from a government or law enforcement agency, or where we reasonably believe disclosure is necessary to prevent fraud or a serious threat to a person's life, health or safety.

If our business is sold, merged or restructured, personal information may be transferred to the successor entity, subject to this Privacy Policy. This includes business accounts, whose Business Agreements we may transfer to a buyer as those agreements provide.

8. Overseas disclosure

We store your documents and Letter records in Australia. Some personal information is disclosed to, or may be accessed from, other countries:

The United States: our email hosting provider holds the emails you send us, including any document you attach, and the enquiries and applications you submit through our website forms
The United States: our card payment processor and our cloud hosting provider may process or access limited personal information there, for purposes such as payment processing, fraud prevention, email delivery and technical support
The United States and the other countries where Google operates data centres (https://www.google.com/about/datacenters/locations/): website usage information collected by Google Analytics
Outside Australia: the text you type into the address search may be processed by the map data provider that supplies address suggestions to our cloud hosting provider, in a country our cloud hosting provider does not specify
The United States: our x402 payment facilitator verifies and settles x402 payments and sends refunds
Worldwide: a payment or refund made through our x402 API is recorded on the Base blockchain, which is public and is copied worldwide by the computers that run the network. This is inherent in how the network works. It cannot be limited to Australia, and we cannot change or delete the record
The destination country: when you send a Letter to an address outside Australia, the recipient's name and address, and your return address and, for a Letter to China, the recipient's mobile telephone number, are disclosed to the postal service and customs authorities of that country, as needed to deliver the Letter
The country you are in: if you visit our website from outside Australia, our content delivery network may handle your requests, including your IP address, at a location near you
Wherever your business chooses: the details of its Letters that we send to the webhook URL it sets for the Business API, as described in Section 7

Where we disclose personal information to an organisation outside Australia, we take reasonable steps to ensure it handles the information consistently with the Australian Privacy Principles, except where the Privacy Act allows otherwise.

9. Data retention

We keep personal information only for as long as we need it for the purposes described in this Privacy Policy:

