[DRAFT FOR LEGAL REVIEW. This is not final and has not been reviewed by an attorney. Do not publish until counsel has reviewed and approved it. Items marked [DECISION: ...] need a business decision from the owner. Items marked [VERIFY] need a check by counsel.]
My Mail Center Data Retention & Deletion Policy
Last updated: [DATE] Effective date: [DATE]
This policy explains how long [Legal entity name, e.g. My Mail Center LLC] ("My Mail Center," "MMC," "we") keeps data from our digital mailbox service, and what happens when you delete your account. It goes with our Terms of Service and Privacy Policy.
Our approach
- We keep data only as long as we need it.
- Some records must be kept by law, even after you close your account. The main ones are your USPS Form 1583 and ID copies, and billing records for taxes.
- When a retention period ends, we delete the data or make it so it can no longer identify you.
- Physical mail is handled under the storage rules in our Terms. Physical items we destroy are cross-cut shredded or destroyed securely. [DECISION: shredding method or vendor.]
Retention schedule
"Active account" means your account is open. "Closing" means the date your account is deleted or terminated.
| Data type | How long we keep it | Why |
|---|---|---|
| Envelope / package exterior images | While your account is active, for [DECISION: e.g. 12 months, or until you delete them]. Deleted within [DECISION: e.g. 30] days after closing. | To show you what arrived and keep a record of mail handling. |
| Mail log (date, sender, carrier, tracking, actions taken) | While your account is active, plus [DECISION: e.g. 2 years] after closing. | To resolve disputes about lost or misdelivered items, and for USPS inquiries. |
| Scanned contents | While your account is active, until you delete them, or [DECISION: auto-delete after X months, or keep until deleted]. Deleted within [DECISION: e.g. 30] days after closing. | To let you view and download your scans. |
| AI summaries and detected due dates | Same as the scan they come from. Deleted when the scan is deleted. | Convenience feature tied to the scan. |
| AI provider copies (Anthropic) | Not kept by us beyond the results returned. The provider may keep inputs for a limited period under its terms. [DECISION/VERIFY: provider retention period; zero-data-retention option.] | Processing only; not used for model training (subject to provider terms). |
| Identification document copies | While your account is active, plus as long as USPS requires after closing. [VERIFY: current DMM 508.1.8 retention period; we understand it to be at least 2 years after the agency relationship ends.] | Required by USPS CMRA rules. |
| USPS Form 1583 (original and copies) | While your account is active, plus as long as USPS requires after closing. [VERIFY: same as above.] | Required by USPS CMRA rules; available for USPS inspection. |
| Online notarization records | Kept by the notary provider under the notary's legal duties. MMC keeps only the completed, notarized Form 1583. [VERIFY: notary provider's retention.] | State notary law. |
| Account profile (name, contact info, address) | While your account is active. After closing, only the parts needed for the records above are kept. | To provide the Service; linked to records we must keep. |
| Forwarding addresses | While your account is active. Deleted within [DECISION: e.g. 30] days after closing, except where included in shipping records. | To forward mail. |
| Mail rules and preferences | While your account is active. Deleted at closing. | To run your automatic actions. |
| Billing records (invoices, payments, refunds, last 4 digits of card) | 7 years after the transaction. [VERIFY: IRS and Illinois Department of Revenue record retention guidance.] | Tax and accounting law. |
| Full card numbers | Never stored by MMC. Stripe keeps payment data under its own policies. | Handled by Stripe. |
| Shipping and postage records (for forwarding) | 7 years [DECISION: or match billing]. | Tax, accounting, and carrier claims. |
| Text message consent and opt-out records | For the life of the account plus [DECISION: e.g. 5 years] after the last message. [VERIFY: TCPA statute of limitations is 4 years.] | To prove consent and honor STOP requests. |
| Support messages | [DECISION: e.g. 3 years] after the conversation ends. | To help you and resolve disputes. |
| Security and audit logs (who viewed or acted on mail, scans, IDs) | [DECISION: e.g. 2 years]. | Security, fraud investigation, and accountability. |
| App usage and device data | [DECISION: e.g. 13 months]. | To run and improve the Service. |
| Push notification tokens | Until you sign out, uninstall, or close your account. | To send app notifications. |
| Backups | Backups roll over within [DECISION/VERIFY: Supabase backup window, e.g. 7–30 days]. Deleted data may remain in backups until they roll over. | Disaster recovery. |
| Records under legal hold | Until the legal matter ends. | Legal claims, subpoenas, or government requests. |
Physical mail and packages
| Item | How long we hold it | What happens next |
|---|---|---|
| Letters and flats | [DECISION: free storage days] | [DECISION: storage fee, forward at your cost, shred, or return to sender] |
| Packages | [DECISION: free storage days] | [DECISION: storage fee, forward at your cost, or return to sender] |
| Archived items (on request) | [DECISION: maximum archive period] | [DECISION: fee and end-of-archive handling] |
| Items for people not on your Form 1583 | [DECISION: e.g. 7 days] | Returned to sender if your form is not updated. |
| Mail still held when your account closes | [DECISION: e.g. 30 days] | [DECISION: returned to sender, shredded, or disposed of] |
| Mail that arrives after your account closes | — | Handled as required by USPS regulations (see Terms, Section 12). |
Deleting your account
You can delete your account in the app under [Account > Delete Account], or by emailing [support email]. This is available in our iOS and Android apps, as Apple and Google require.
