Privacy Policy

1. Information we collect

Information you give us. When you sign up, contact support at support@hollerpost.com, or otherwise talk to us, you may give us your name, email address, phone number, business name and mailing address, billing details, and the contents of your messages.

Information collected automatically. When you use the Site or the Service, we may collect your IP address, browser type, operating system, referring URLs, pages viewed, and the dates and times of your visits. We use cookies and similar technologies to do this (see section 4).

Product usage. When you’re signed in, we record which parts of Hollerpost you use (for example, opening the campaign editor or the Reports page), with your account and workspace IDs and the time. We use this only to improve Hollerpost and to help you get set up. It stays in our own database, isn’t shared or sold, and is deleted after 13 months.

Payment information. Payments are processed by Stripe. We don’t store your full card number.

2. How we use your information

• To provide the Service: to set up and run your account, send your campaigns, and bill you.
• To communicate with you: to answer questions, help with setup, and tell you about your account, like usage, plan, and billing notices.
• To improve the Site and Service: to understand how people use them and fix what’s confusing.
• For marketing: to send you emails about Hollerpost. You can opt out at any time with the unsubscribe link.
• To keep the Service safe: to prevent spam, fraud, and abuse that would hurt other customers’ deliverability.

3. How we share your information

We do not sell your personal information. We share it only in these limited cases:

• With service providers who help us run the business. They may only use your information to provide their service to us, and they are required to protect it. The full list is in section 3a.
• For legal reasons, if required by law or a valid request from a public authority, such as a court or government agency.
• In a business transfer, if Utopian Creations LLC is involved in a merger, acquisition, or asset sale.

3a. Who we work with (sub-processors)

These are the companies that handle data on our behalf. We’ll update this list when it changes.

Provider	What they do for us	Where
Cloudflare	Hosts hollerpost.com, app.hollerpost.com and our API, protects against attacks, and runs privacy-friendly page analytics (no cookies)	United States, global edge
Supabase	Database and sign-in for the Service (your account, workspaces, contacts, campaigns)	United States
Amazon Web Services (SES)	Delivers the emails you send and reports bounces and complaints	United States
Telnyx	Delivers text messages and handles STOP replies	United States
Stripe	Payments, invoices, and the billing portal	United States
Microsoft (Advertising and Clarity)	Measures whether our ads lead to visits and signups (on hollerpost.com and in the app), and records anonymised session replays on hollerpost.com only, so we can see where the site is confusing. The app blocks session replays.	United States
HeyCatch	Measures which pages and channels lead to visits and signups on hollerpost.com, and in the app records sign-ups and plan changes for your account (your user ID, email address, name and plan).	United States
AI providers (Helios, DeepSeek, Groq)	The AI writer, the AI designer and the support chat run first on Helios, a server we own. If it’s busy or offline, the request goes to DeepSeek or Groq instead. They receive the prompt and the draft, and for the support chat a short summary of your account (plan, usage, recent campaign names). We never send your contact list.	United States (Helios, Groq); China (DeepSeek)
Google Fonts	Serves the typefaces on hollerpost.com and in the app, and in emails that use a Google font; the reader’s browser or email app requests them directly from Google	Global
CJ (Commission Junction)	Only if you click one of our affiliate help links (Namecheap, Google Workspace): credits the referral. We share no account data with them.	United States
Zapier (optional)	Only if you connect it: moves data between Hollerpost and your other tools on your instruction	United States

If you connect your own AI assistant to Hollerpost through our MCP server, that assistant and its provider are your choice and your responsibility; we only see the API calls it makes.

4. Cookies and tracking

The Site uses a small number of cookies:

• Referral cookie (hp_ref). If you arrive from a referral link, we store the referral code for 60 days so the person who referred you gets credit when you sign up.
• Microsoft Advertising (UET). We use Microsoft’s Universal Event Tracking on hollerpost.com and in the app to measure whether our ads lead to visits and signups.
• Microsoft Clarity. Loaded with UET on hollerpost.com only. It records how visitors move through the public site (clicks, scrolls, page paths) as anonymised session replays, and masks text you type. The app blocks it, so nothing inside your account (contacts, campaigns, settings) is ever recorded.
• Cloudflare Web Analytics. Page-view counts with no cookies and no cross-site tracking.
• HeyCatch. On hollerpost.com and in the app. It measures which pages and channels (a social post, an ad, or a short link like hollerpost.com/x) lead to visits and signups. It records page views, clicks, the page you came from and the campaign tags in the link, under a random visitor ID kept in a cookie and in your browser’s local storage. In the app it also ties that visit to your account (user ID, email address, name and plan) and records when you sign up, connect your domain, send your first campaign, or start, change or cancel a plan.
• Affiliate links. A few help links (Namecheap for domains, Google Workspace for inboxes) are affiliate links through CJ (Commission Junction). If you click one, CJ may set its own cookie so the referral is credited. We don’t share your account data with them.
• Sign-in session. The app keeps you signed in with a session token stored in your browser. It is strictly necessary and expires when you sign out.

We honor the Global Privacy Control (GPC) signal on hollerpost.com and in the app: if your browser sends it, we don’t load Microsoft Advertising or Clarity, we don’t start HeyCatch, and the app doesn’t record product usage.

You can set your browser to refuse cookies or to tell you when one is being sent. The Site works without them.

5. Data security

We use reasonable security measures to protect your information from unauthorized access, use, or disclosure. No method of sending or storing data over the internet is 100% secure, and we can’t guarantee absolute security.

