Privacy Policy
Effective September 18, 2026
Quillus is a proximity direct-mail marketing service operated by B2 Holdings LLC, an Ohio limited liability company (“Quillus,” “we,” “us,” or “our”). This policy explains what information we collect, how we use it, how we share it, and the choices and rights you have. It applies to www.quillus.com and the Quillus application (together, the “Service”).
Who this policy covers
This policy describes our practices for two groups of people:
- Customers — the businesses and individuals who create a Quillus account to design and send postcards.
- Recipients and prospects — people and businesses whose mailing addresses appear in a campaign, who scan a postcard QR code, or whose publicly available business information we collect to identify potential customers.
For mailing lists a customer uploads, the customer decides who is contacted and why; we process that data on the customer’s behalf to print and mail their cards. For data we collect ourselves (described below), we act as the business responsible for that data.
Information we collect
Account information you provide: your name, email address, phone number, business name, return mailing address, and — if you sign in with Google — the basic profile and email associated with your Google account. We may collect phone verification to gate free samples and prevent abuse.
Campaign data you create or upload: the recipient addresses you select on the map or import as a list, your contacts, postcard designs, uploaded images, brand assets, and the message content you choose to print.
Prospect information we collect ourselves: to identify businesses that might benefit from Quillus, we collect publicly available business information (such as business names, categories, addresses, and website content) and standard mailing-address and property reference data. We use this to build and mail our own marketing. We do not build profiles of individuals for sale, and — as stated below — we do not sell or license this data.
Engagement data: when a recipient scans the QR code on a mailed postcard, we record the scan event — the address the card was mailed to, the time, and coarse device/browser information — so we can attribute scans to campaigns. We do not collect the scanner’s precise location.
Payment information: card payments are processed by Stripe. We do not store your full card number; Stripe handles card data under its own security and privacy terms, and shares with us only limited metadata (such as the result of a charge and the last four digits).
Technical, cookie, and analytics data: standard log data, session and authentication cookies needed to operate and secure the Service, and limited analytics (described under “Cookies and analytics”).
How we use information
We use information to:
- print, address, and mail your postcards through our print/mail partner;
- operate the map, imagery, design, and QR tracking features;
- process payments and prevent fraud and abuse;
- provide analytics on sends and scans;
- power optional AI features, such as scanning a website to pre-fill a brand kit and assisting with template content (see "Automated processing and AI features");
- identify and reach potential customers with our own marketing;
- communicate with you about your account, campaigns, and (where permitted) marketing; and
- comply with law and enforce our agreements.
How we share information
We share information only with the service providers needed to deliver the Service, including our print-and-mail partners to produce and mail cards, Stripe for payments, Amazon Web Services for hosting, Google Maps Platform for satellite/Street View imagery, and Google for sign-in and analytics. These providers act on our instructions and are bound by their own obligations. We may also disclose information if required by law, to enforce our terms, or to protect the rights and safety of Quillus, our users, and the public, and in connection with a business transfer.
We do not sell or share your personal information (including the prospect and address data we collect) for money or for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act and similar laws. We do not license or transfer our prospect or address data to third parties for their own use.
Text messages (SMS) and your mobile number
If you add a mobile number under Settings › Account, we collect that number together with the express consent you give by ticking the opt-in box, and we use them only to send you account and support text messages: a one-time verification code confirming the number is yours, replies inside a support conversation you start by texting our business number, and service notices about your account. Message frequency varies. Message and data rates may apply. You can reply STOP at any time to opt out, or HELP for help.
If you scanned the QR code on a postcard one of our business customers mailed and chose to text us from the page that opened, we collect the mobile number you texted from, the text itself, and the mailing address and campaign the QR code identifies. We use them to relay the conversation between you and that business and to measure how quickly the business responds, and we store the number on that business’s contact record for the mailing address so it can follow up on your inquiry. That business may text or call you back about your inquiry. We do not use the number for promotions, and neither we nor the business may add it to a marketing list without a separate opt-in from you. Reply STOP at any time to end the conversation.
We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes. Mobile opt-in information is never sold, rented, or released to any third party for their own marketing, and it is excluded from every data-sharing arrangement we have. We disclose your mobile number only to the messaging carrier and to our messaging provider (Twilio) to the extent needed to deliver the messages you asked for, or where the law requires it. Opting out of text messages does not affect your account or the other ways we contact you.
Automated processing and AI features
Quillus offers optional features that use automated tools and third-party AI services (such as Amazon Web Services AI offerings) to make the product easier to use — for example, scanning a business website to suggest brand colors and copy, assisting with postcard content, and moderating uploaded images for prohibited content. These features support your choices; they do not make legal or significant decisions about you without human involvement. Content you process through these features is used to provide the feature and is not used to train third-party public models on your behalf.
Cookies and analytics
We use cookies and similar technologies that are necessary to sign you in and keep the Service secure, and a limited set of analytics tools (such as Google Analytics and Google Search Console) to understand how the Service and our marketing pages are used. You can control cookies through your browser settings; disabling necessary cookies may prevent you from signing in.
Data retention
We retain account and campaign data for as long as your account is active and as needed to provide the Service, comply with legal and tax obligations, resolve disputes, and enforce our agreements. We retain engagement and prospect data only as long as it is useful for the purposes above. You may request deletion of your account data as described below.
Security
We use industry-standard safeguards — encryption in transit, access controls, least-privilege permissions, and managed cloud infrastructure — to protect information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and any regulators as required by applicable law.
Your privacy rights
You can access and update your account information in Settings. Depending on where you live, you may have the right to request access to, correction of, a copy of, or deletion of your personal information, and to opt out of the “sale” or “sharing” of personal information or targeted advertising. Because we do not sell or share personal information or use it for targeted advertising, there is nothing to opt out of in that respect — but you may still exercise your other rights.
Residents of California (CCPA/CPRA), Virginia (VCDPA), Colorado, Connecticut, and other states with comprehensive privacy laws have these rights under their state law. We do not discriminate against you for exercising them. To make a request, email Quill@Quillus.com; we will verify your request and respond within the timeframe required by law. You may use an authorized agent where the law permits.
If you received mail from us
If you received a postcard from Quillus or a Quillus customer and do not wish to receive further mail, email Quill@Quillus.com with the mailing address on the card and we will remove it from our own mailings and pass the request to the relevant customer where applicable.
Children’s privacy
Quillus is a business tool and is not directed to children under 16. We do not knowingly collect personal information from children.
Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you.
Contact
Quillus is operated by B2 Holdings LLC. Questions about this policy? Email us at Quill@Quillus.com.