Privacy policy

Last updated: 20 October 2026

Snailgram is run by AWS, CYY & Co. Pty Ltd (ACN 686 116 245) as trustee for Mumu, Lulu & Co. (ABN 54 837 123 965), in Melbourne, Australia ("we", "us"). This policy covers the Snailgram website, card studio and ordering service. It explains what personal information we collect, why we collect it, who we share it with and how long we keep it.

We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. If you're in the EU, EEA or UK, section 14 explains your extra rights. This policy is a notice. It isn't part of our terms and conditions or any contract.

1. The short version

• We use your card's details only to make it, post it and look after your order.
• We never contact the person you're sending to and never add them to a list.
• We never sell your data and never send marketing emails.
• We never use your message, your cover sentence or your handwriting to train AI models.
• We delete your message once your card is posted, and the recipient's name and street address soon after.

2. Information we collect

When you design and order a card:

• the sentence you describe your cover with, the covers made from it, and the one you choose,
• your message and sign-off,
• the recipient's name and postal address, and the date the card should arrive,
• your name, postal address and email address, and
• if you choose to have the pen write in your own hand, a photo of your handwriting sample.

Automatically, when you visit:

• your IP address, browser and device details, and the pages you request, in our server and security logs,
• how you use the site, through Google Analytics on snailgram.com.au, and
• where you came from, such as a referring site or the campaign tags in a link or ad.

When you contact us: your email address and what you write to us.

When you use the help chat: the questions you ask. They're answered as you ask them and not kept (see section 9), so please don't type addresses or payment details into it.

Payments are processed by Square. Square collects your card or wallet details directly. We never see or store your full card number. We receive a payment reference, the amount, and the card type and last four digits.

Without the recipient's name and address and your email address, we can't make or post your card.

3. Information we don't collect

• You don't need an account or a password to order.
• We don't ask for government ID or your date of birth.
• We don't use social media tracking pixels.
• We don't collect the recipient's email address or phone number.

4. How we use your information

• to make your covers, write your message and post your card in time for your date,
• to take payment, issue receipts and handle refunds and chargebacks,
• to email you about your order, such as confirmation, posting and any problem with it,
• to answer your questions and resolve complaints,
• to prevent fraud and misuse, including enforcing what can't be sent under our terms, and to keep the site secure,
• to understand how the site is used and measure our advertising, so we can improve it, and
• to meet our legal obligations, such as tax record-keeping.

We don't use your message, cover sentence or handwriting for marketing or profiling. We won't show your card or quote your words in our marketing unless you give us permission.

5. The person you're writing to

When you give us someone's name and address, you confirm that you're allowed to share it with us so we can post them a card. We use it only to post the card and handle any problem with its delivery. We never contact them, and the card is from you, not from us.

Your message may include personal or sensitive details. Our team handles it only to make and post your card.

6. Your message, cover and handwriting

• Everything is encrypted in transit (TLS) and at rest, and stored with Amazon Web Services in Sydney, Australia.
• Our team sees your card only to write, check, pack and post it. Otherwise, we access it only when the law requires it or to fix a problem you've raised.
• Your cover is made from your sentence alone. We don't send your name, message or addresses to make it.
• Your handwriting sample is used only to teach the pen your hand, and your hand is used only for cards you order. We never use it for anyone else's card.

7. Who we share information with

We share only what each provider needs to do its job:

• Amazon Web Services Australia hosts the site, stores our data in Sydney, delivers the website (CloudFront), sends order emails (SES), suggests addresses as you type them (Amazon Location Service), makes covers from your sentence and answers the help chat (Bedrock, hosted in Australia).
• Australia Post carries and delivers your card. It sees the recipient's name and address on the envelope.
• Square AU Pty Ltd processes card and wallet payments and refunds, and issues tax invoices.
• Fastmail Pty Ltd hosts our snailgram.com.au mailboxes, so it holds emails you send us.
• Google Australia provides Google Analytics, which measures how the site is used. It never receives your message, addresses, email address or payment details. Google Fonts serves the site's typefaces, so Google receives your IP address when pages load.
• Discord Inc. notifies our team when an order is paid. These notifications never include names, addresses, emails or messages.

