Privacy Policy

MyMailForwarder.com is a service operated by Neighborhood Parcel, a Biz International Corp company located in Tewksbury, Massachusetts, United States. Neighborhood Parcel is a USPS-approved Commercial Mail Receiving Agency (CMRA) authorized and regulated by the United States Postal Service.

For the purposes of the European Union General Data Protection Regulation (GDPR) and the UK GDPR, Neighborhood Parcel is the data controller responsible for the personal data described in this policy. For the purposes of the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), Neighborhood Parcel is the business.

We collect only the personal data that is necessary to provide our services, comply with legal obligations, and improve your experience. Below is a complete account of every category of data we collect and its source.

2.1 Data You Provide Directly

• Identity data: Full legal name, date of birth, and government-issued identification documents submitted in connection with USPS PS Form 1583 (two forms of ID required by federal law).
• Contact data: Email address, mailing address, permanent home address, and telephone number.
• Account data: Username, password (stored in hashed form only), account preferences, and subscription plan selection.
• Payment data: Credit or debit card details, PayPal account information, and billing address. Payment card numbers are processed by our payment processors (Stripe, PayPal) and are never stored on our servers.
• Forwarding instructions: Destination addresses, carrier preferences, customs declaration values, and forwarding request history.
• Concierge Service data: Product specifications, retailer details, and purchasing instructions provided when using the Personal Concierge Service.
• Communications: Messages sent through our Contact page, support requests, and any other correspondence with our team.

2.2 Data We Collect Automatically

• Technical data: IP address, browser type and version, operating system, device type, and screen resolution collected when you visit our website.
• Usage data: Pages viewed, time spent on pages, links clicked, and navigation paths through our website.
• Cookie data: Data set by cookies and similar tracking technologies as described in Section 9.
• Log data: Server logs including access times, error logs, and security event records maintained for operational and security purposes.

2.3 Data from Third Parties

• Carrier data: Tracking information, delivery confirmation, and shipment status provided by USPS, FedEx, and UPS in connection with inbound and outbound shipments.
• Payment verification: Fraud detection signals and payment authorization data from our payment processors.
• USPS systems: Address validation and CMRA Customer Registration Database (CRD) confirmation data as required by USPS regulation.

We use your personal data only for the specific purposes listed below. We do not use your data for automated decision-making that produces legal or similarly significant effects, and we do not engage in profiling for behavioral advertising.

• Activating and managing your mailbox subscription and associated Massachusetts street address.
• Complying with USPS CMRA regulatory requirements, including PS Form 1583 registration, Customer Registration Database submissions, and quarterly certifications (see Section 5).
• Receiving, logging, storing, and forwarding your mail and packages.
• Sending you free email notifications when mail or packages arrive at your address.
• Processing payments and managing billing for your subscription and forwarding services.
• Providing digital mail scanning services where requested.
• Executing purchases through the Personal Concierge Service where requested.
• Responding to your support enquiries and communications.
• Sending you service-related communications including policy updates, account notices, and security alerts. These are not marketing emails and are sent regardless of marketing preferences.
• Preventing fraud, detecting security threats, and maintaining the security of our facility, systems, and subscriber data.
• Complying with all applicable laws, regulations, and lawful requests from governmental and postal authorities.
• Improving our website, services, and subscriber experience through aggregated, anonymized analytics.

For subscribers in the European Union and European Economic Area, the GDPR requires us to identify a lawful basis for each purpose for which we process personal data. The following table sets out our lawful bases.

Where we rely on legitimate interests as our lawful basis, we have conducted a balancing assessment and determined that our interests are not overridden by your rights and freedoms. You have the right to object to processing based on legitimate interests as described in Section 12.

As a USPS-approved Commercial Mail Receiving Agency, Neighborhood Parcel is required by federal postal regulations to:

• Collect completed PS Form 1583 (Application for Delivery of Mail Through Agent) with two valid forms of government-issued identification from every subscriber before activating mail services.
• Upload completed PS Form 1583 and copies of identification documents to the USPS Customer Registration Database (CRD), where they are maintained by the USPS as a federal record.
• Certify to the USPS CRD every quarter (January 15, April 15, July 15, and October 15) that all Form 1583 submissions are current and no identification documents have expired.
• Make all PS Forms 1583 available for inspection by USPS representatives and postal inspectors at any time, as required by federal regulation.
• Record your permanent home address as a remail address in the USPS CRD, to be used in the event of account termination for the mandatory 6-month post-termination mail forwarding period.
• Notify the USPS when an account is terminated and enter the termination date in the CRD.
• Comply with any emergency mail withholding order issued by the USPS Chief Postal Inspector.

Records submitted to the USPS fall within USPS System of Records No. 845.000, Commercial Mail Receiving Agency, and are governed by the Privacy Act of 1974. The USPS Privacy Act Notice applicable to PS Form 1583 records can be found at usps.com.

We share your personal data only in the following circumstances. We never sell your data to any third party for any commercial purpose.

