Who we are
LetterAid is operated by [LEGAL COMPANY NAME], the data controller for the personal data you provide. You can reach us at hello@letteraid.co.uk.
What we collect
When you use LetterAid we collect:
- Contact details - your name and email address
- Questionnaire answers - the information you provide about your situation, which may include sensitive personal data such as your National Insurance number, address, financial circumstances, health, or housing situation, depending on the letter type
- Payment metadata - Stripe's record of the transaction (we do not see or store your card details)
- Order record - an internal reference number, the letter type, the price, and timestamps
Why we collect it and our lawful basis
We process your data to deliver the service you bought (Article 6(1)(b) - performance of a contract). Where sensitive data is involved, we rely on Article 9(2)(a) - your explicit consent given when you submit the questionnaire.
We do not use your data for marketing, profiling, or any purpose other than producing the letter you asked for.
How long we keep it
- Questionnaire answers (including any sensitive personal data): deleted automatically 12 months after delivery
- Generated letter draft: deleted automatically 12 months after delivery
- Supporting files you upload: deleted automatically 3 days after your letter is sent or posted, and within 24 hours if you never complete your order
- Order record (without questionnaire content): retained for 6 years for tax/accounting purposes as required by HMRC
Who we share it with
We use the following sub-processors. Each has signed appropriate data protection agreements:
- Stripe - payment processing (UK / EU data centres)
- MongoDB Atlas - secure database hosting (UK / EU region)
- Vercel - website hosting and serverless functions (UK / EU region)
- Resend - outbound email delivery (EU data centre)
- Anthropic - letter drafting via the Claude API (USA, with EU SCCs in place)
- Stannp - printing and posting your letter, if you choose that option. Receives the recipient's name and address (UK)
- Cloudflare R2 - secure storage for any supporting files you upload (EU region)
We do not sell or otherwise share your data with third parties.
Your rights
Under UK GDPR you have the right to:
- Access - request a copy of the personal data we hold about you
- Rectification - ask us to correct anything that's wrong
- Erasure - ask us to delete your data (subject to the 6-year HMRC retention for the order record itself)
- Restrict processing - ask us to pause processing while a query is resolved
- Portability - request your data in a portable format
- Object - object to processing on grounds relating to your particular situation
To exercise any of these, email hello@letteraid.co.uk. We aim to respond within one month.
Cookies
LetterAid uses only the cookies it strictly needs to function:
- Session cookie for the admin login (used by our team, not by customers)
- Stripe checkout cookies during the payment flow (set by Stripe on stripe.com)
We do not use analytics, advertising, or tracking cookies. If we ever do, we'll ask you first.
Complaints
You have the right to complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk if you believe we have mishandled your data. We'd appreciate the chance to address any concern first - email hello@letteraid.co.uk.
Changes to this policy
If we materially change how we handle your data, we'll update this page and bump the "last updated" date at the top. For substantive changes, we'll email anyone affected.