Privacy Policy

Grateful (“we,” “us,” “our,” or “Company”) is a web application developed and operated by SquiFi LLC, a Florida single-member LLC. Our service helps users create, customize, and send personalized, AI-generated, physically handwritten thank you notes to recipients after life events such as weddings, bar mitzvahs, baby showers, and graduations.

This Privacy Policy explains:

• What information we collect
• How we use that information
• How we share that information with third parties
• Your rights and choices regarding your information
• How we protect your data
• How to contact us with questions or concerns

This Privacy Policy applies to our website at sendgrateful.com and all services related to Grateful. By accessing or using Grateful, you agree to the terms of this Privacy Policy.

We collect information in several ways: directly from you when you use Grateful, automatically as you interact with our services, and from third parties.

2.1 Account Information

When you create an account or use Grateful, we collect:

• Name– your full name as provided during account creation
• Email address– for account access, password recovery, and communications
• Profile information– including an optional avatar or profile picture
• Authentication data– when you sign in via Google OAuth or other authentication methods

2.2 Recipient Information

When you create a batch of thank you notes, you upload information about the people who will receive the notes. We collect:

• Recipient full name (first and last)
• Mailing address (street address, city, state, zip code)
• Gift description – what you're thanking the recipient for
• Optional personal details – anecdotes or specific facts about the recipient that inform the note's tone and content

Important: Recipients do not create accounts with Grateful, do not interact with our service, and do not directly provide this information. You (the user) enter all recipient information. Recipients do not consent to or agree with this Privacy Policy. See Section 5 for more details on how we handle recipient information.

2.3 Mailing Address (User)

We collect and store:

• Return mailing address– your address to appear on the back of the mailed notes
• This address is entered per batch and may be saved for future batches

2.4 Payment Information

When you make a payment through Grateful, we collect:

• Stripe Customer ID – a unique identifier assigned by our payment processor
• Last four digits of your credit card or payment method – for your reference only
• Email address associated with payment – for billing and receipts
• Billing address – as required by the payment processor
• Promo codes or discount codes used during purchase

Critical Note: We do NOT store full credit card numbers, expiration dates, or complete payment card details. Payment processing is handled entirely by Stripe. We receive only the Stripe customer ID and limited details for your records.

2.5 Usage and Activity Data

We automatically collect:

• IP address
• User agent and device information – browser type, operating system, device type
• Page views and navigation
• Interactions with the service – buttons clicked, forms submitted, notes generated, batches created
• Timestamps
• Session data
• Referral source – how you found Grateful (e.g., search engine, ad, link from another site)

2.6 Cookies and Similar Technologies

We use cookies and similar tracking technologies for:

• Authentication– to keep you logged in
• Analytics– to understand how users interact with our service
• Preferences– to remember your settings
• Security– to prevent fraud and unauthorized access

You can control cookies through your browser settings. However, disabling certain cookies may affect your ability to use Grateful.

2.7 Google Analytics Data

Through Google Analytics 4, we collect:

• Anonymized page views and user flows
• Device and browser information
• Geographic data (country, state, city)
• Traffic source and referral data
• Event data (e.g., “batch created,” “note sent”)

3.1 Core Service Delivery

• Creating and sending thank you notes – recipient information is used with our AI service to generate personalized notes, and then shared with Handwrytten for physical production and mailing
• Address validation – mailing addresses are validated through USPS to ensure deliverability
• Payment processing – to process purchases and manage your account balance
• Account management – to maintain your account, process login requests, and recover lost passwords

3.2 Communication

• Service updates
• Transactional emails – receipt confirmations, batch status updates, order confirmations
• Customer support
• Legal compliance
• With your consent – promotional emails, marketing newsletters, feature updates (you can opt out at any time)

3.3 Analytics and Improvement

• Understanding usage patterns
• Service optimization
• Business analytics
• Fraud detection

3.4 Legal and Safety

• Compliance with law
• Enforcing terms
• Safety and security
• Dispute resolution

3.5 AI Content Generation

Your recipient information (names, gift descriptions, anecdotes) is sent to Anthropic's Claude API to generate personalized note content. Anthropic does not retain this data for model training or improvement. See Section 6 for more details on AI-generated content.

