FuturePosts Privacy Policy
Effective 23 September 2026. This policy replaces every earlier version.
In short
This summary is here to help you read the policy. The numbered sections below are the policy.
- We collect what we need to make and deliver your postcard: your email, a delivery address, and the photos, words and recordings you seal. Nothing more than that unless you give it to us.
- Your photos, message and recordings are encrypted when they reach us, and no one at FuturePosts looks inside a sealed capsule before its opening month, except to print your card, to examine a reported item under our Terms, or where the law requires it.
- We never sell your data, never share it for advertising, and never use your content to train anything.
- We keep your capsule until its opening month, and for a period after. We keep order records for as long as tax law requires. Everything else has the shorter periods in section 8.
- You can ask us at any time what we hold about you, to correct it, to delete it, or to receive a copy. Section 9 says how.
1. Who is responsible for your data
The controller of your personal data is the operator of FuturePosts, based in Romania. The registered name, registration number and registered office of the company that operates it will be stated here once its registration is complete. In this policy, “FuturePosts”, “we”, “us” and “our” mean that operator.
For anything about your data, write to hello@future-posts.com. We have not appointed a data protection officer.
This policy covers the website at future-posts.com, the postcard designer, your capsule pages and the pages for Premium Vault contributors. It also covers what we do with data about people who are not our customers but whose data reaches us through one: a gift recipient, someone in a photo, or a contributor to a Premium Vault.
2. What we collect, and where it comes from
From you, when you order
- Your email address. It is how we confirm your order, how we reach you about your capsule, and where the opening link goes.
- A name and a delivery address, for a printed postcard. If you order a Classic FuturePost as a gift, this is the recipient’s name and address, and it comes from you, not from them.
- Your order: the tier, the opening month, any extras, and the price paid.
- Limited payment details, but not your card number. Payment is taken by Stripe, which tells us details such as the card’s brand, its last four digits and the billing country, together with the tax that applied. We never see or store the full card number.
- The content you seal: your photos, the place and month of your postmark, your message, and, on the Vault tiers, your voice recording and extra photos. Section 6 explains how this is protected.
From a contributor, on a Premium Vault
- The name they sign with, an email address if they were invited by email, the time they contributed, and what they added: photos, recordings and messages. Contributions are sealed and protected exactly like the buyer’s own content.
From a buyer, about other people
- The guest list. A buyer may give us email addresses to invite. We use them to send the invitation the buyer asked for, and to record whether it was delivered and whether the person contributed. We do not use them for anything else, and we do not add them to any list of ours.
Created while you use the service
- Email records. For the emails we send you, we keep a record of which email it was, the address it went to, when, and whether it was delivered.
- Card scans. When the QR code on a printed Vault card is scanned and claimed, we record when, as our record that the card arrived.
- Sign-in records for your capsule pages.
- Records of requests we handle. If you ask us to recover access to a capsule, or we act on a report about content or on a legal order, we keep a record of the request and what we did.
- Technical records. Like every website, we record technical data such as the IP address, browser type and time of requests, to keep the service secure.
- The launch giveaway’s record. When the launch giveaway covers a capsule, we keep a record of the internet connection it was claimed from, so the giveaway stays one free capsule per connection.
- Your draft, on your own device. The postcard designer keeps your work in progress in your browser so that you can come back to it. That draft stays on your device and does not reach us unless you place the order, choose to save it with us, or ask us from the designer to tell you when a capsule is back.
- A draft you save with us. If you save your postcard to finish later, we keep the draft, its photos included, and the email address we send its link to. It is deleted when you place the order, when you save the same postcard again, or 30 days after you saved it.
- Notify me. If you ask us to tell you when a capsule is back, we keep your email address and which capsule you asked about. If you ask from the postcard designer, we also keep your postcard as designed so far, so that we can bring you back to it. When the capsule is back, we email you with a launch discount code, and we record whether the code was used and on which order.
- Counts of interest. We count how many people reach each step of the postcard designer and the order page, place an order, save a postcard, or ask to be notified. These are totals and nothing else: nothing that tells one visitor from another.
- How the service is used. With each order and capsule we keep a record of how it is used, such as where the visit came from, the kind of device and the country, and when the capsule is visited, added to or opened. It never includes what you write, record or upload.
From your correspondence
- Anything you write to hello@future-posts.com or abuse@future-posts.com, and our replies.
What we do not collect
- We do not collect anything from your device beyond what is listed here. We do not read your contacts, your location, or your other photos.
- We do not deliberately collect sensitive data such as health, religion or political opinion. A photo or a message may of course reveal such things about you or about someone else. We seal it exactly as we seal everything else and use it for nothing but your order.
