›

Privacy Policy

What personal information we collect, how we use it, and how we keep it safe.

Last updated: September 20, 2026

Mailbox To Go Inc. (“Mailbox To Go”, “we”, “us”, or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit mailboxtogo.com (the “Website”), create an account, subscribe to or use a virtual mailbox, contact us, or otherwise use our related products and services (collectively, the ”Services”). It also explains the choices and rights available to you.

This Policy applies to personal information handled by Mailbox To Go and, as described below, to personal information handled on our behalf by a business that operates a mailbox location (an “Operator”). It does not apply to an unrelated third-party website or service that you choose to use through a link from our Website.

This Policy should be read together with our General Terms and Conditions and, if you subscribe to a virtual mailbox, our Renter Terms and Conditions (“Renter Terms”). Those terms govern your use of the Website and Services, while this Policy explains how personal information is handled.

Personal information we collect

The information we collect depends on how you interact with us and which Services you use. It may include the following:

Account, contact, and subscription information

your name, email address, telephone number, login credentials, user and account identifiers, notification preferences, selected mailbox location, plan, subscription status, and account history;
your residential address and other contact or profile information you provide; and
business name, business contact information, registration number, and related account details where the mailbox is used for a business.

Identity, address, business, and recipient verification information

a copy or image of government-issued photo identification, such as a driver’s licence or passport, including information visible on that document;
a proof-of-address document selected by you, such as a utility bill or insurance document, including information visible on that document;
business registration documents and related information where a business recipient is added;
the same types of information for an additional recipient whom you are authorized to add; and
verification decisions, reasons, status, dates, and related records created by the assigned Operator or by Mailbox To Go when investigating fraud, resolving a technical issue, or addressing a compliance concern.

Verification is performed by the assigned Operator. Mailbox To Go personnel may access verification information where reasonably necessary for technical assistance, fraud or security review, compliance, legal obligations, or oversight of the Services.

Mail, package, and handling information

the recipient and sender information visible on an item, mailing and return addresses, carrier and postage information, tracking numbers, delivery information, and dates and times;
photographs or scans of the outside of eligible mail, packages, and identifiable returned forwarding shipments;
information concerning an ineligible item inadvertently received, including visible package details, exterior photographs, tracking or delivery information, and records of its refusal, temporary safeguarding, return, escalation, or other resolution;
scanned images of the contents of mail when the customer requests an open-and-scan service;
information observed during a limited safety or compliance inspection of an item that appears damaged, unsafe, improperly sealed, prohibited, or illegal, as permitted by the Renter Terms;
customer instructions and processing records concerning scanning, forwarding, pickup, release, recycling, shredding, return, transfer, consolidation, or disposal;
destination names and addresses supplied for forwarding;
the name of a person authorized by the customer to collect mail, pickup authorizations and results, and related activity records; and
mail descriptions, notifications, status changes, audit records, and other information reasonably required to receive, identify, secure, display, and handle an item.

Location security and video surveillance information

Security cameras may be present at or around a mailbox location, including in mail-receiving, storage, work, entrance, or pickup areas. Cameras may record video images, dates, times, locations, and activities involving visitors, customers, authorized collectors, personnel, mail, or packages. Where Mailbox To Go or an Operator uses CCTV in connection with the Services, audio recording is not used for the Services.

Depending on the location, a camera system and its recordings may be controlled by Mailbox To Go, the Operator, a landlord, building manager, security provider, or another third party responsible for the premises. Where Mailbox To Go or an Operator controls the recordings in connection with the Services, they may be used to protect people, premises, mail, packages, and systems; control physical access; deter and investigate theft, fraud, unauthorized access, damage, safety events, disputes, or other incidents; verify relevant events; comply with law; and establish, exercise, or defend legal claims. The party controlling the surveillance system is responsible for providing any signage or other notice required by applicable law. An independent landlord, building manager, or other third party that controls its own surveillance system is also responsible for its separate privacy practices.

