MailVue

Data & Compliance

Effective: 2026-05-15 Last updated: 2026-05-15

This page describes how MailVue handles data and what compliance commitments we make to Stores and Customers using the platform.

Data we process

  • Account profiles (Store Operators, Staff, Customers)
  • USPS Form 1583 records and ID images
  • Mail-piece images, scans, sender data, tracking
  • Service requests and audit logs
  • Billing records and Stripe payment metadata
  • Messages between Stores and Customers

Hosting and infrastructure

MailVue runs on managed cloud infrastructure with US-based data residency. Data is encrypted in transit (TLS 1.2+) and at rest. Production access is limited to authorized personnel via role-based access controls and is audited.

Subprocessors

  • Cloud infrastructure providers — application hosting, database, and secure file storage (platform data)
  • Stripe — payment processing (billing email, transaction metadata)
  • Telnyx — SMS notifications when enabled by the Store (phone numbers, message content)
  • Google Cloud Vision — mail-piece OCR when enabled by the Store (mail-piece images)

We will give Stores reasonable notice of changes to subprocessors.

Retention

  • Mail-piece photos: auto-deleted 30 days after pickup (per Store configuration)
  • Form 1583 and ID images: retained at least 12 months after CMRA agreement termination per USPS regulations
  • Invoices / billing: retained per accounting and tax requirements (typically 7 years)
  • Audit logs: 12 months
  • Account records: while account is active; deleted on request subject to USPS retention obligations

Security commitments

  • TLS encryption for all traffic
  • At-rest encryption for stored data
  • Role-based access control with audit logging
  • Quarterly review of access permissions
  • Breach notification without unreasonable delay if affected users can be identified
  • Documented incident response procedures

Compliance posture

  • USPS / CMRA: the platform supports the operational requirements of USPS DMM 508 (CMRA rules), including Form 1583 capture and retention. Stores remain responsible for the regulatory compliance of their CMRA business.
  • GDPR: MailVue is US-based and not directed to EU residents. EU residents using a Store's services should contact us to discuss data subject rights.
  • CCPA and state privacy laws: California, Texas, Virginia, Colorado, and Connecticut residents may have specific rights regarding access, deletion, and opt-out — contact us to exercise them.
  • PCI: payment card data is handled exclusively by Stripe (PCI Level 1 service provider); MailVue never stores full card numbers.
  • HIPAA: MailVue is not a HIPAA Covered Entity or Business Associate. Do not use the platform to transmit Protected Health Information.

Data Processing Agreement

Stores requiring a DPA can request one — contact support@mailvueapp.com.

Contact

support@mailvueapp.com