3. Why we use your data, and the legal basis for each use
Data protection law requires us to have a legal basis for each thing we do with your data. This table sets them out.
| What we do | Data involved | Legal basis |
|---|---|---|
| Take, confirm and fulfil your order: seal your capsule, print and post your card, open your capsule in its month, send the emails that do this | Email, name, address, order, content | Performing our contract with you |
| Run a Premium Vault: invitations and contributions | Guest list, contributor names and content, sign-in records | Performing our contract with you and with each contributor; for the guest list, our legitimate interest in sending the invitations the buyer asked for |
| Take payment and keep tax records | Payment details, tax amounts, billing country | Performing the contract; our legal obligations under tax and accounting law |
| Check in with you while your capsule is unopened, so a changed address is caught in time | Performing the contract; our legitimate interest in the opening email reaching you | |
| Keep the service and your order secure: prevent fraud, abuse and unauthorised access, verify a recovery request, tell you when your order’s details change, and honour requests not to be emailed | Technical records, email records, records of requests we handle | Our legitimate interest in running a safe service; in part, our legal obligations |
| Keep the launch giveaway to one free capsule per internet connection | The launch giveaway’s record | Our legitimate interest in giving the free capsules out fairly |
| Act on a report about content, or on a valid legal order | The content concerned, the reporter’s details, records of requests we handle | Our legal obligations; our legitimate interest in keeping unlawful content off the service |
| Answer your questions and requests, including requests about your data | Correspondence, the data the request concerns | Performing the contract; our legal obligations under data protection law |
| Write to you about your FuturePost, for example to ask how it went, to check that your email still reaches you, or to remind you of something you started | Email, your order | Our legitimate interest in keeping in touch with our own customers about what they ordered; every such email lets you opt out, and we stop when you ask |
| Send you news about FuturePosts, if you subscribe | Your consent, which you can withdraw at any time from the link in every such email | |
| Tell you when a capsule you asked about is back, with a launch discount, and keep your postcard ready for you (Notify me) | Email, the capsule you asked about, the postcard saved with it, your launch code and whether it was used | Your consent, which you can withdraw at any time by replying to any of those emails |
| Learn how FuturePosts is found and used, to improve it and our marketing | Counts of interest, the record of how the service is used | Our legitimate interest in improving the service and knowing what brings people to it |
| Understand how the site is used, with analytics | Information about how the site is used | Our legitimate interest in knowing how the site is used, weighed against the small amount of data involved and your ability to turn it off (see our Cookie Policy) |
Where we rely on legitimate interest, we have weighed it against your rights, and you may object under section 9.
We do not make decisions about you by automated means that have a legal or similarly significant effect on you.
4. What we never do
- We never sell your data, and we never share it for advertising.
- We never use your content, or anyone’s, to train a model or to build a profile.
- We never put the contents of a capsule in an email. Our emails carry a link to your capsule and nothing more.
- No one at FuturePosts opens a capsule before its opening month, except to print your card, where the law requires it, or where a report under our Terms requires us to examine the reported item.
5. Who we share your data with
We share data only with the providers we need to run the service, and only what each one needs. They are:
- our hosting and storage providers;
- our payment provider, Stripe;
- our email provider;
- our analytics provider;
- our print partner, and the postal services that carry your card;
- our mailbox provider, for your correspondence with us.
Beyond these, we disclose personal data only where the law requires it: to comply with a valid legal order, to protect someone’s safety, or to enforce our Terms.
If FuturePosts were ever sold or merged, your data would pass to the new owner under this policy.
6. How your content is protected
- Your photos, message and recordings are encrypted when they reach us, and they stay encrypted until they are needed to print your card or to open your capsule in its opening month.
- Your email address, the delivery address and your order details are kept private, and everything in section 4 applies to them.
- Connections to our website and to your capsule are encrypted in transit.
- No system is perfectly secure. If a breach ever affects your data in a way that puts you at risk, we will tell you and the supervisory authority as the law requires.
7. Transfers outside the European Economic Area
Some of our providers may process data outside the European Economic Area. Where they do, it is protected by the safeguards the law requires, such as an adequacy decision or Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply to any transfer.