Payment and transaction information

We collect billing contact information, which may include first and last name, company name, country, province or state, and postal code, together with subscription, invoice, payment status, refund, chargeback, and transaction records. Card information is collected through Stripe Elements and submitted to Stripe for processing. Mailbox To Go’s own systems do not receive or store the full card number or security code. We store a Stripe payment identifier and limited payment-method information provided by Stripe so that we can process recurring payments and allow you to identify and manage the payment method associated with your account. Mailbox To Go does not receive or store your full payment-card number or security code. Our payment processor may process payment and related information for transaction processing, security, fraud prevention, dispute handling, and compliance with its legal obligations.

Communications and other information you provide

We collect information contained in support requests, live-chat messages, emails, contact forms, complaints, privacy requests, feedback, surveys, and other communications with us. Information from customer-support communications may be shared with the assigned Operator where reasonably necessary to resolve a location-specific service issue.

If we request or receive a testimonial, we may collect the person’s name, company, photograph, and comments. We will obtain permission before publishing personal information in a testimonial.

Website, device, cookie, and usage information

When you use the Website or Services, we and our technology providers may automatically collect information such as:

IP address and approximate location derived from it;
browser, device, operating system, language, and display information;
referring and exit pages or links;
pages and features viewed, searches or interactions, and time spent;
dates, times, logins, error information, and security events; and
cookie, advertising, analytics, and similar online identifiers.

We use this information to operate and secure the Website, detect fraud and misuse, understand Website performance and use, improve the Services, and measure marketing or advertising results as described under “Cookies, analytics, and advertising” below.

Information about other people

The Services may contain personal information about additional recipients, authorized collectors, mail senders, people named on or inside mail, and other individuals who do not hold the account. This information may be provided by the customer, an authorized user or recipient, an Operator, a sender, a postal or courier service, or the physical mail itself. If you submit personal information about another person or instruct us or an Operator to receive, open, scan, disclose, forward, release, or destroy mail relating to that person, you represent that you have the authority or consent required to do so. You must not use the Services to collect, view, or disclose another person’s information unlawfully.

How we use personal information

We may use personal information for the following purposes:

to create, secure, administer, and authenticate accounts;
to reserve and activate a mailbox and manage subscriptions;
to verify customers, businesses, recipients, and pickup authorizations;
to receive, identify, store, photograph, scan, display, forward, release, recycle, shred, return, transfer, or otherwise handle mail and packages as instructed or permitted by the applicable terms;
to conduct a limited safety or compliance inspection of an item where permitted by the Renter Terms;
to create forwarding labels, arrange carrier services, track shipments, and complete customer requests;
to process recurring and one-time payments, refunds, disputes, and chargebacks;
to send account, verification, mail, billing, security, service, and legal notices;
to provide customer support and resolve technical or location-specific problems;
to maintain records of instructions, custody, access, and activity;
to detect, prevent, investigate, and respond to fraud, identity misuse, prohibited activity, security threats, and violations of our terms;
to protect customers, recipients, Operators, Mailbox To Go, carriers, senders, other persons, property, mail, and systems;
to operate or use location security cameras for physical security, access control, incident investigation, and evidence, where applicable;
to comply with legal, tax, accounting, regulatory, insurance, audit, and record-keeping requirements;
to establish, exercise, or defend legal claims and enforce our agreements;
to operate, troubleshoot, analyze, maintain, and improve the Website and Services;
to measure Website use and the results of communications or advertising;
to send marketing communications where permitted by law and manage opt-outs;
to request feedback and, with permission, publish testimonials; and
to complete a proposed or completed business transaction as described below.

We will not use scanned mail contents or verification documents for advertising, marketing profiles, or unrelated analytics.

Consent and customer choices

We obtain consent where required by applicable law. The form of consent may vary depending on the sensitivity of the information and the reasonable expectations of the individual. Some collection, use, or disclosure is necessary to provide a requested Service. For example, we cannot provide a mailbox without the required identity and address verification, disclose a scan without opening the requested mail, or forward an item without using the destination address. As part of requesting the Services and agreeing to the Renter Terms, customers also authorize the limited safety or compliance inspection described in this Policy when an item’s condition or apparent contents create a reasonable safety, security, or legal concern.

