Privacy policy
Last updated: October 2026
PostMCP prints and posts letters for you, so it has to read your letters and know who they are for. This page explains what we collect, why, who we share it with and how long we keep it, in line with the General Data Protection Regulation (GDPR).
1. Data controller
BeyondSky OÜ, a company registered under Estonian law with company number 16894028, operating PostMCP (getpostmcp.com). Contact for any privacy question: [email protected]
2. What we collect
- The letter itself: the text or file you or your AI assistant send us, and the PDF we print.
- Sender details: name and postal address printed on the letter.
- Recipient details: name and postal address of the person or company you write to.
- Your email address, to send the receipt and the tracking updates.
- Order data: price, status, tracking number, dates.
- Technical data: IP address and request logs of the MCP server, used for security and to stop abuse.
We never see or store your card details: payments are handled by Stripe. We do not use advertising or tracking cookies on this website.
3. Why we use it
| Purpose | Legal basis |
|---|---|
| Print, post and track your letter, send the receipt and status emails | Performance of the contract |
| Check letters for abuse (threats, scams, impersonation) before printing | Legitimate interest: protect recipients and the service |
| Keep invoices and payment records | Legal obligation (accounting) |
| Security logs, rate limiting | Legitimate interest |
We do not sell your data and do not use your letters to train any AI model.
4. Recipients of your letters
When you send a letter, you give us the name and address of a third person. We only use them to print and deliver that letter. You confirm that you are allowed to send them mail. A recipient can contact us at any time to exercise their rights.
5. Who we share it with
Only the providers we need to run the service, each bound by a data processing agreement:
- Hetzner Online GmbH (Germany): hosting, servers in the European Union.
- Stripe: payment processing.
- Pingen GmbH (Switzerland): printing and posting of plain letters. Switzerland is recognized by the European Commission as offering an adequate level of protection.
- Anthropic: automated content check of the letter before printing. Data may be processed in the United States under the European Commission's standard contractual clauses, and is not used to train models.
- Postal operators (for example La Poste in France): delivery of the letter, which shows the sender and recipient addresses.
- Our email provider: sending the receipt and status emails.
Fonts on this website are loaded from Google Fonts, which receives your IP address when you visit.
6. How long we keep it
- Letter files (text and PDF): deleted 30 days after the letter is posted, delivered, returned or cancelled. Unpaid letters are deleted 30 days after creation.
- Order data (addresses, email, price, status, tracking): 3 years after the order, to handle claims.
- Invoices and payment records: as long as accounting law requires (up to 7 years).
- Security logs: 12 months at most.
7. Your rights
You have the right to access, rectify and erase your data, to restrict or object to its processing and to data portability. Write to [email protected] and we answer within one month. Some data cannot be erased while the law requires us to keep it (invoices).
You can also file a complaint with a data protection authority: the Estonian Data Protection Inspectorate (www.aki.ee) or the authority of your country, for example the CNIL in France (www.cnil.fr).
8. Security
Data is sent over encrypted connections (HTTPS). Letter previews are only reachable through a private link. Access to the admin tools is restricted and password protected.
9. Changes
We may update this policy. The date at the top of the page shows the latest version.