Uploaded documents and print-ready Letters: deleted once the Letter is despatched, or otherwise within the periods described in Section 6. We keep their size and SHA-256 digest with the Letter record, as described below
Uploaded profile photos: kept until the team member replaces or removes it, is removed from the business account or the account is closed, and then deleted within 30 days or, if the account is closed, as described for closed business accounts below
Documents and recipient lists uploaded to a business account: each stops being available no later than 14 days after upload and is permanently erased from our storage within 3 days after that. A document or recipient list uploaded for a particular send is deleted sooner, once every Letter sent with it has been despatched. The print-ready copy of each Letter is deleted once the Letter is despatched, and in any case within 17 days after the Letter is sent. We do not keep them for any longer period. If the business account is closed first, they are deleted as described for closed business accounts below
Letter records (the recipient's name and address, your return address and email address and, for a Letter sent by International Express before we withdrew it, your telephone number, and, for a Letter to China, the recipient's mobile telephone number, the file name, page count, price, payment reference, tracking number, status and, where we have recorded it, the date on which Australia Post's tracking records show the Letter as delivered, held for collection or not delivered, and the record of how you found us described in Section 2): kept for receipts, support, refunds and billing disputes. The recipient's name, street address and any telephone number, and your return address and telephone number, are deleted 60 days after Australia Post's tracking records show the Letter as delivered or, if we have not recorded its delivery within 90 days after the Letter is despatched, 90 days after it is despatched. If those records show the Letter as held for collection or not delivered, and not later as delivered, they are instead kept until 60 days after we record that, if that is later, so that you can show where the Letter was sent if there is a dispute about it. For a Letter that is not despatched, they are deleted 30 days after payment. After that we keep only the recipient's suburb, state, postcode and country. Those, the file name, the tracking number and the record of how you found us are deleted 18 months after payment. The rest of the record, which shows the transaction, is kept for as long as Australian tax and record-keeping law requires, generally seven years from the date of the transaction, and then deleted or de-identified. The record of a Letter that is not paid for is deleted after 14 days. The IP address a Letter was created from, and any record of the browser or software used and of its language setting, which we keep with its record, are also deleted 18 months after payment. Letter records for a business account are kept for the same periods or, if sooner, until the account is closed, and are then deleted, except for the compliance records, as described below. A Letter record also includes the size and SHA-256 digest of each file you upload, of the print-ready copy and of each photo of the envelope. We keep them with the rest of the record so that we can resolve a dispute about what was posted, and delete them with it
Photos of Letters' envelopes: stored in Amazon Web Services' Sydney region and deleted when the recipient's name and street address are deleted from the Letter record, as described above, and in any case within 120 days after they are taken. A copy we email to you with the tracking number is yours to keep, and we do not delete it. We keep the size and SHA-256 digest of each photo with the Letter record, so that we can confirm whether a copy is the photo we took
Support chat: the conversation is sent to Amazon Bedrock in Australia to generate a reply. We keep a copy of each message and reply, with a one-way hash of your IP address, for 90 days to review and improve the answers, and then delete it. The hash is also kept for no more than 2 hours to apply usage limits
Support emails: kept for as long as needed to resolve your request and any related dispute
Business enquiry form: your enquiry is emailed to our business inbox and kept like a support email. A one-way hash of your IP address is kept for no more than 2 hours to limit how many enquiries can be sent
Business account applications: kept while we assess your application and, if we open an account, as part of its records. If we decline an application or you do not go ahead, we delete it within 12 months
Business API key use: each request made with a key, and each system that has used it, is kept for 90 days after the request, or after the system last used the key, and then deleted. When a key was last used is kept with the key, and when a key was issued, turned off or turned on, and by whom, is kept with the business account. Both are deleted when the account is closed, as described below
Business API webhooks: each event we send is kept only until it is delivered or we stop retrying it, and in any case for no more than 4 days, or 14 days if a fault in our systems stops us from processing it. For a test Letter in the sandbox, a record that an event has been sent, which holds no personal information, is kept for 7 days so that the event is not sent twice. A webhook's settings and its last delivery attempt are kept until your business removes the webhook or the account is closed
Server and security logs: kept for 90 days, or longer only if needed for a specific security incident or legal claim. We design our logs not to record the contents of your documents, your email address or the recipient's name and address
Accepted Business Agreements: the record of each acceptance (the name, position, email address, IP address and browser of the person who accepted it, the time, and the business's name, ABN and capacity) and the copy of the agreement as accepted are kept as evidence of the contract with your business, and to establish, exercise or defend legal claims about it, until 7 years after the agreement ends or is replaced, and then deleted. For the first 7 years after acceptance they are kept in storage that is locked so that they cannot be changed or deleted by anyone, including us. The record shows what was entered when the agreement was accepted, so we do not change it. If you tell us that information in it is inaccurate, we will tell you in writing why we have not changed it and how to complain, keep a statement of the correction with the record, and use the correct information for every other purpose
Closed business accounts: when a business account is closed, we permanently delete everything we hold for it, including its stored documents, settings, API keys, webhooks, team members and their logins and profile photos, its Letter records (except the despatch records described below), its application, and the emails its team members sent us. Only the owner can close an account. We delete within 30 days after the owner closes it, unless a copy period below applies. Where we end the account, or it ends for any other reason, its administrators may ask us for copies within 30 days, and we delete within 30 days after that period ends. Deleted data cannot be recovered. We keep only these compliance records: audit logs of sign-ins, account changes, staff views and API key use, for no more than 90 days unless needed for a specific security incident or legal claim; accepted Business Agreements, kept as described above; the records of Business Credit purchases, refunds and transactions that Australian tax law requires us to keep, generally for seven years; for each Letter sent from the account, the record of the transaction (its reference and any reference the business gave it, the team member or API key that sent it, the dates it was sent and despatched, its service, destination country, page count, price and status) for the same period, and its tracking number until 18 months after it was sent, to show that the Letter was despatched and to answer claims about it; while a refund of Business Credit remains unpaid, the billing email address, each administrator's name and email address and the amount owed, until the refund is paid or dealt with as the law on unclaimed money requires; and any data a law, court order or regulator requires us to keep, or that relates to a payment dispute, claim or dispute notified before deletion, until the requirement ends or the matter is resolved. Except for that last kind, compliance records never include the content or file names of any Letter or stored document, or the recipients of any Letter, apart from a reference the business chose to give a Letter, which may itself identify someone. For each Letter, compliance records also include the size and SHA-256 digest of each file it was printed from, of its print file and of each photo of its envelope, which identify those files but cannot be turned back into them
Payments through the x402 API: the wallet address and payment reference are kept with the Letter record. The blockchain record of the payment itself is public and permanent, and we cannot delete it