We do not sell your personal information. We do not share your personal information with third parties for cross-context behavioral advertising. We do share information with third-party service providers who help us operate Grateful, solely for the purposes described below:

4.1 Supabase (Database and Authentication)

Supabase hosts our database and provides authentication services. We share all user account data, recipient information, batch records, and usage data. Data may be stored in the United States.

4.2 Stripe (Payment Processing)

We share email address, billing address, Stripe customer ID, and payment intent details with Stripe to process payments securely.

4.3 Anthropic (AI Note Generation)

We share recipient first and last name, gift description, optional personal details (anecdote), and optional tone preference with Anthropic's Claude API to generate personalized thank you notes. Anthropic does not retain this data for training or improvement.

4.4 Handwrytten (Physical Fulfillment)

We share recipient full name and mailing address, note content, card selection, and font preference with Handwrytten to physically write and mail the thank you notes.

4.5 USPS (Address Validation)

We share mailing addresses (user return address and recipient addresses) with USPS to validate addresses and ensure mail deliverability.

4.6 SendGrid (Transactional Email)

We share email address, user name, batch information, and receipt details with SendGrid to send transactional emails.

4.7 Google Analytics 4 (Analytics)

We share anonymized user behavior, page views, device information, and referral source with Google Analytics to understand how users interact with our service.

4.8 Vercel (Hosting)

Vercel hosts our application and infrastructure. All data processed on our platform passes through Vercel's servers.

4.9 Other Disclosures

We may share your information without your consent if:

• Required by law (subpoena, court order, legal process)
• To protect the rights, privacy, or safety of Grateful, our users, or the public
• To enforce our terms of service or other agreements
• In connection with a merger, acquisition, bankruptcy, or similar business transaction
• With your explicit consent

Recipients are not users of Grateful. They do not create accounts, consent to this Privacy Policy, or interact with our service. However, we collect and process information about them through you.

5.1 Who Provides Recipient Information?

You (the account holder) provide recipient information to Grateful, including recipient names, mailing addresses, gift descriptions, and personal anecdotes or details.

5.2 How We Use Recipient Information

• Generate personalized thank you notes using AI
• Validate mailing addresses through USPS
• Fulfill and mail physical notes through Handwrytten
• Maintain batch history for your records
• Detect duplicate addresses to prevent duplicate mailings

5.3 How We Share Recipient Information

Recipient information is shared with:

• Anthropic (Claude API)– to generate personalized note content
• Handwrytten– to physically write, address, and mail notes
• USPS– to validate mailing addresses

5.4 Your Responsibility

By using Grateful, you represent that:

• You have the lawful authority to provide recipient information to us
• You have obtained any necessary consent from recipients to share their information with us
• You will not upload information that is inaccurate, misleading, or obtained through fraud
• You are responsible for the accuracy of all recipient information you provide

5.5 Data Retention for Recipients

We retain recipient information for as long as necessary to complete the mailing, maintain batch history for your records (typically 1-3 years), and comply with legal obligations. After the retention period, recipient information is deleted or anonymized.

6.1 How It Works

When you create a batch of notes, Grateful:

1. Collects recipient names, gift descriptions, and optional personal details from you
2. Sends this information to Anthropic's Claude API, along with your requested tone or style preferences
3. Claude generates a personalized thank you note for each recipient
4. The generated notes are returned to you for review and editing before mailing

6.2 AI and Fulfillment Disclosure

Grateful uses two forms of automation to produce and deliver your notes:

• Content generation:Note text is generated by Anthropic's Claude AI based on the information you provide. Notes are not written by a human author. You review and approve all content before sending.
• Physical production: Approved notes are physically produced by Handwrytten using robotic pen technology that writes with real ink on real stationery. Notes are not handwritten by a human person. The result closely resembles human handwriting but is produced by an automated pen system.

6.3 Data Retention by Anthropic

Anthropic does not retain your recipient information or note content for training machine learning models, improving Claude's performance, or any purpose other than fulfilling your immediate request.

6.4 Quality and Accuracy

While Claude is highly capable, AI-generated content is not perfect. We recommend reviewing each note before sending, editing notes to better match your voice or preferences, and using the character counter to ensure notes meet all requirements. Grateful is not responsible for any errors, omissions, or inaccuracies in AI-generated content.

