# Datenschutzerklärung

Zuletzt aktualisiert: 14. Oktober 2026

Die verbindliche Fassung dieses Textes ist derzeit die englische. Eine deutsche Übersetzung folgt nach anwaltlicher Prüfung.

This policy describes what the service does today. When the service changes, this page changes first.

## Wer verantwortlich ist

The controller under the GDPR is:

Sara Meindl  
Höllriegelstraße 1a  
2380 Perchtoldsdorf  
Austria  
[support@agentletterdesk.com](mailto:support@agentletterdesk.com)

Write to this address for every question and request about your data.

## Kurz gesagt

- The text of a letter, its addresses and its enclosures stay on our server only until the letter reaches a final state: sent, failed, unresolved, cancelled or expired. Then they are deleted.
- We never store the PDF of a letter. The preview is drawn again each time you open it.
- A print partner keeps its own copy of each letter that it receives. The [retention table](https://agentletterdesk.com/de/privacy#retention) says for how long.
- Each letter and each enclosure passes an automatic content check on Cloudflare Workers AI before it gets a price.
- Our logs never contain letter text, sign-in codes, e-mail addresses or postal addresses.
- We count what happens in the service (usage statistics) with a pseudonymous account code, never with names, addresses or letter text.
- These pages have no tracking or analytics scripts and load nothing from other servers. They set a cookie only when you choose a language.

## Was wir verarbeiten und warum

### Ihr Konto

Your e-mail address, if you sign in with one. Your full name: it is the sender name on every letter. Your sender addresses (without the name), your preferences (language, e-mails about your letters) and the time you last deleted or changed a sender address. The language of your first sign-in (English or German): the language that you chose with the language link on our pages, the language that your AI app sends, or the language of your browser. Our pages and e-mails use it when you chose no language in your preferences. How you sign in: your e-mail address, a Google account ID, or the label of a tester access code. We need this to give you an account and to send letters in your name (GDPR Art. 6(1)(b), contract).

### Ihre Briefe

While a letter waits for your approval, or while a send waits for the printer’s confirmation, we keep its content: the recipient’s name and address, your address, the text and the enclosures. We need it to show you the preview and to mail the letter (Art. 6(1)(b)).

After a letter is done, we keep a record without the text: letter ID, purpose, country (for a US letter also the recipient’s state until the letter is sent; then it only adds one to our count of letters per state and year, for sales tax), status, recipient name, whether we verified the recipient’s address, page count, price, postal service, the printer’s IDs, tracking number and times. We also keep a fingerprint of the PDF (SHA-256), which shows that a copy is the letter that was mailed, and two keyed hashes: one finds the same letter sent twice, one counts letters from one sender to one recipient. We need the record to show you the status and to prove what was mailed (Art. 6(1)(b)), and the hashes to prevent duplicates and abuse (Art. 6(1)(f), our legitimate interest in a postal service that cannot be used for harassment).

### Status Ihrer Briefe

The printer and the post report what happens to a letter: accepted, handed to the post, a tracking number, scans in the mail, delivered, undeliverable or returned. For each report we store what happened, the printer’s code for it, when it happened, when we received it and the tracking number. We store no addresses, no text, no images and no place. We need these events to show you and your AI app the status, to send you the status e-mails and to notice a letter that does not reach the post (Art. 6(1)(b)).

If status e-mails are on (they are on until you turn them off on your account page or through your AI app), we e-mail you when a letter is handed to the post, when the post records the delivery of a registered letter, and when the post cannot deliver a letter or returns it. The e-mail names the postal service, the destination country, the date, the tracking number and the first characters of the letter ID. It never contains the recipient’s name or address or the text of the letter. We store which of these e-mails went out, so that each goes out once (Art. 6(1)(b)).

### Anmeldung und Sicherheit

A session cookie keeps you signed in on our pages; we store only a hash of it. Sign-in codes are stored only as keyed hashes, with the e-mail address they were sent to. With each code request we store a keyed hash of your network address (IP), to limit requests per network. To preselect your country on the address form, we read the country that Cloudflare derives from your connection; we do not store it. We count content checks per account for two hours, to protect the shared check capacity. Purposes: sign-in and protection against abuse (Art. 6(1)(b) and (f)).

### Verbundene Apps

When you connect an AI app, we store which app you connected, the permissions you granted, and its tokens as hashes. Access tokens are valid for one hour, refresh tokens for 30 days (Art. 6(1)(b)).

### Diese Website und unsere Logs

To deliver a page, Cloudflare processes your IP address and the details of the request. Our logs hold the request method, the requested URL, status codes and error names, and for a request from an AI app the tool it called and the name of the app. They never hold letter text, sign-in codes, e-mail addresses or postal addresses (Art. 6(1)(f), our legitimate interest in running and securing the service).

### Nutzungsstatistik

We record what happens in the service, for example “an app was connected”, “a letter was prepared, sent or handed to the post”, or an error code. A record holds a pseudonymous account code (a keyed hash that only we can link to an account), the AI app (for example Claude or ChatGPT), the destination country, the postal service, the price, the page count, the letter ID and codes. It never holds names, postal addresses, e-mail addresses or letter text. Cloudflare stores the records (Workers Analytics Engine) for 3 months; daily counts without the account code stay in our database for 90 days. We e-mail ourselves short notices with the same data, through Resend, to our support address, which forwards them to our mailbox at Gmail. Purpose: see that letters go out, and find problems early (Art. 6(1)(f), our legitimate interest in a reliable service).