Before you delete, please:
- Download any scans you want to keep. We can't recover them after deletion.
- Request pickup, forwarding, or shredding of mail we are holding.
- Update your address with your senders.
- Pay any balance due.
What happens when you delete:
| Step | Timing |
|---|---|
| You can no longer sign in. Auto-renewal stops. | Right away |
| Mail images, scans, AI summaries, mail rules, push tokens, and preferences are deleted. | Within [DECISION: e.g. 30] days |
| Deleted data is cleared from backups. | Within [DECISION/VERIFY: backup window] after that |
| Form 1583 and ID copies are kept, then deleted. | When the USPS-required period ends [VERIFY] |
| Billing and tax records are kept, then deleted. | 7 years after the transaction [VERIFY] |
| Audit logs and consent records are kept, then deleted. | Per the schedule above |
| We tell USPS the agency relationship has ended, if required. | As required by USPS regulations [VERIFY] |
During the retained period, we limit access to these records to what is needed for legal, tax, and USPS purposes.
Deleting individual items
You can delete individual envelope images and scans in the app at any time. Deletion from active systems happens [DECISION: immediately, or within X days]. The mail log entry (date, sender, action) stays for the period in the schedule above, so we have a record that the item was handled. [DECISION: confirm.]
Secure disposal
When we destroy records, we do it so the information can't be read or rebuilt. This includes:
- Deleting electronic records from our database and storage, and letting backups roll over.
- Shredding paper records and physical mail.
This follows the Illinois Personal Information Protection Act's duty to dispose of personal information securely.
Changes and questions
We may update this policy. We will post the new version and change the "Last updated" date. For material changes, we will notify you by email or in the app.
Questions: [privacy email] or [support email].
Notes for counsel
- USPS Form 1583 retention. Please confirm the current retention requirement in DMM 508.1.8 (and the 2023 CMRA final rule) for the original 1583, copies of ID, and any electronic records, and whether the period runs from termination of the agency relationship. The "at least 2 years after termination" figure in this draft is my understanding and must be verified. Also confirm whether electronic retention satisfies the "original" requirement when the 1583 is signed via online notary. Sources: USPS DMM 508; 88 FR 32117 (May 19, 2023); Archived DMM 508 (2011) for comparison.
- Post-termination mail. Confirm DMM 508.1.8 language on forwarding after termination and the required return-to-sender endorsement, and any obligation to notify USPS when the relationship ends.
- Tax records. Confirm the 7-year period against IRS guidance (generally 3–7 years) and Illinois Department of Revenue requirements. Source: IRS – How long should I keep records?
- Secure disposal. 815 ILCS 530/40 requires reasonable disposal of materials containing personal information. Source: 815 ILCS 530.
- BIPA. No biometric data is collected, so BIPA's retention-schedule requirement (740 ILCS 14/15(a)) should not apply to the mailbox Service. Confirm, and confirm the separate biometric screening business has its own public retention schedule. Source: 740 ILCS 14.
- TCPA consent records. The TCPA private right of action has a 4-year limitations period (28 U.S.C. 1658); keep consent records at least that long after the last message.
- Apple account deletion. App Store Review Guideline 5.1.1(v) requires in-app account deletion and allows retention of data required by law if disclosed. Source: Apple App Review Guidelines.
- Provider-side retention. Confirm Supabase backup/PITR retention, Vercel log retention, Twilio message log retention, and Anthropic API data retention, and configure them to match this schedule.