6.5 Sensitive Information

Do not include credit card numbers, Social Security numbers, passwords, medical information, or extremely sensitive personal secrets in recipient details. If you include sensitive information, it will be sent to Claude for processing.

7.1 Security Measures

• HTTPS encryption – all data transmitted between your browser and Grateful is encrypted
• Database encryption – sensitive data is encrypted at rest
• Row-level security (RLS) – database access controls ensure users can only access their own data
• Access controls – only authorized employees and service providers can access your data
• Regular backups to prevent data loss
• Security monitoring for suspicious activity

7.2 Limitations

No security measure is perfect or impenetrable. While we use industry-standard protections, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your password and account credentials.

7.3 Breach Notification

In the event of a data breach, we will investigate promptly, notify affected individuals in compliance with the Florida Information Protection Act (FIPA) and other applicable law, notify applicable regulators, provide breach details, and where appropriate offer remediation.

8.1 User Account Data

We retain your name, email, and account preferences while your account is active. Account data is deleted within 30 days of account closure, except where required by law. Data may persist in backups for up to 90 days after deletion.

8.2 Recipient Information

Recipient information is retained while the batch is being processed, for 1-3 years after notes are sent for batch history, and is securely deleted or anonymized after the retention period.

8.3 Payment Information

Stripe customer ID and last 4 digits are retained while your account is active and for 1-3 years after account closure. Full payment card details are not stored by Grateful.

8.4 Cookies and Analytics Data

Session cookies are deleted when you log out or close your browser. Persistent cookies are retained for up to 1 year. Analytics data is retained by Google Analytics according to their standard retention policies.

9.1 General Rights

You have the right to:

• Access – request a copy of your personal information
• Correct – request corrections to inaccurate information
• Delete – request deletion of your information
• Opt-out of marketing communications
• Data portability – request your information in a portable format
• Withdraw consent

9.2 California Residents (CCPA/CPRA)

California residents have additional rights under the CCPA and CPRA, including the right to know, delete, correct, opt-out of sale, limit use, non-discrimination, and appeal. Email app.grateful@gmail.com with the subject “California Privacy Request” to submit a request. We will respond within 45 days.

9.3 Virginia, Colorado, Connecticut, and Utah Residents

Residents of these states have similar rights to CCPA. Contact us at app.grateful@gmail.com to exercise these rights.

9.4 European Residents (GDPR)

If you are located in the EU, UK, or EEA, you have rights under GDPR including access, rectification, erasure, restriction of processing, data portability, objection, and the right to lodge a complaint with your local data protection authority. Contact us at app.grateful@gmail.com.

9.5 Cookies and Tracking

You can control cookies through your browser settings or use Google's browser extension to opt out of Analytics tracking. Grateful does not currently respond to Do Not Track (DNT) signals.

9.6 Marketing Communications

You can opt out of marketing emails by clicking “Unsubscribe” in any promotional email or emailing app.grateful@gmail.com.

Grateful is not intended for users under the age of 16. We do not knowingly collect personal information from anyone under 16. If we become aware that we have collected information from a person under 16, we will promptly delete that information. If you are a parent or guardian and believe your child has created an account, contact us at app.grateful@gmail.com.

Our service is operated in the United States. Your personal information may be transferred to, stored in, and processed in the United States. For EU/EEA residents, we rely on Standard Contractual Clauses (SCCs) and adequacy decisions where applicable. Contact app.grateful@gmail.com for more information.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy, updating the “Last Updated” date, and sending email notification for significant changes. Your continued use of Grateful after changes become effective constitutes acceptance.

If you have questions about this Privacy Policy, our data practices, or your privacy rights, please contact us:

Email: app.grateful@gmail.com

Mailing Address:
SquiFi LLC
555 NE 34th Street APT 904
Miami, FL 33137

We will respond to privacy inquiries within 30 days of receipt.

• Personal Information: Any information that can identify you directly or indirectly
• Processing: Any operation performed on data, including collection, storage, use, sharing, or deletion
• Third-Party Service Provider: A company that processes data on our behalf under contract
• Recipient: A person who receives a thank you note sent through Grateful; not a user of the service
• Batch: A group of thank you notes sent together by a single user