You may choose not to provide optional information. You may also withdraw consent to a use or disclosure, subject to reasonable notice and any legal, contractual, security, fraud-prevention, or record-retention requirement. Withdrawing consent for information that is necessary to provide the Services may prevent us from activating or continuing the account. A withdrawal does not affect handling that was lawful before the withdrawal.

Applicable law may permit or require us to collect, use, or disclose personal information without consent, including for fraud investigations, debt collection, emergencies, legal process, law enforcement, or compliance with a legal obligation. We limit such handling to what is permitted or required.

Marketing messages include an unsubscribe method. Unsubscribing from marketing does not stop necessary transactional, security, billing, verification, mail, legal, or other service communications while the account remains active.

How we disclose personal information

We do not sell or rent personal information. We may disclose or make it available in the following circumstances.

Assigned Operators

We make the information described in this Policy available to the Operator assigned to the customer’s selected location to the extent reasonably necessary to perform verification, physical mail handling, location security, incident response, and related Services. An Operator cannot access customers assigned to another location. The Operator relationship and restrictions are described under “How Operators handle personal information” above.

Third-party service providers

We use third-party providers for functions such as application and database hosting, backups, server management, payment processing, transactional and marketing email, live chat, customer support, analytics, advertising measurement, security, error logging, and other technology or operational support. These providers receive only the information reasonably necessary for their function. Where a provider processes personal information on our behalf, we use contractual or other measures designed to require appropriate confidentiality, security, and limitations on use. Some providers, including payment processors, analytics or advertising companies, carriers, and other independently regulated businesses, may also handle information under their own legal obligations and privacy terms.

Forwarding, pickup, and other customer instructions

When a customer requests forwarding or another service involving a third party, we or the Operator may disclose the destination name, address, contact information, package or mail details, and other necessary information to postal services, couriers, shipping suppliers, customs authorities, an authorized collector, or another person selected or authorized by the customer.

Legal, safety, fraud, and compliance disclosures

We or an Operator may disclose personal information where required or permitted by applicable law, court order, subpoena, warrant, regulatory requirement, or other lawful process. We may also disclose information where reasonably necessary and legally permitted to investigate fraud or unlawful conduct; collect a debt; respond to an emergency; protect the rights, safety, security, or property of any person; report prohibited or dangerous mail; obtain legal, accounting, insurance, or other professional advice; or establish, exercise, or defend a legal claim.

Business transactions

Personal information may be disclosed to advisers and prospective counterparties in connection with a proposed financing, merger, acquisition, reorganization, sale of assets, or similar business transaction. We will use reasonable measures to protect the information during the transaction. If the transaction is completed, personal information may be transferred to the successor organization for the purposes described in this Policy, subject to applicable law. Where personal information was disclosed without consent under an applicable business-transaction exception, Mailbox To Go or another party to the transaction will notify affected individuals within a reasonable time after completion that the transaction was completed and their personal information was disclosed, as required by law.

How Operators handle personal information

Mailbox To Go provides the online platform, customer accounts, billing, customer support, and platform-wide policies for the Services. Eligible physical mail and identifiable returned forwarding shipments are received and handled at the mailbox location selected by the customer. An ineligible item inadvertently left by a carrier may also be temporarily safeguarded and handled only as permitted by the Renter Terms. A location may be operated directly by Mailbox To Go or by an independent local business acting as the Operator for that location.

