GrandMail Privacy Policy

Version: 2026-10-28 Last updated: 28 October 2026

1. Who we are

GrandMail is a business of Petrosi Group Pty Ltd (ABN 25 615 926 335), trading as GrandMail.

We take privacy seriously because of what we do. We hold personal information about people who did not give it to us themselves: the grandparents, parents and friends our subscribers write to. Section 4 explains how we handle that, and it is the most important part of this policy.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Privacy contact: privacy@grandmail.com.au

By post: Privacy Officer, GrandMail, PO Box 307, Drummoyne NSW 1470, Australia

2. The two kinds of people in this policy

Subscribers are people who create an account, pay us, and provide information.

Recipients are the people who receive our letters, cards and gifts. Recipients do not sign up with us, do not pay us, and usually do not know we exist until the first letter arrives.

Both are covered by this policy. Recipients have the same rights of access, correction and deletion as Subscribers, and can exercise them by contacting privacy@grandmail.com.au.

3. Information we collect about Subscribers

• Name and email address
• Mobile number, if you provide one
• Billing information. Card details are handled by our payment provider and we never see or store your full card number
• Your subscription, package, billing history and gift selections
• Gift-request details, including delivery address, requested date, value and card message
• Uploaded My Language Letters files, the language specified, recipient and delivery details, and any notes supplied
• Correspondence with us
• Website usage information, including how you found us, pages visited, and a session identifier

4. Information we collect about Recipients

This is the sensitive part, and we want to be plain about it.

When someone subscribes on a Recipient's behalf, they give us:

• The Recipient's full name
• Their postal address
• Their date of birth
• Their relationship to the Subscriber
• Their interests
• Occasions they observe
• Anything the Subscriber has asked us never to mention, which may itself be sensitive, such as a bereavement or an illness

We collect this from the Subscriber, not from the Recipient. We do this because it is the only practical way the service can work: a surprise letter cannot be arranged by first asking the person it is for.

We require every Subscriber to confirm they have a genuine relationship with the Recipient and are entitled to provide their details. We do not independently verify this.

What Recipients can do. A Recipient can contact privacy@grandmail.com.au at any time to:

• Ask what information we hold about them
• Correct anything that is wrong
• Ask us to stop sending them mail
• Ask us to delete their information

We will act on a request to stop mail immediately, and on a deletion request within a reasonable time, subject to any records we must keep for financial or legal reasons. We will not require a Recipient to explain themselves or to contact the Subscriber first.

Never-mention information. Where a Subscriber tells us something must never be mentioned, we hold it solely to prevent it appearing in correspondence. We do not use it for any other purpose.

5. Why we collect and use personal information

• To provide the service: writing, printing and posting letters and cards
• To source, purchase and send gifts
• To process payments and issue receipts
• To send service emails: account verification, password reset, enquiry acknowledgements, subscription confirmations, replies and birthday posting notifications
• To respond to your enquiries
• To detect and prevent errors, fraud and misuse
• To meet our legal and record-keeping obligations
• To understand how people find and use our website, in aggregate

We do not sell personal information. We do not share it with third parties for their own marketing.

6. Letters and artificial intelligence

My Language Letters uses letters you write and upload yourself. We store these files so we can print and post them. We do not write, translate or edit them and do not use their contents for AI drafting. Do not upload photographs or files containing photo images. We print letters only.

We research and curate stories, themes, events and topics based on the Recipient's interests and hobbies. Artificial intelligence produces the letter from that curated material. Our team then reviews it to check that the story, events, themes and hobbies align with the Recipient's interests before release for posting.

To do this, the Recipient's first name, interests, occasions and never-mention instructions are sent to our AI provider to generate the draft. Their postal address and date of birth are not sent for this purpose.

We use AI services to produce drafts from our curated material. We do not use Recipient information to train our own AI models. Third-party processing is subject to the relevant provider's service terms and privacy safeguards. See section 7 for overseas processing, and contact privacy@grandmail.com.au for information about the providers used for your service.

7. Cross-Border Disclosure of Personal Information

GrandMail may use trusted third-party service providers to help us operate and deliver our services. These providers may include organisations that provide cloud hosting, database management, payment processing, email delivery, artificial intelligence-assisted content generation, printing, postal delivery, gift fulfilment, customer support, analytics, and other technology services.

We only disclose personal information to service providers where it is necessary for them to perform services on our behalf. Each provider is only given access to the information required to provide their specific service.

Some of our service providers may be located outside Australia or may process personal information in countries other than Australia, including the United States and other jurisdictions where our service providers operate. As a result, personal information provided to GrandMail may be transferred, stored, or accessed overseas.

Before disclosing personal information to overseas recipients, GrandMail takes reasonable steps to ensure that these providers handle personal information appropriately and maintain privacy and security safeguards consistent with applicable privacy obligations.

We may also disclose personal information where required or authorised by law, to protect our rights, prevent misuse of our services, or enforce our Terms and Conditions.

8. How long we keep information

We retain information where needed to provide your service, resolve enquiries and meet legal and financial record-keeping obligations. Contact privacy@grandmail.com.au to request access, correction or deletion. Financial records may need to be retained under Australian law. We review deletion requests individually and do not currently promise automatic deletion after a fixed number of days.

9. Security

• Our service uses access controls that restrict what can be read and written; overseas processing is described in section 7
• Card details are handled entirely by our payment provider and never reach our systems
• Access to personal information is limited to those who need it to operate the service
• Form details are not saved for resumption before submission. Starting checkout stores submitted details as an awaiting-payment record. Passwords are handled by our account service and not stored with subscription records.

No system is perfectly secure. If a data breach occurs that is likely to cause serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

10. Cookies and website analytics

We use a small number of cookies and similar technologies to keep you signed in and understand how people find and use our site.

We do not provide saved-signup cookies or automatic signup-resume emails.

You can block cookies in your browser, though parts of the site may not work properly.

11. Marketing

We send service emails about your subscription. These are not marketing.

We will only send you promotional email if you have opted in, and every promotional email includes an unsubscribe link. We comply with the Spam Act 2003 (Cth).

We never send marketing email to Recipients.

12. Accessing, correcting and deleting information

Contact privacy@grandmail.com.au.

• Access. We will tell you what we hold, usually within 30 days, and free of charge in most cases.
• Correction. We will correct anything inaccurate.
• Deletion. We will delete your information, except where we must keep records for legal or financial reasons.
• Recipients. Recipients may make any of these requests directly, and may ask us to stop sending them mail. We will act on that immediately.

We may need to verify your identity before acting on a request.

13. Complaints

If you are unhappy with how we have handled your personal information, contact privacy@grandmail.com.au. We will acknowledge your complaint and review it without promising a fixed response timeframe.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

• Website: oaic.gov.au
• Phone: 1300 363 992

14. Changes to this policy

We may update this policy. Each version carries a version number and date, and we keep a copy of every published version. Material changes will be notified by email to current subscribers.

15. Contact us

By post: Privacy Officer GrandMail PO Box 307 Drummoyne NSW 1470 Australia

Petrosi Group Pty Ltd (ABN 25 615 926 335) trading as GrandMail.