5a. How long we keep data

• Your account and workspace (contacts, campaigns, forms, stats): for as long as your account is open. When you delete your workspace or ask us to, we delete it within 30 days, except what we must keep for the reasons below.
• Bounces and spam complaints: kept indefinitely as the address and the reason, so no Hollerpost customer keeps mailing an address that doesn’t exist or that reported spam.
• Unsubscribes and STOP replies: kept for as long as the workspace exists, because the law requires honoring them, and deleted with it.
• Send logs (who was sent what, when, and whether it was delivered or opened): for as long as your account is open, so your reports, stats and engagement filters keep working. They’re deleted with your workspace.
• Billing records: 7 years, as tax law requires.
• Support conversations: 2 years after the last message, then deleted automatically.
• Security records (signup network checks, which keep a hashed network address, and our support agent’s action log): 1 year, then deleted automatically.
• Your login: until you delete it, or 30 days after the last workspace you belong to is deleted.
• Product usage (which parts of Hollerpost you use, see section 1): 13 months, then deleted automatically.
• Site analytics and session replays: Microsoft keeps Clarity recordings for 30 days; UET data per Microsoft’s retention.
• Backups: encrypted database backups roll off within 30 days of deletion.

5b. Deleting your account and getting your data

In the app, go to Settings, then Your data. Export my data downloads your contacts and your send history as CSV files, and everything else (campaigns, drafts, surveys and answers, forms and submissions, saved designs, automations, unsubscribes and your workspace settings) as one JSON file, any time. Delete workspace asks you to type the workspace name to confirm, then right away cancels scheduled campaigns, cancels your plan, turns off your API keys and stops all sending. Everything in the workspace is permanently deleted 30 days later; until then you can email us to restore it. Delete my login removes just you: you leave the workspace and your login is deleted right away, while the workspace stays for the others in it. (The last admin of a workspace deletes the workspace instead, and their login goes with it.) Developers can export and delete with GET /api/v1/account/export and DELETE /api/v1/account.

You can also email support@hollerpost.com from the address on the account and we’ll do it for you; we confirm within 2 business days and finish deletion within 30 days.

6. Your privacy rights (California residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you these rights:

• The right to know what personal information we collect about you.
• The right to request deletion of your personal information.
• The right to opt out of the sale of personal information. (We don’t sell personal information.)
• The right to non-discrimination for exercising your CCPA rights.

To exercise these rights, email support@hollerpost.com. We’ll verify the request against the email on the account and respond within 45 days. If you live somewhere else with similar rights (for example the EU or UK), the same process applies.

6a. Where your data lives

We run in the United States. If you use Hollerpost from elsewhere, your information is transferred to and stored in the United States.

7. Data we process for our customers

Businesses that use Hollerpost upload their own subscriber lists (names, email addresses, phone numbers, and tags) to their private workspace. For that data, the business is the data controller and we act as a processor: we store and transmit it only to deliver the campaigns the business sends, we keep each workspace isolated so no other customer can see it, and we honor unsubscribe, bounce, and complaint signals automatically through a platform-wide suppression list. We do not sell, rent, or use our customers’ subscriber lists for our own marketing.

If you got an email or text from a business that uses Hollerpost, that business controls your information. Use the unsubscribe link in the email, or reply STOP to a text, and you won’t hear from them through Hollerpost again.

8. Text messages

Our own texts (Hollerpost Updates). If you sign up on our text sign-up page, we collect your mobile number, your first name if you give it, the date and time of your consent and where you gave it, and whether you’ve opted out. We use this only to send you Hollerpost Updates (product news, tips and offers from Hollerpost) and to honor your opt-out. Signing up is optional and is not a condition of any purchase. Message frequency varies. Message and data rates may apply. Reply STOP to any text to opt out, or HELP for help.

Texts businesses send through Hollerpost. When a business sends texts through Hollerpost, we store the phone numbers, consent records, and message history needed to deliver those texts and honor opt-outs. Reply STOP to a business’s text to stop hearing from that business.

Your mobile information. No mobile information will be sold or shared with third parties for promotional or marketing purposes. Text message opt-in data and consent are not shared with any third parties or affiliates, except the messaging providers that deliver the messages (see section 3a).

9. Third-party links

The Site may link to websites we don’t operate. We have no control over, and aren’t responsible for, their content or privacy practices.

10. Children’s privacy

Hollerpost is not directed to anyone under 13, and we don’t knowingly collect personal information from children under 13.

11. Changes to this policy

We may update this policy from time to time. When we do, we’ll post the new version here and update the date at the top. For changes that affect how we use your data, we’ll also email account holders at least 14 days before they take effect.

Change log: November 3, 2026, we record which parts of Hollerpost signed-in customers use, in our own database, for 13 months. October 28, 2026, the sub-processor list names each AI provider and where it runs, adds email fonts and CJ; the export covers the whole workspace; you can delete your own login; retention for security records, and bounces kept as address and reason (an earlier version said hashed, which was wrong). October 27, 2026, HeyCatch analytics on hollerpost.com and in the app; the app blocks Microsoft Clarity and no longer loads Google Analytics. October 26, 2026, section 8 covers Hollerpost Updates, our own text program. October 8, 2026, send logs are kept while your account is open instead of 13 months. October 7, 2026, in-app data export and workspace deletion. October 6, 2026, added the sub-processor list, retention periods, deletion process, GPC, and Clarity disclosure. September 28, 2026, first version.

12. Contact us

Questions about this policy? Email support@hollerpost.com.

Hollerpost is a service of Utopian Creations LLC.