10. Information stored in your browser

Our website uses Google Analytics, which sets cookies (such as _ga) to tell visits apart and measure how the website is used. You can block these cookies in your browser settings, or opt out of Google Analytics on every website with Google's opt-out browser add-on at https://tools.google.com/dlpage/gaoptout. The Service works the same without them. If you reach our website from one of our Google advertisements, Google Analytics also sets a cookie (such as _gcl_au) to record that, and tells Google Ads when the visit leads to a paid Letter, so that we can measure our advertising.

To make the Service easier to use, our website also stores some information in your browser, on your device only:

For business accounts, a secure sign-in cookie that keeps you signed in. It is needed for the portal to work, cannot be read by the website's scripts, and is removed when you sign out or it expires
For business accounts, which getting-started steps you have opened in the business portal, and whether you have hidden them
The details you have entered for a Letter you haven't paid for yet (the recipient's address, your return address, your email address, Service Level and options), so they are still there if you leave and come back. These are removed once the Letter is paid for
A list of Letters sent from that browser in the last 14 days (the file name, recipient's name, suburb, state, postcode and status), so you can check their progress
Your light or dark theme preference
The language you have chosen to read the website in. Where you have not chosen one, the website selects a language from your browser's language setting. Both are sent to us when you start a Letter, as described in Section 2
How you found us, as described in Section 2, so it can be kept with a Letter or business account application you submit later

This information is not sent to us except when you submit a Letter or business account application, and except for the sign-in cookie, which your browser sends to us with each request to the business portal. You can remove it at any time by clearing your browser's site data for unopost.com.au. If you use a shared or public device, we recommend clearing your browser's site data after use.

11. Security

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These include encryption in transit and at rest, HTTPS-only access to our website and storage, short-lived signed upload links, a second sign-in step with an authenticator app for business accounts that hold Business Credit, access controls that limit our systems and staff to the information they need, and automatic deletion of documents. The measures described in this Section are the Security Summary referred to in our Business Agreement.

Your documents:

Encrypted at rest (AES-256) and in transit. Our storage refuses any request that is not made over HTTPS
Uploaded and downloaded through signed links that expire within minutes
Stored only in Australia, and deleted automatically as described in Sections 6 and 9

Business accounts:

No passwords to steal or reuse. Each sign-in uses a one-time code emailed to the team member's address at the business's own domain
A second step with an authenticator app for every team member once the business holds Business Credit, which cannot be put off once it has stored documents. A code works only once, and repeated wrong codes lock the step for 15 minutes
The signed-in session is kept in a secure cookie that the website's scripts cannot read
Every request is checked against the signed-in person's own business, so that one business cannot reach another's account, documents or folder
Only the owner and administrators can change the account or the team, and only the owner can close it

Our staff view a business account only as described in Section 4. That view cannot send Letters, use Business Credit or change anything in the account. Access to our production systems is limited to the people who need it to run the Service.

We improve our security measures and the technology behind them over time, and may change them without notice, as long as the overall protection they give personal information is not materially reduced. Whatever changes, documents stay encrypted in transit and at rest and stored in Australia, and staff access stays limited as described above.