An assigned Operator may need to review verification documents, approve or reject recipients, receive and store eligible physical mail, packages, and identifiable returned forwarding shipments, photograph the outside of those items, open and scan them when instructed, prepare forwarding labels and shipments, verify a person collecting mail, and carry out instructions to release, recycle, shred, return, transfer, or otherwise handle an item. The Operator may also refuse, temporarily safeguard, return, escalate, or otherwise resolve an ineligible item inadvertently received. As permitted by the Renter Terms, an Operator may open and inspect an item without a customer scanning request when the item appears damaged, unsafe, improperly sealed, or potentially contains prohibited or illegal material, but only to the extent reasonably necessary to determine safe and lawful handling or comply with a lawful request. The Operator may access only customers and recipients assigned to its own location and only the information reasonably necessary to perform these functions, comply with law, protect its premises and personnel, or investigate a suspected incident. An independent Operator is not a Mailbox To Go employee. When an Operator processes personal information on our behalf, we require it by contract and platform rules to:

use the information only to provide the Services, comply with law, maintain security, or carry out an action authorized by the customer;
limit access to authorized personnel based on their duties;
maintain appropriate confidentiality, physical security, and information-security safeguards;
not add customer information to its own marketing or unrelated customer database;
not sell, rent, or disclose the information for an unrelated purpose;
notify Mailbox To Go promptly of a privacy or security incident; and
securely return or destroy information when it is no longer required.

Operators must keep personal information within the Platform except where limited temporary handling outside the Platform is reasonably necessary to perform an authorized Service. Any such information must be appropriately protected and securely destroyed when no longer required. Mailbox To Go is responsible for personal information under its control. An independent Operator may also have legal obligations for information in its custody or control and remains responsible for its own employees, unauthorized conduct, independently determined activities, and compliance with laws that apply directly to it. Nothing in this Policy reduces any right or remedy an individual has under applicable privacy law.

Access within Mailbox To Go and the Services

Access to personal information is based on role and operational need. The assigned Operator and its authorized personnel can access the records required to verify customers and recipients and handle mail at that location. Depending on the task, this may include customer contact and residential information, verification and business documents, recipient information, exterior images, requested interior scans, forwarding destinations and handling instructions, and limited subscription or payment-status information. Mailbox To Go personnel have different access levels based on their duties.

Mailbox To Go limits access to personal information based on role and operational need. Authorized personnel may access customer records, mail images, scans, and related information only where reasonably necessary to provide support, maintain or secure the Services, investigate an incident or technical issue, comply with law, or perform another authorized business function.

Processing and storage outside Canada

Our primary application, database, verification documents, exterior mail images, and interior mail scans are hosted in Canada, and our designated backup storage for this information is also located in Canada. Some other information, including payment, email, support, chat, analytics, advertising, device, and Website-usage information, may be processed or stored by service providers in the United States or other countries where they or their subcontractors operate. Personal information handled outside Canada may be subject to the laws of the foreign jurisdiction and may be accessible to courts, law-enforcement agencies, national-security authorities, or regulators in that jurisdiction in accordance with local law.

Mailbox To Go remains accountable under applicable Canadian privacy law for personal information under its control, including personal information processed through the Platform or transferred to a service provider for processing on our behalf. We assess the nature and sensitivity of the information, restrict access where appropriate, and use contractual or other means designed to provide a comparable level of protection. Contact our Privacy Officer if you would like information about our policies and practices regarding service providers outside Canada or the countries in which particular categories of information may be processed.

Retention and disposal

We retain personal information only for as long as reasonably necessary for the purposes identified in this Policy and to satisfy legal, tax, accounting, security, fraud-prevention, dispute, chargeback, audit, insurance, and enforcement requirements. Retention depends on the type of information and the circumstances.