Our providers must keep your information confidential and use it only to provide their service to us. We remain responsible for how they handle it. If we add or change a provider that receives personal information, we'll update this section first.

We may also disclose information when the law requires it, to prevent serious harm or fraud, or to a buyer or successor if our business is sold or restructured.

8. Overseas disclosure

We store your information in Australia. Some providers may access or process it from overseas:

• the United States, for email hosting support, payment processing and hosting support, and for Discord notifications (which contain no personal details),
• the United States and other countries where Google runs data centres, for analytics and fonts.

9. How long we keep it

• Your message: deleted once your card is posted.
• The recipient's name and street address: removed 14 days after delivery is recorded, or 60 days after posting if it isn't. We keep the suburb, state and postcode longer, to understand where cards go.
• Covers and cover sentences: covers you didn't choose are deleted within 14 days. The cover you chose is deleted 60 days after posting, in case you need it reprinted.
• Your handwriting sample: the photo is deleted once the pen has learned your hand. The learned hand is kept so you can use it again, and deleted 12 months after your last card or sooner if you ask.
• Your return address: removed at the same time as the recipient's name and street address.
• Saved cards that aren't posted: the message, both addresses, the cover and your handwriting photo are deleted 60 days after you save the card.
• Designs you don't save: stay only in your browser (see section 10), never on our servers.
• Other order details, such as dates and status: up to 18 months.
• Your email address: kept with your order reference so we can help with past orders, until you ask us to delete it.
• Support emails: as long as we need them to resolve the matter.
• Help chat questions and answers: not stored on our servers or in our logs. The conversation stays in your browser tab (see section 10).
• Server and security logs: 90 days.
• Payment and transaction records: about seven years, as tax law requires.

10. What's stored in your browser

• Google Analytics cookies (_ga and _ga_*), on snailgram.com.au only. You can block them in your browser settings or with Google's opt-out browser add-on.
• The card you're designing, so you can pick up where you left off.
• Your handwriting photo, until you remove it or order.
• Your language choice.
• Your help chat conversation, until you close the tab.

These stay on your device until you order. Clearing this site's data in your browser removes all of them.

11. Security

• Data is encrypted at rest with AES-256 and in transit with TLS. The site is HTTPS only.
• Only people who need it to make, post or support your card can see it, and access is limited to what they need.
• If a data breach is likely to cause serious harm, we'll tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

You can report a security issue under our responsible disclosure policy.

12. Seeing, correcting or deleting your information

You can ask for a copy of the personal information we hold about you, or ask us to correct or delete it, by emailing support@snailgram.com.au with "Privacy request" in the subject line. We may need to confirm who you are first. We'll reply within 30 days, at no charge. If we refuse, we'll explain why in writing.

Once a card is posted, we can't change it. Information we've already deleted can't be recovered.

13. Automated checks

We run routine automated checks, such as confirming that an address is complete and its suburb, state and postcode match, that an email address is valid, and that the site isn't being misused. We don't make automated decisions that have legal or similarly significant effects on you. A person reviews any order we decline.

14. People in the EU, EEA or UK

If the GDPR or UK GDPR applies to you, the controller is AWS, CYY & Co. Pty Ltd as trustee for Mumu, Lulu & Co. We rely on these legal bases:

• contract: to make and post the card you ordered,
• legitimate interests: to keep the site secure, prevent fraud and improve the service, and
• legal obligation: to keep tax records.

You can ask to access, correct, erase, restrict or move your data, or object to how we use it. Email support@snailgram.com.au with "GDPR data request" in the subject line, and we'll reply within one month. We can't erase records the law requires us to keep. You can also complain to your local data protection authority.

15. Marketing

We don't send marketing emails. We email you only about your order or when you've contacted us.

16. Children

Snailgram isn't for people under 18. If you think a child has given us their information, contact us and we'll delete it.

17. Changes to this policy

When we update this policy, we'll change the date at the top of this page. If we make an important change, we'll summarise it on the site. You can ask us for earlier versions.

18. Contact and complaints

Email support@snailgram.com.au, or write to PO Box 169, South Melbourne VIC 3205, Australia. We'll acknowledge your complaint within one business day and aim to resolve it within 30 days.

If you're not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, on 1300 363 992, or by post to GPO Box 5288, Sydney NSW 2001.