No method of transmission or storage is completely secure. If we have reasonable grounds to suspect an eligible data breach, we will assess it promptly, and in any case within 30 days. If we have reasonable grounds to believe one has occurred, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth) requires. We do this whether or not the scheme applies to us by law. Where the information is in a business customer's documents or letters, we tell that business without undue delay, and in any case within 72 hours, take reasonable steps to contain it, work with it on the response, and agree with it which of us will notify. Unless we agree otherwise with that business, it notifies the affected individuals and the OAIC about information in its documents, recipient lists and letters, as our Business Agreement provides, and we notify them if it does not and the Privacy Act 1988 (Cth) requires us to.

If you believe you have found a security issue in Unopost, email support@unopost.com.au with "Security" in the subject line. Our Responsible Disclosure Policy (https://unopost.com.au/responsible-disclosure) explains what to include, the rules we ask you to follow and how we respond.

12. Access and correction

You may request access to the personal information we hold about you, or ask us to correct it, by emailing support@unopost.com.au. To protect your privacy, we may ask you to verify your identity, for example by confirming the email address and reference of a Letter.

We will respond within 30 days. We may decline a request where permitted by law, and if we do, we will explain why. Because documents are deleted automatically, we may no longer hold a copy of a document you uploaded. Once a Letter has been posted, its address can no longer be changed. For a Letter ordered through the x402 API, we may ask you to prove that you control the wallet that paid for it, and we cannot correct or delete a payment recorded on a public blockchain. We do not charge for making a request or for giving you access. If we refuse to give access or to correct information, we will tell you in writing why and how to complain. If we do not correct information, you may ask us to keep a statement with it saying that you believe it is inaccurate, out of date, incomplete, irrelevant or misleading, and we will. If your request concerns personal information in the documents or Letters of a business that uses a business account, we may tell that business and help it to respond.

13. People in the European Union, EEA or United Kingdom

We provide the Service from Australia. If the GDPR or UK GDPR applies to our handling of your personal information, the controller is AWS, CYY & Co. Pty Ltd as trustee for Mumu, Lulu & Co., contactable at support@unopost.com.au. We rely on these legal bases: performance of a contract, to print and post your Letter and take payment; legitimate interests, to secure the Service, prevent fraud and abuse, answer enquiries and support chat messages, measure how our website is used, understand which channels bring customers to us and resolve disputes; and compliance with legal obligations, such as tax and record-keeping. Section 8 describes where your information is held and sent, and Section 9 how long we keep it.

You have the right to request access to, rectification, erasure or restriction of your personal information, to object to its processing, and to data portability. To exercise these rights, email support@unopost.com.au with the subject line "GDPR Data Request". We will respond within one month. Erasure does not extend to a record on a public blockchain, which we cannot change or delete, or to information we are required by law to keep. You also have the right to lodge a complaint with your local data protection authority.

14. Automated decisions

Our systems make some routine decisions automatically, such as limiting how many chat messages or enquiries can be sent from one IP address, checking that an Australian address is in a valid Australian format, checking that a Chinese recipient's number is a Chinese mobile number, and checking that an ABN is valid and that a business account application uses a company email address. We do not use computer programs to make decisions, using personal information, that could reasonably be expected to significantly affect your rights or interests. A person reviews every business account application we receive.

15. Marketing

We do not send marketing emails, other than an occasional email from us with a discount code, for example to thank you or to make up for a problem with a Letter. We send one only to an email address given to us when ordering a Letter, and each one says how to stop them: reply asking us to, or email support@unopost.com.au, and we will not send you another. Otherwise we send only transactional emails about Letters you have sent, your business account and Business Credit, and replies to support requests you have made.

16. Children

The Service is not directed to individuals under 18 years of age, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date at the top of this page and, for material changes, post a summary of changes on our website. Changes to our list of service providers are made as described in Section 7. We keep earlier versions of this Privacy Policy and will give you a copy on request. If you have a business account, we will also email your administrators about material changes.

18. Contact and complaints

If you have any questions about this Privacy Policy, or wish to make a complaint about how we have handled your personal information, please contact us at:

Email: support@unopost.com.au. Post: PO Box 169, South Melbourne VIC 3205, Australia.

We will acknowledge your complaint within 1 business day and aim to resolve it within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at https://www.oaic.gov.au, by calling 1300 363 992 or by writing to the OAIC at GPO Box 5288, Sydney NSW 2001.