Privacy Policy

Scribe Privacy and Data Handling Policy

Effective Date: Sep 1, 2026

Scribe Letters, Inc., a Delaware corporation doing business as Scribe Handwritten, Scribe Nurture, and Scribe (“Scribe,” “we,” “us,” or “our”), provides this Privacy and Data Handling Policy to explain how we collect, use, protect, retain, and disclose information in connection with our website, our Scribe Nurture software platform (the “Platform”), and our handwritten direct mail production and fulfillment services (together, the “Services”). This policy supersedes and replaces our prior Privacy Policy dated October 25, 2024, our prior Scribe Nurture Privacy Policy dated March 5, 2026, and our prior PII Handling Policy and Procedures dated November 1, 2025. Where any of those prior policies remains posted, this policy controls.

Scribe currently serves customers located in the United States only. This policy is incorporated by reference into our Terms and Conditions.

Two Categories of Data, Two Roles

This policy covers two different categories of information, and Scribe’s role differs for each. Reading the correct part for your situation will tell you how your information is handled.

Information about you. When you visit our website, create an account, or use the Platform as a client, we collect information about you as an account holder and user. For that information, Scribe acts as the party that determines how the data is used. Part One governs this category.

Recipient data you provide to us. When you upload or sync a mailing list so we can produce and mail your handwritten pieces, that list contains personal information about your recipients. For that information, Scribe acts as a service provider that processes the data on your documented instructions and for no independent purpose of our own. Part Two governs this category.

PART ONE: INFORMATION ABOUT PLATFORM USERS AND CLIENTS

1. Information We Collect

Information You Provide

We collect information you give us directly, including your name, business name, email address, phone number, mailing address, account credentials, and the content of communications you send to us. If you enroll in a paid plan or pay-as-you-go billing, our payment processor collects your payment card information. Payments are processed through Stripe. Scribe does not store your full payment card details.

Information Collected Automatically

When you access our website or the Platform, we may automatically collect information about your device, browser type, IP address, pages viewed, and usage patterns through cookies and similar technologies, as described in the Cookies and Tracking Technologies section below.

Information From Third Parties

We may receive information about you from third parties that support our Services, such as our payment processor, analytics providers, and any CRM platform you connect to your account through an integration.

2. How We Use Information

To provide, maintain, secure, and improve the Services, including your account and the Platform.
To process payments and administer subscriptions, invoices, and pay-as-you-go billing.
To communicate with you about your account, orders, support requests, and service changes.
To send marketing communications where you have consented, from which you may opt out at any time.
To comply with law, respond to lawful requests, prevent fraud, and protect the rights, property, and safety of Scribe, our clients, and others.

3. How We Share Information

Service providers. We share information with trusted third parties that help us deliver the Services, such as hosting providers, analytics partners, and our payment processor. These providers are bound by contract to keep information secure and to use it only to perform services for us.

Legal requirements. We may disclose information if required by law or in response to valid requests by public authorities.

Business transfers. In connection with a merger, acquisition, financing, or sale of assets, information may be transferred as part of the transaction. We will provide notice if your information becomes subject to a different privacy policy.

We do not sell your personal information, and we do not sell client contact data or recipient data to third parties.

4. Cookies, Analytics, and Tracking Technologies

We use cookies and similar technologies to operate the Platform and our website, keep you signed in, remember your preferences, and understand how the Services are used. You can manage cookie preferences through your browser settings, though disabling certain cookies may affect the functionality of the Services.

Cookies We Set on the Platform

XSRF-TOKEN: a security cookie that helps prevent cross-site request forgery attacks. It is required for the Platform to function.
Session cookie: maintains your login session while you use the Platform.
Remember Me cookie: set when you choose “Remember Me” at login, allowing you to stay signed in across browser sessions.
UI preference cookies: remember whether you have completed onboarding tooltips and guided tours within the Platform. These expire after 30 days.

Third-party libraries used by the Services may also set their own cookies.

Website Analytics

On our website we use Google Analytics to understand how visitors interact with our pages. Google Analytics uses cookies and similar technologies to collect data such as pages visited, time on site, and general geographic location. This data is used in aggregate. You can opt out of Google Analytics collection using the Google Analytics Opt-out Browser Add-on.