Account, verification, mail-handling, and related service records are generally retained while the account or subscription remains active and as needed to provide the Services.
After a subscription expires or an account is closed, verification documents and related verification records may be retained for up to 12 additional months where reasonably necessary for fraud or compliance inquiries, chargebacks, disputes, legal requests, or enforcement. They may be retained longer where required by law, subject to legal process, or necessary for an unresolved investigation or claim.
Interior mail scans are retained while the subscription remains active. If a payment failure or subscription expiry results in a grace period during which the mailbox may be reactivated, the scans remain available during that period. If the mailbox is not reactivated within the applicable grace period, the scans are removed from live storage promptly after the grace period ends, unless longer retention is required by law or reasonably necessary for an unresolved investigation, dispute, legal request, or claim.
Exterior mail images are retained while the subscription remains active and for up to 90 days after the subscription ends, unless the customer deletes them earlier or longer retention is required or reasonably necessary for an unresolved investigation, dispute, legal request, or claim.
When an exterior image or interior mail scan is deleted by the customer or under the retention periods described above, it is removed from live storage promptly. A temporary copy may remain in a backup until that backup is overwritten through the ordinary rotation process. Individual files are not ordinarily removed from an existing backup snapshot.
Mail-handling and related activity records may be retained for up to 12 months after the subscription ends where reasonably necessary for fraud prevention, service history, disputes, chargebacks, investigations, legal requests, or enforcement.
Billing, transaction, tax, corporate, consent, complaint, and legal records may be retained for longer periods where reasonably necessary or required by law.
Security, access, activity, support, and incident records are retained for periods appropriate to their purpose, sensitivity, and applicable legal requirements.
Security-camera recordings controlled by Mailbox To Go or an Operator are generally overwritten or deleted according to the location’s ordinary security-recording cycle and are retained only for as long as reasonably necessary for the purposes described in this Policy and applicable legal requirements. The ordinary recording cycle may vary by location. Recordings connected with an investigation, dispute, legal requirement, or claim may be preserved for longer than the ordinary cycle.
Personal information contained in temporary forwarding labels, working copies, or other materials created by an Operator must be securely destroyed when no longer required.

Eligible mail other than packages, including permitted contents, is generally available in active storage for up to 30 days from the date it first appears in the customer’s account. Packages are generally available in active storage for up to 7 calendar days from the date they first appear in the customer’s account, subject in each case to the Renter Terms and any earlier authorized handling instruction. At the end of active storage, an item is scheduled for secure disposal and is no longer available for recovery or new instructions, except where the Renter Terms expressly permit an exception. Physical shredding, recycling, return, transfer, or other lawful disposal may not occur on that exact day because Operators complete disposal according to their ordinary secure-disposal schedules. In the ordinary course, Customer Mail other than packages will be disposed of no later than 35 calendar days after it is scheduled for disposal, while packages will be disposed of no later than 7 calendar days after they are scheduled for disposal. It remains subject to appropriate safeguards while awaiting disposal. An item may be retained beyond the ordinary period only where required or permitted by law or reasonably necessary to preserve evidence, comply with legal process, investigate an incident, or resolve a dispute or claim.

Ineligible items inadvertently received do not enter the ordinary storage or disposal cycle described above. They remain subject to appropriate custody, privacy, and security safeguards while awaiting return or other resolution under the Renter Terms.

When personal information is no longer required, we delete, destroy, or anonymize it using measures appropriate to its sensitivity. We may retain information that has been irreversibly anonymized so that it can no longer reasonably identify an individual.

Cookies, analytics, and advertising

The Website and Services use cookies and similar technologies for account authentication, security, preferences, payments, live chat, Website analytics, and advertising measurement. These technologies may collect online identifiers, IP-derived approximate location, browser and device information, referring pages, Website interactions, and related usage information, and are described in our Cookie Policy.

We use analytics and advertising technologies provided by third parties to understand Website use, measure performance and conversions, and evaluate advertising. Depending on the technology, this may involve online identifiers, device and browser information, Website activity, conversion information, and limited customer information used for measurement or attribution. Further details about the technologies and providers we use are available in our Cookie Policy.

You can control cookies through your browser and the provider-specific controls described in our Cookie Policy. Blocking necessary technologies may prevent login, payment, live chat, or other parts of the Services from working. Our Cookie Policy provides more information about the technologies we use, their purposes, duration, providers, and available choices.

Email and other communications

We use third-party email providers to deliver account, mail, billing, verification, support, and marketing communications. We may send marketing messages where we have consent or another basis permitted by applicable anti-spam law. Marketing messages identify the sender and include an unsubscribe method. We may retain communication records as reasonably necessary to manage preferences, demonstrate compliance, provide support, and resolve complaints.

Accuracy, access, and correction

You are responsible for providing accurate information and notifying us when relevant account, contact, address, recipient, or business information changes. Some information can be updated through the account. Other changes may require a request to us or reverification by the assigned Operator.