6.1 Essential Service Partners

• USPS (United States Postal Service): As required by federal CMRA law as described in Section 5.
• Shipping Carriers — USPS, FedEx, UPS: Your name, delivery address, and shipment details are shared with carriers to facilitate inbound and outbound shipments.
• Payment Processors — Stripe, PayPal: Payment card data and billing information are processed directly by our payment processors. We do not store card numbers. Both processors operate under their own privacy policies and maintain PCI-DSS compliance.
• Customs Authorities: For international shipments, your name, address, and customs declaration details are included on shipping documentation as required by the destination country’s customs regulations.

6.2 Legal and Regulatory Disclosures

We may disclose your personal data to governmental, regulatory, or law enforcement authorities where we are legally required to do so, including in response to a valid court order, subpoena, search warrant, or lawful regulatory request. We will notify you of any such disclosure to the extent permitted by law.

6.3 Business Transfers

In the event of a merger, acquisition, sale of assets, or other business transfer involving Neighborhood Parcel, your personal data may be transferred as part of that transaction. We will notify affected subscribers in advance and the acquiring entity will be required to honor the commitments made in this Privacy Policy. Any such transfer will comply with applicable USPS CMRA regulations regarding subscriber records.

6.4 What We Do Not Do

• We do not sell your personal information to any third party under any circumstances.
• We do not share your data with advertising networks or social media platforms.
• We do not share your data with data brokers or list rental services.
• We do not disclose your home address or identification documents to any party other than the USPS as required by law and the carriers needed to deliver your mail.

MyMailForwarder.com is based in the United States. If you are accessing our services from the European Union, the European Economic Area, or the United Kingdom, your personal data will be transferred to and processed in the United States, which the European Commission has not issued an adequacy decision for in respect of US transfers generally.

You may request a copy of the Standard Contractual Clauses applicable to your data processing by contacting us through our Contact Page.

For UK residents: We apply equivalent transfer safeguards under the UK GDPR and the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs where applicable.

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy, to comply with our legal obligations, and to resolve disputes. The following retention periods apply.

Where CCPA applies, retention periods are stated in specific timeframes as required by the 2025 CPRA regulations. We do not retain personal data beyond the periods stated above. Upon expiry of the applicable retention period, data is securely deleted or anonymized in accordance with Massachusetts 201 CMR 17.00.

Our website uses cookies and similar tracking technologies. Cookies are small text files stored on your device when you visit a website. We use the following categories of cookies.

Essential Cookies (Always Active)

These cookies are strictly necessary for the website to function. They enable core functionality such as account login, shopping cart operation, and security. These cannot be disabled as our service cannot function without them. Legal basis: Legitimate interests.

Analytics Cookies (Optional)

We use aggregated, anonymized analytics to understand how visitors use our website. This data does not identify individual users and is used only to improve our service. Where required, we obtain your consent before setting analytics cookies. Legal basis: Consent (EU/EEA visitors) or Legitimate interests (other visitors).

Functional Cookies (Optional)

These cookies remember your preferences such as language settings and display options. They are not essential but improve your experience. Legal basis: Consent where required.

You can control cookies through your browser settings at any time. Disabling essential cookies will affect the functionality of our website. Disabling analytics cookies will not affect your ability to use any part of our service. For detailed information on managing cookies, visit aboutcookies.org.

Our services are not directed at children under the age of 13 in the United States, or under the age of 16 in the European Union and European Economic Area, and we do not knowingly collect personal data from children in these age groups without verifiable parental or guardian consent.

USPS PS Form 1583 requires the subscriber to be an adult capable of entering a legally binding agreement. All subscribers represent that they are at least 18 years of age. If you believe we have inadvertently collected personal information from a minor without appropriate consent, please contact us immediately via our Contact Page and we will take prompt action to delete that information.

We comply with the Children’s Online Privacy Protection Act (COPPA) for US-based operations and with GDPR Article 8 for EU/EEA subscribers with respect to any incidental processing of data related to individuals under the applicable age threshold.

Regardless of where you are located, you have the following rights in relation to your personal data held by MyMailForwarder.com. Additional rights specific to EU/EEA residents (GDPR) and California residents (CCPA/CPRA) are described in Sections 12 and 13.

• Right to know: You may request information about what personal data we hold about you and how we use it.
• Right to correct: You may request correction of any inaccurate personal data we hold about you.
• Right to update: You may update your account information at any time through your account portal. Changes to Form 1583 information must be submitted in writing as a new Form 1583 as required by USPS regulations.
• Right to opt out of marketing: You may opt out of any marketing communications at any time using the unsubscribe link in any marketing email or by contacting us. Service-related communications cannot be opted out of while your account is active.

To exercise any of these rights, contact us through our Contact Page. We respond to all requests within the timeframes required by applicable law and at no cost to you.

12.1 How to Exercise GDPR Rights

Submit your request through our Contact Page, clearly identifying the right you wish to exercise and providing sufficient information to verify your identity. We do not charge a fee for exercising your rights. We respond within 30 days. Where we are unable to comply, we will explain why in writing.