5. Marketing Communications

With your consent, we may send you promotional messages, newsletters, and other communications. You can opt out at any time by following the unsubscribe instructions in each communication or by contacting us. Consent to receive marketing is never a condition of purchasing the Services.

6. SMS and Text Messaging

If you opt in to receive text messages from Scribe, this section describes how we handle information in connection with that program.

Purpose. We use your information to send text messages and respond to your inquiries, which may involve sharing information with messaging platform providers and carriers that help deliver messages.
Protection. We do not sell, rent, trade, or otherwise transfer for profit any phone numbers or customer information collected through the SMS program. Text messaging opt-in and consent information is never shared with third parties or affiliates for their marketing purposes.
Consent. Consent to receive automated marketing text messages is not a condition of any purchase.
Opt out. You can stop messages at any time by replying STOP, END, CANCEL, UNSUBSCRIBE, or QUIT to any message.

7. Data Security

We implement technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. No internet based service is completely secure, so we cannot guarantee absolute security.

8. Retention of Account and User Data

We retain account and user information for as long as your account is active and as needed to provide the Services, and afterward as required to meet legal, tax, accounting, and dispute resolution obligations. Retention of recipient mailing data is governed separately by Part Two. Where the two categories overlap in your account, the recipient data terms in Part Two control for that data.

9. Your Privacy Rights and Choices

Subject to applicable law, you may request to access, correct, update, or delete the personal information we hold about you as a user, and you may opt out of marketing communications. To exercise these rights, contact us using the details in the Contact section. We may need to verify your identity before acting on a request.

If your request concerns recipient data you uploaded, see Part Two, which explains how deletion requests for mailing lists are handled and the timeline that applies.

10. California Privacy Rights

This section applies to California residents whose personal information we handle as a business under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”). It applies to information about you as a website visitor, account holder, or Platform user. It does not apply to recipient data you upload, which is addressed below.

Subject to the CCPA and verification of your identity, California residents may request to know the categories and specific pieces of personal information we have collected, request deletion of personal information, request correction of inaccurate personal information, and opt out of any sale or sharing of personal information. We do not sell or share personal information as those terms are defined by the CCPA. You will not be discriminated against for exercising these rights. To submit a request, use the details in the Contact section.

Recipient data and California residents. For personal information contained in a client’s uploaded mailing list, Scribe acts as a service provider and processes that information only on the client’s instructions. A California resident who is a mail recipient and who wishes to exercise CCPA rights should direct the request to the business that collected the data, which is the Scribe client that provided the list. If we receive such a request directly, we will refer the resident to the applicable client where we are able to identify it, and we will assist that client as the CCPA requires of a service provider.

11. Children’s Privacy

The Services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. Our Platform is intended for business users who are at least 18 years old, as stated in our Terms and Conditions. If you believe a child under 13 has provided us with personal information, contact us using the details in the Contact section and we will promptly delete it.

PART TWO: RECIPIENT DATA YOU PROVIDE TO US

This part describes how Scribe handles the personal information contained in the mailing lists and recipient records that clients provide for production and fulfillment of handwritten mail (“recipient data”). For recipient data, Scribe acts as a service provider that processes the data solely to perform the Services on the client’s documented instructions. This part applies to all employees, contractors, vendors, and systems involved in list processing, production, storage, or fulfillment.

12. Scope and Our Role

Recipient data includes recipient names, mailing addresses, and any other contact records a client supplies for a mailing. Scribe uses recipient data only to produce, address, and mail the client’s pieces, and for no independent purpose of our own. Recipient data is available only within the discrete account of the client that provided it. Scribe does not combine, cross reference, or use one client’s recipient data for the benefit of any other client or for any other client’s mailings.

13. Collection and Intake

Recipient data is collected only to produce and fulfill handwritten mail. The primary and preferred intake channel is secure upload through the Scribe Platform or an authorized CRM integration. Where secure upload is not available for a given engagement, recipient data may be received through an encrypted Google Workspace email or another secure, access controlled channel approved by leadership. Recipient data must never be sent or received through personal email, consumer messaging apps, or unapproved systems.