Subject to applicable law, an individual may request:

confirmation of whether Mailbox To Go holds personal information about them;
access to that personal information;
information about how it has been used and the organizations or types of organizations to which it has been disclosed;
correction of information that is inaccurate or incomplete;
withdrawal of consent to an optional use or disclosure; or
deletion of information that is no longer required, subject to lawful retention needs.

Submit a written request to the Privacy Officer using the contact information below. We may ask for enough information to locate the records and verify identity before providing access or making a change. We will not disclose personal information to a person who cannot establish authority to receive it.

Access may be limited or refused where permitted or required by law, including where a record contains personal information about another person, is protected by legal privilege, would reveal confidential commercial information, could threaten safety or security, or cannot be disclosed under applicable law. Where appropriate, we will sever protected information and provide the remainder. We will explain a refusal as required by law.

We will respond within the period required by applicable law. Under the Personal Information Protection and Electronic Documents Act, the ordinary response period for an access request is 30 days, subject to permitted extensions.

Safeguards

We use administrative, technical, and physical safeguards appropriate to the sensitivity, amount, format, and location of the personal information, including measures designed to protect accounts, systems, communications, records, and physical mail against unauthorized access, use, disclosure, alteration, loss, or destruction. Operators are responsible for applying the required physical safeguards at their locations and limiting access to authorized personnel. Mailbox To Go uses access controls to limit each independent Operator to customers at its assigned location.

However, no system, transmission, or storage method is completely secure. We cannot guarantee that information will never be lost, misused, accessed, disclosed, altered, or destroyed without authorization. Customers are responsible for protecting their passwords, devices, email accounts, and authentication methods and for notifying us promptly of suspected unauthorized account access.

Privacy and security breaches

If a breach of security safeguards involving personal information occurs, we will investigate, contain, document, and assess the incident and take reasonable corrective steps. Where applicable law requires it, we will report the breach to the Office of the Privacy Commissioner of Canada or another regulator and notify affected individuals as soon as feasible if the breach creates a real risk of significant harm. We will also notify another organization or government institution where required by law or where doing so may reduce or mitigate the risk of harm. We also maintain records of privacy and security breaches for as long as required by applicable law.

Children

The Services are intended for persons who have reached the age of majority and are able to enter into the applicable agreement. We do not knowingly offer accounts to or collect personal information directly from minors for their own use of the Services. If you believe that a minor has submitted personal information without appropriate authority, contact the Privacy Officer so that we can investigate and take appropriate action.

Links and third-party services

The Website may contain links to websites or services that we do not operate. This Policy does not govern information you provide directly to an unrelated third party through its own website or service. Review the third party’s privacy notice before providing information. This section does not exclude the assigned Operator or a provider processing personal information on our behalf from the responsibilities described elsewhere in this Policy.

Changes to this Policy

We may update this Policy to reflect changes in law, technology, the Services, or our information-handling practices. We will post the updated version and revise the “Last updated” date. If a change is material, we will provide additional notice through reasonable means, such as email, an account notice, or a prominent Website notice, before or when the change takes effect as required by law.

We will obtain additional consent where required before using or disclosing personal information for a materially new purpose. Continued use of the Services does not by itself authorize a new use for which applicable law requires fresh consent.

Questions, requests, and complaints

Mailbox To Go has designated a Privacy Officer to oversee compliance with this Policy and applicable privacy law. To ask a question, request access or correction, withdraw consent, or make a complaint, contact:

Privacy Officer
Mailbox To Go Inc.
103-2727 Steeles Ave W
Toronto, Ontario M3J 3G9
Canada

Or via contact form at https://www.mailboxtogo.com/contact/

Please describe your request or concern in sufficient detail for us to investigate. We may need to verify your identity and authority before discussing or disclosing personal information. We will investigate privacy complaints and respond within the period required by applicable law.

You may also direct a complaint to us about an Operator’s handling of personal information in connection with the Services. We may coordinate with the Operator to investigate and respond, without limiting any responsibility or right that applies directly to either organization under law.