8. How long we keep your data
| Data | Kept for |
|---|---|
| Your sealed content and your capsule | Until your opening month, then one year after opening, or longer if you extend it under our Terms, then deleted. If you delete your capsule under section 9, or cancel an order under the Terms, it is deleted then. |
| Contributions to a Premium Vault | The same as the capsule they are in, unless erased earlier under section 9 |
| Your order, invoice and payment record | Five years, counted from 1 July of the year after the order, as Romanian accounting law requires; personal data not needed for that record is removed when the capsule is deleted |
| The guest list and invitation records | Until the capsule is deleted |
| Email records | Six months after the capsule is deleted |
| Addresses that cannot receive, or asked not to receive, our emails | As long as needed so that we do not write to them again |
| Sign-in records | A sign-in link until it is used or expires; a signed-in device 30 days from last use, and never more than 12 months |
| Records of requests we handle | Three years after the capsule is deleted |
| Technical records | Seven days |
| The record of how the service is used | As long as the order or capsule it belongs to; counts of interest are kept as totals |
| Correspondence with you | Three years after the last message |
| Your draft in the designer | On your own device only, for a limited time, or until you clear it or place the order |
| A draft you save with us | Until you place the order or save that postcard again, and never more than 30 days |
| Your Notify me request | Your email address and the capsule you asked about: until you ask us to delete them. The postcard saved with it: until 30 days after we tell you the capsule is back, or sooner if you ask us or order that postcard |
| Your launch code | Until 30 days after it expires, or, once used, as long as the order it was used for |
| The launch giveaway’s record | As long as the order it belongs to |
| Newsletter subscription | Until you unsubscribe |
| Analytics data | 14 months, then deleted; the analytics cookies on your device, up to 2 years or until you delete them |
When a period ends we delete the data or make it anonymous. Where the law requires us to keep a record longer, we keep only what it requires.
9. Your rights
You have the following rights over your personal data. They are free to exercise.
- Access: to be told what we hold about you and to receive a copy.
- Correction: to have inaccurate data corrected. You can change the email and the delivery address on your order yourself, from your capsule page.
- Deletion: to have your data deleted. You can delete a capsule before its opening month by writing to us; a printed order that has already been produced cannot be recalled from the post. Where we must keep an order record for tax law, we keep only that record.
- Restriction and objection: to have us pause a use of your data, or to object to a use based on our legitimate interest. We stop unless we have a compelling reason to continue, and we always stop direct marketing when asked.
- Portability: to receive the data you gave us in a machine-readable form, on request.
- Withdrawing consent: where we rely on your consent, you can withdraw it at any time, which does not affect what was done before.
- Not to be subject to automated decisions: we make none.
Erasing a contribution. A contributor may ask us to erase their own contribution, or content in which they appear, at any time, including while the capsule is sealed. Anyone who appears in someone else’s photo or recording may ask the same. Write to abuse@future-posts.com from the address you contributed with, or with the capsule link and enough detail for us to find the content and to know the request is yours.
How to ask. Write to hello@future-posts.com from the email address on your order, or, if you are not a customer, tell us who you are and what data you mean. We may ask you to confirm your identity before we act, to make sure we do not hand your data to someone else. We answer within one month, and we tell you if we need longer.
Complaining. If you are unhappy with how we handle your data, we would like to hear about it first. You also have the right to complain to a data protection supervisory authority, in particular in the country where you live or work.
10. People who are not our customers
Some of the data we hold is about people who did not order anything from us, and who may not know we hold it. We hold it because a customer gave it to us, and we use it for that customer’s order alone.
- Gift recipients. The buyer gives us your name and address so that a postcard can reach you. We use it to post the card. We do not write to you otherwise.
- People in a photo or recording. The person who sealed it is responsible for having your agreement. We hold it encrypted, as section 6 describes, and we do not analyse or identify anyone in it.
- Invited guests. The buyer gave us your email address so that we could send you their invitation. We send that invitation and nothing else, and we do not add you to any list.
- Contributors. Your name and what you added are held for the buyer’s capsule until its opening month and after, as section 8 says. Section 9 says how to erase it.
Everyone in this section has every right in section 9.
11. Cookies and storage on your device
- We use analytics to understand how the site is used. It does not run on capsule pages. Our Cookie Policy explains more.
- The postcard designer keeps your draft in your browser for a short time. It stays on your device unless you send it to us, as section 2 describes.
- Our payment provider sets the cookies it needs for a secure payment during checkout, and our hosting provider sets the ones it needs for security. Our Cookie Policy describes them.
12. Children
FuturePosts is not for anyone under 16, and we do not knowingly collect data from anyone under that age. If you are a parent or guardian and believe a child under 16 has given us data, write to hello@future-posts.com and we will delete it. Between 16 and 18, a person may use FuturePosts with the knowledge and consent of a parent or guardian.
13. Links to other sites
Our website may link to other sites. Their privacy practices are their own, and this policy does not cover them.
14. Changes to this policy
We may change this policy. The effective date is at the top. If a change affects your rights or what we do with your data in a significant way, we email you before it takes effect.
15. Contact
- Questions and requests about your data: hello@future-posts.com
- Reports about content, and erasure of a contribution: abuse@future-posts.com