Privacy Policy

This policy is issued by Instant Authority LLC, doing business as Direct Marketing Monster and covers directmarketingmonster.com, the advertiser portal, the landing pages we publish for advertisers, and the tracked phone numbers we provide them.

Two different groups of people appear in this policy:

• Advertisers — businesses who buy or enquire about a slot on the card.
• The public — people who call a tracked number, text it, visit an advertiser’s landing page or fill in a form there. If that is you, clause 4 is the part written for you.

• Enquiries. Name, business name, email address, phone number, the category you are after and anything you type into a message box on our contact form, waitlist or reservation form.
• Newsletter and offer signups. Your email address and, if you give it, your business name.
• Intake details for your advertisement. Business name, display phone number, address, website, hours, your headline and offer, and any logo or photograph you upload.
• Business lookups. When you start typing your business name we query Google’s Places service to help you pick the right listing, and store the identifier Google returns so we can look up your public listing later.
• Account and portal. The email address you sign in with, and records of the links we email you to access intake, proofs and the portal.
• Payments. Amounts, dates, package, and the customer and subscription identifiers Stripe gives us. We never receive or store your card number — payment happens on Stripe’s own checkout page.
• Correspondence. A record of the emails and texts we send you about deadlines, proofs, results and billing, and private notes we keep about our dealings with you.

Our web host records ordinary server logs — IP address, browser type, the page requested and when — which we use to keep the site running and secure.

Advertiser landing pages are described separately in clause 4, because they do carry an advertising pixel.

You reached a local business through a card we mailed. That business is our customer; we run the phone number and the web page it sent you to. Here is exactly what that means.

When you call or text a number from one of our cards we record:

• your phone number, the time of the call and how long it lasted;
• whether the call was answered, and an audio recording of it;
• the content of text messages you send to or receive from that number.

Audio recordings are deleted automatically 90 days after the call. The details around them — number, time, duration, whether it connected — are kept longer, because the advertiser’s historical reports are built from them.

When you visit an advertiser’s landing page we record the visit, which card drop brought you there, and anything you type into the form on that page — typically your name, phone number, email address and a description of the work you want. That goes to the advertiser, because contacting them is the point.

Those pages carry a single advertising pixel shared across all of them, which lets us measure response and show advertising to people who have visited. You can limit that through your browser settings and through the ad preferences of the platform concerned.

What we never do with it: we do not sell it, we do not add you to a marketing list of our own, and we do not text you cold. We hold it so the advertiser can answer you and see whether their advertising worked.

To ask what we hold about you or to have it deleted, email support@directmarketingmonster.com with the phone number you called from. We will honour the request whether or not a law in your state requires us to.

• To answer enquiries, quote, and take payment.
• To design, print and mail the card and to publish landing pages.
• To route calls and texts to the right advertiser and to report on them.
• To send advertisers what they need to keep a drop on schedule — intake requests, proofs, artwork deadlines, results, renewal reminders and billing notices.
• To send our newsletter and offers to people who asked for them, until they unsubscribe.
• To detect fraud, keep the systems secure, keep accounting records and comply with law.

We rely on your consent for marketing email and text, and on the performance of our contract with an advertiser, and on our legitimate interest in running and securing the business, for everything else.

We do not sell personal information, and we do not share it for anyone else’s marketing. We use the following service providers, each of which handles a defined part of the job under its own terms:

• Supabase — the database, file storage and sign-in behind the site and the portal.
• Stripe — payments, subscriptions and the billing portal.
• GoHighLevel — the tracked phone numbers, call recording and text messaging.
• Resend — transactional email, such as proofs, deadlines and receipts.
• MailerLite — the newsletter and offer list.
• Google — business lookups through the Places service.
• Our web host — serving the sites.
• Meta — the shared advertising pixel on landing pages described in clause 4.

We also pass a lead to the advertiser whose advertisement produced it — that is the whole purpose — and we give our printer and the Postal Service what they need to print and deliver the card, which contains no personal data beyond what is on the advertisement itself.

We will disclose information if the law requires it, and if the business is ever sold the records go with it, subject to this policy.

• Call recordings — 90 days, then the audio is deleted automatically.
• Call, text and visit records — for as long as the advertiser has a relationship with us, so their reports remain accurate, and then in aggregate.
• Leads and enquiries — while they are live, and afterwards as a business record.
• Advertiser records, invoices and tax records — as long as the law requires, generally seven years.
• Newsletter subscriptions — until you unsubscribe, plus a record that you did.
• Landing pages of former advertisers — the page stays live 90 days after their last card mails, then becomes a notice that the offer has ended.

Data is held in an access-controlled database with row-level security, so an advertiser signed in to the portal can reach their own records and no one else’s. Uploaded files are served through short-lived signed links rather than public addresses. Traffic is encrypted in transit. Card numbers never touch our systems.

No system is perfect, and we do not claim otherwise. If a breach affects you we will tell you.

• Email. Every marketing email has an unsubscribe link. Service messages about a drop you have paid for are not marketing and continue.
• Text. Reply STOP to any message from us.
• Access, correction and deletion. Email us and we will tell you what we hold, correct it, or delete what we are not required to keep.
• Recordings. If you called an advertiser and want the recording of your call deleted before its 90 days are up, tell us the number you called from and roughly when.

North Carolina does not currently have a comprehensive consumer privacy statute. We handle these requests the same way regardless of where you live.

Nothing we run is directed at children, and we do not knowingly collect information from anyone under 13. If you believe we have, tell us and we will delete it.

If this policy changes we will update the date at the top of this page, and tell current advertisers by email where the change is material.