Privacy Policy

Last updated: May 7, 2026

Who We Are

Friendly City Custom Printing ("FCCP," "we," or "us") operates the Main Street Mail service. We are a custom print shop helping customers handle the postal side of their events — weddings, holiday cards, invitations, and more.

When you submit your address through a guest form, you are sharing it with both the customer who invited you (e.g., the couple getting married) and FCCP as the service provider.

What Data We Collect

When you fill out an address collection form, we collect:

  • Your full name and any honorifics or titles you provide
  • Your mailing address (street, city, state, ZIP code)
  • Optionally: your email address and/or phone number, if the customer's form includes those fields
  • Event information related to the invitation (e.g., wedding name, event date)
  • Technical data: IP address, browser type, and user agent — captured automatically for fraud prevention and security purposes

How We Use Your Data

Your information is used only for:

  • Printing addressed mail pieces for the event you were invited to
  • Communicating with you only if the customer who invited you asks us to send reminders or updates
  • Transactional emails: confirmation that we received your address, and notification if the customer makes changes to their project
  • Security and fraud prevention (IP address, browser info)

We do not sell your personal information to advertisers or third parties. We do not use your data for any purpose unrelated to the event you were invited to.

Data Sharing

We share your data only with:

  • The customer who invited you — they receive your address to send you mail
  • Our email provider (Resend) — only for transactional emails we send on the customer's behalf
  • Address validation providers (Google Maps Platform) — only if the customer opts into paid validation; validation happens in batch after the customer signs off, not per submission
  • Our infrastructure providers (Supabase for database, Vercel for hosting) — bound by strict data processing agreements

We do not share your information with data brokers, advertisers, or any party not listed above.

Data Retention

We keep your data only as long as we need it:

  • While your event is active and the customer maintains an active account
  • Submissions audit log (raw form data, IP, user agent): retained for 90 days, then IP and user agent are scrubbed
  • Contacts on a customer's master list are retained indefinitely unless you request deletion
  • If you are a one-time guest with no ongoing relationship, your data is retained for 12 months, then deleted
  • If a contact is deleted at a customer's request or your own request, it is soft-deleted for 90 days before permanent removal

Cookies

Main Street Mail uses minimal cookies — only for essential functionality and basic analytics. We do not use advertising cookies or tracking cookies. If we use any analytics tools in the future, we will update this policy and obtain consent where required.

Your Rights

You have the right to:

  • Access — request a copy of the personal data we hold about you
  • Correct — ask us to fix inaccurate or incomplete information
  • Delete — request that we remove your data from our systems
  • Object — ask us to stop processing your data for certain purposes

To exercise any of these rights, email us at privacy@friendlycityprintshop.com. We will respond within 7 business days.

Children's Privacy

We do not knowingly collect personal information from children under 13. If you are a parent and believe we have collected information about your child without your consent, please contact us and we will promptly delete it. Note: children's names listed on an adult's envelope submission (e.g., "The Smith Family — Lily, 8, and Max, 5") are not considered individually collected data under COPPA.

International Data Transfers

If you are located in the EU, UK, or other jurisdictions with data protection laws, please note that your data is processed in the United States where FCCP operates. We take appropriate safeguards to ensure your data is handled in accordance with applicable law, regardless of where you are located.

Data Security

All data is encrypted in transit (HTTPS only) and at rest (Supabase managed encryption). Access to our systems is restricted to authorized personnel only. In the unlikely event of a data breach, we will notify affected customers within 72 hours and follow all applicable state and federal breach notification requirements.

Do Not Sell My Personal Information

We do not sell your personal information. California residents (and residents of other states with similar laws) have the right to request information about whether we sell your data — we do not, and we never will. This right is honored through our general deletion process described above.

Changes to This Policy

We may update this privacy policy from time to time. If we make material changes, we will notify customers via email and update the "Last updated" date at the top of this page. For significant changes, we will provide additional notice before the changes take effect.

Contact Us

If you have questions about this privacy policy, want to exercise your rights, or have concerns about how your data is handled, please contact us:

For data deletion requests, you can also use our dedicated deletion request form.