14. Access Control

Access to recipient data is restricted to authorized personnel whose job function requires it, such as production staff, account managers, and fulfillment specialists.
All systems that hold recipient data require authenticated login with company approved credentials.
Recipient data is never shared through personal email, messaging apps, or unauthorized systems.

15. Storage

Recipient data is stored only in secure, access controlled environments approved by leadership, and within the discrete account of the client that provided it. Recipient data must not be stored on personal devices, USB drives, local hard drives, or in printed form outside of controlled production use.

16. Retention and Deletion

Scribe retains a client’s recipient data within that client’s account so it remains available for the client’s future mailings, merge and purge against the client’s own new lists, and account continuity. Recipient data is retained on this basis until the client requests deletion. Retained data is used only for that same client and only within that client’s account.

Deletion on request. A client may request deletion of recipient data at any time. On receipt of a written deletion request, Scribe will delete the specified recipient data from the client’s account within thirty (30) days, subject to any records we are required to retain by law. Electronic recipient data is deleted using secure deletion protocols.

17. Use and Production

Authorized staff may clean lists, for example to remove duplicates and format addresses, and may split lists per client instructions, for example for matched weekly sends.
Recipient data may be temporarily printed on controlled access sheets used for envelope handwriting. Printed sheets must be secured at all times and limited to production areas.
Recipient data is used solely to address and prepare the client’s mailers. For bulk shipments to a client or partner, recipient data may be referenced only for packing accuracy.

18. Transmission to Third Parties

Any transmission of recipient data to a third party, such as a printer or logistics provider, must be approved by leadership, must occur only through encrypted or secure file transfer, and must be limited to the minimum data essential for the task. Scribe does not sell, distribute, or share recipient data with non essential parties.

19. Physical Security

Production and fulfillment areas remain supervised and access controlled at all times. Printed address sheets are stored securely until they are destroyed, and recipient data does not leave the premises except as authorized for fulfillment.

20. Destruction

Electronic recipient data is permanently deleted using secure deletion protocols on deletion request or at the end of any applicable retention obligation. Printed address references, test prints, and production sheets are collected in secure bins and cross shredded at the end of each production cycle.

21. Client Responsibilities

Provide accurate and lawful recipient data, and hold all rights and authorizations needed to share that data with Scribe for mailing.
Ensure the data does not violate any applicable law or third party agreement.
Notify Scribe if retention or destruction timelines for a given engagement should differ from this policy.
Respond to and resolve privacy rights requests from the client’s own recipients, since the client is the business that collected the data.

PART THREE: PROVISIONS APPLICABLE TO ALL DATA

22. Incident and Breach Notification

Any suspected or confirmed exposure of personal information, including unauthorized access, lost or misplaced data, mis mailed letters, or a system breach, must be reported immediately to the Director of Operations and documented in the internal incident log. Where an incident involves a client’s recipient data or account information, Scribe will notify the affected client within forty eight (48) hours of Scribe’s discovery or confirmation of the incident, and will cooperate with the client on any notifications the law requires.

23. Training and Compliance

All personnel who handle personal information must complete initial privacy and security training, quarterly refreshers, and an acknowledgment of compliance with this policy. Non compliance may result in disciplinary action up to and including termination. Scribe reviews this policy at least annually and more frequently as regulations and operations evolve.

24. Changes to This Policy

Scribe may update this policy from time to time. When we make material changes, we will update the effective date above and provide notice by email and in app or on site notice at least fourteen (14) days before the changes take effect. Changes apply prospectively. Continued use of the Services after the effective date of a change constitutes acceptance of the updated policy.

25. Contact

If you have questions about this policy or wish to exercise a privacy right, contact us at:

Scribe Letters, Inc.

1209 Tyler Street NE, Minneapolis, MN 55413

Email: [email protected]

Phone: 952-522-4880

Platform: scribenurture.com Company site: scribehandwritten.com

This policy is posted at: https://scribenurture.com/privacy