Privacy notice

Who is responsible

The controller is [Legal entity name], [Registered address] (registration [Chamber of Commerce (KvK) number]). Contact us about privacy at support@example.com.

What we collect and why

• Your email address, to send your documents, the link to your draft and order, and the confirmations the law requires. Basis: performing our contract with you.
• Your answers: names and addresses of you and the other party, what was agreed, amounts, dates, what happened, and your payment details for the letter. We ask only for what goes into the documents. Basis: performing our contract with you.
• Files you upload as evidence. They are kept in private storage. We extract their text on our own servers and send that text once to the AI model provider to suggest a short summary of each file, which you check and can edit; only your summary is used in your documents, and the files themselves are never sent. Basis: performing our contract with you.
• Payment records: amount, currency, date, tax and payment references. Stripe processes your card or bank details; we never see or store them. Basis: performing the contract and our legal duty to keep sales records.
• Your confirmations at checkout (the AI disclosure and, for EU buyers, the request to start immediately), with the time you gave them. Basis: our legal duty to be able to show them.
• Technical data: your IP address and email are turned into one-way hashes to limit abusive traffic; hashes are kept for at most one day. Basis: our legitimate interest in keeping the service secure.

Please do not include health information or other sensitive details that the letter does not need. The other party's name and address are processed because you need them in your letter; you are responsible for having a lawful reason to use them.

How the AI is used

An AI model provider generates your documents from your answers and your evidence summaries, and suggests those summaries from the text of your uploaded files. We use it as a processor under a data processing agreement: it processes your information only to produce your documents and, under its commercial terms, does not use it to train models. No decision with legal or similarly significant effects on you is made by automated means; you decide whether to send anything. See the AI disclosure.

Who we share it with

• Supabase (database and file storage), in a data centre in the European Union.
• Anthropic (the AI model provider), which processes your answers and the text of your uploaded files to generate your documents.
• Stripe (payments and tax calculation).
• Resend (sending emails).
• Vercel (hosting the website and running the application).

Some of these providers are based in, or may process data in, the United States. Where data leaves the European Economic Area, the transfer is covered by the provider's data processing agreement, using the EU Standard Contractual Clauses or the EU-US Data Privacy Framework as applicable. We never sell your information and never contact the other party.

How long we keep it

• Your answers, uploaded files and generated documents: deleted 30 days after delivery, or immediately when you ask.
• Drafts you never pay for: deleted 30 days after your last change.
• The record of the sale (amount, dates, payment references and your checkout confirmations) is kept for as long as tax law requires, without your email address once your data is deleted. Stripe keeps its own payment records under its privacy policy.

Cookies

We set one strictly necessary cookie that holds the access key to the draft you are working on, so your draft survives a refresh and the payment step. It expires after 30 days. We use no analytics, advertising or tracking cookies, so we do not ask for cookie consent. Before your draft is saved, the answers on the first step are kept in your browser tab only.

Your rights

You can ask for access to, correction or deletion of your information, restriction of or objection to its processing, and a copy in a portable format. The fastest way to delete everything is the “Delete my data now” button on your order page or the link in your delivery email. For anything else write to support@example.com. You can also complain to your data protection authority; in the Netherlands that is the Autoriteit Persoonsgegevens.

Security

Your order is reachable only with a long random key sent to you; we store it only in hashed and encrypted form. Files and documents are in private storage that is not publicly accessible. Connections are encrypted.