12.2 Right to Lodge a Complaint

If you are dissatisfied with how we have handled your personal data or responded to a rights request, you have the right to lodge a complaint with the supervisory authority in your EU member state of habitual residence, place of work, or the location of the alleged infringement. A list of EU supervisory authorities is available at edpb.europa.eu. We would always prefer to resolve any concerns directly — please contact us before filing a complaint so we have the opportunity to address your concern.

12.3 Legal Basis for Limitations

Certain rights under GDPR are not absolute. Your rights to erasure, restriction, and portability do not apply to data we are required to retain by USPS CMRA regulations, US federal law, Massachusetts law, or other applicable legal obligations. We will identify the specific legal obligation when exercising this limitation in response to any request.

13.1 Categories of Personal Information Collected (CCPA Disclosure)

In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA:

• Identifiers (name, email, IP address, account username)
• Personal information under Cal. Civ. Code 1798.80(e) (name, address, telephone number)
• Sensitive personal information (government-issued ID, collected solely for USPS CMRA compliance)
• Internet or other electronic network activity (website usage data)
• Geolocation data (IP-level only, not precise geolocation)
• Commercial information (transaction records, subscription history)
• Inferences drawn from the above (account preferences)

13.2 How to Submit a CCPA Request

Submit your request through our Contact Page. We respond within 45 days, with one possible 45-day extension where we notify you in advance. We verify identity before fulfilling data requests using two or more pieces of account information. We do not charge a fee and will not discriminate against you for exercising your rights.

13.3 Authorized Agent

You may designate an authorized agent to submit a CCPA request on your behalf. Your agent must provide written proof of authorization and we reserve the right to verify your identity directly in addition to verifying the agent’s authorization.

13.4 CCPA “Shine the Light” (Cal. Civ. Code 1798.83)

California residents may request information about personal information disclosed for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes. This right is therefore automatically satisfied. Confirm in writing by contacting us through our Contact Page.

In the event of a data security breach involving your personal information, we will notify you and all applicable regulatory authorities in accordance with the following requirements.

• GDPR (EU/EEA): We will notify the relevant supervisory authority within 72 hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of natural persons. Where the risk is high, we will notify affected individuals without undue delay. Notification will include the nature of the breach, categories and approximate number of individuals affected, likely consequences, and remediation measures taken.
• Massachusetts law (M.G.L. Chapter 93H): We will notify affected Massachusetts residents and the Massachusetts Attorney General as soon as reasonably possible following discovery of a breach of security involving personal information.
• CCPA/CPRA (California): We will notify affected California residents in the event of unauthorized access to personal information in violation of reasonable security procedures, as required by Cal. Civ. Code 1798.82.
• All jurisdictions: We will also notify other applicable regulatory authorities and affected individuals in accordance with the breach notification laws of any other jurisdiction where affected individuals reside.

We implement technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction, consistent with our obligations under GDPR Article 32, Massachusetts 201 CMR 17.00, and CCPA/CPRA security requirements.

• Encryption: All personal data is encrypted in transit using TLS and at rest using industry-standard encryption. All digital communications with subscribers are transmitted with end-to-end encryption.
• Access controls: Access to personal data is restricted to employees with a specific business need. All accounts are protected by strong authentication requirements.
• Physical security: Our Massachusetts facility is secured with 24/7 monitored access controls. Physical documents containing personal information are stored in locked, access-controlled areas.
• Staff vetting: All employees with access to subscriber mail or personal data undergo background checks as a condition of employment.
• Security training: All employees with access to personal information receive regular data security and privacy training.
• Vendor security: All third-party processors are contractually required to maintain appropriate security measures and are assessed before engagement.
• Incident response: We maintain a documented incident response plan reviewed and tested annually.

While we implement robust security measures, no security system is impenetrable. We cannot guarantee absolute security of your data and you use our service at your own risk in respect of security events beyond our control.

We may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or regulatory guidance. When we make material changes, we will:

• Post the updated policy on this page with a revised Effective Date prominently displayed.
• Send an email notification to all active subscribers at least 30 days before material changes take effect.
• For EU/EEA subscribers: where changes require a new lawful basis, we will seek fresh consent where consent is the applicable basis.

Your continued use of our service after the effective date of any update constitutes your acknowledgment of the updated policy. We maintain an archive of previous versions of this Privacy Policy available upon request through our Contact Page.

For any privacy-related questions, data subject requests, or concerns about how we handle your personal data, please contact us through any of the following channels. We take all privacy enquiries seriously and acknowledge receipt within 72 hours.

• Privacy requests and data subject rights: mymailforwarder.com/contact-us — mark your message as “Privacy Request” in the subject line.
• Business name and address: Neighborhood Parcel — Biz International Corp, Tewksbury, Massachusetts, USA.
• Business hours: Monday to Friday, 9:00 AM to 5:30 PM EST. Saturday, 10:00 AM to 2:00 PM EST.
• USPS CMRA enquiries: For questions about your PS Form 1583, USPS Customer Registration Database records, or CMRA-related data, please contact us with your account name and PMB number for fastest response.