### Fehlerberichte

When our server has an unexpected error, it sends an error report to Sentry (Functional Software, Inc., USA), which stores it in its EU region (Frankfurt, Germany). A report holds the type of the error, the place in our code, the time, the server version and the requested path without its parameters. It never holds letter text, enclosures, names, postal or e-mail addresses, sign-in codes or your IP address. Purpose: find and fix errors fast (Art. 6(1)(f)). Reports are deleted after 30 days.

### E-Mails an uns

If you write to [support@agentletterdesk.com](mailto:support@agentletterdesk.com), Cloudflare Email Routing (Cloudflare, Inc.) forwards your message to our mailbox at Gmail (Google LLC, USA, through Google Ireland Ltd.), where we read and answer it. We use your message and address to answer you (Art. 6(1)(b) or (f)). We keep support e-mails as long as we need them to answer and for our records.

## Die Inhaltsprüfung

Before a letter gets a price, and before an enclosure is added, two AI classifiers on Cloudflare Workers AI read its text. For an image or a scanned document, a model on Workers AI first turns it into text. The check looks for threats, harassment, stalking, extortion, hate, sexual content and letters that pretend to come from a court or an authority. We log only the category codes of a refusal, never the text.

The check decides automatically whether a letter can be prepared. A refused letter is not prepared and not sent; it has no other effect. The refusal names the reason in plain words and has a refusal ID. For each refusal we store the refusal ID, the category codes, whether a letter or a file was refused, and the time, for 90 days or until you delete your account; never the text.

**Human review.** If you think a refusal is wrong, e-mail the letter text or the file to [support@agentletterdesk.com](mailto:support@agentletterdesk.com) with the refusal ID. We did not keep the text, so we need it from you. A person reviews the decision and answers within one month (GDPR Art. 22(3)). We use what you send only for the review.

Before this check, a word check without AI refuses letters that end an employment in Germany or the lease of a home in Germany or Austria: the law requires a handwritten signature for them, and our letters carry a typed name. It stores no letter text: only a keyed fingerprint of the refused letter, for two hours, so that your confirmation applies to that letter. If the check is wrong, you confirm that through your AI app, and the letter is prepared.

Legal basis: Art. 6(1)(f), our legitimate interest, and the recipients’ interest, in a service that cannot be used to threaten or harass people, and that does not mail letters without legal effect.

## Warteliste

If you join the waitlist on [our waitlist page](https://agentletterdesk.com/waitlist), we store your e-mail address, the country you chose (optional), the language of the page and the time, and we send you one e-mail with a confirmation link (double opt-in). Only when you open the link and confirm are you on the list; we store the time of the confirmation as the record of your consent. We use the data for one purpose: to send you one e-mail when Agent Letter Desk opens. We send nothing else and give the address to no one. Legal basis: your consent (GDPR Art. 6(1)(a)), which you give with the confirmation. You can withdraw it at any time.

If you do not confirm within 7 days, we delete the entry. We keep a confirmed entry until we send that e-mail, or until you ask us to delete it. If our e-mail service refuses your address repeatedly, we delete the address. If we cannot find out within 20 hours of the first try whether the e-mail went out, we delete the address without a further try. To delete it, open the remove link in the confirmation e-mail, or write to [support@agentletterdesk.com](mailto:support@agentletterdesk.com) from the address on the list. To limit sign-ups per network, we store a keyed hash of your network address (the IP address; for IPv6, its /64 network) for two hours.

## Cookies

Only the sign-in, account, waitlist and order pages and the language link set cookies, and only these:

- `__Host-ald_session`: keeps you signed in, 30 days or until you sign out.
- `__Host-ald_pending`: holds the e-mail address that waits for its sign-in code, signed, 10 minutes.
- `__Host-ald_google`: the state of a Google sign-in, signed, 10 minutes.
- `__Host-ald_lang`: the language that you chose with the language link on our pages (`en` or `de`), 1 year. Only a click on the link or a language choice in your account preferences sets it; "Automatic" deletes it.

They are strictly necessary for what you ask for (the sign-in, the language you chose), so they need no consent (§ 165 (3) TKG 2021). The other pages, this one included, set a cookie only when you choose a language with the language link.

## Wer sonst Daten erhält

These companies process data for us. Each one works under a data processing agreement, unless this list says otherwise:

- **Cloudflare, Inc.** (USA) runs our server, database and key store, delivers these pages, keeps our logs and usage statistics, and runs the content check on Workers AI.
- **Functional Software, Inc.** (Sentry, USA) stores our error reports in its EU region (Frankfurt). A report holds no letter text, names, addresses or sign-in codes.
- **PostGrid, Inc.** (a Delaware corporation, USA) prints and mails letters within the United States. It processes them in the USA. It receives the PDF with the sender’s and the recipient’s address. Before the launch it does not print or mail anything. PostGrid keeps its records of each letter, with the PDF and the addresses, without a time limit. When we ask PostGrid to delete them, it deletes them within 30 days, and copies in its backups usually within one year.
- **Pingen GmbH** (Zurich, Switzerland) prints letters to European countries and hands them to the post or to DHL. It receives the PDF with the sender’s and the recipient’s address. Before the launch it does not print or mail anything. Pingen deletes the PDF after 1 month and the addresses after 6 months. Our Pingen account uses these periods, the shortest that Pingen offers. When Pingen deletes the addresses, it turns the recipient’s address into map coordinates. Pingen does not publish how long it keeps these coordinates, the status events of a letter (some with an image) and the tracking number. Its privacy policy says, in general, that it keeps data until the end of the contract or 18 months after the order. We do not have a data processing agreement (GDPR Art. 28) with Pingen yet. We asked Pingen for one. Until we have it, Pingen prints and mails no letter for us.
- **Resend, Inc.** (USA) sends the e-mail with your sign-in code, the waitlist e-mails (the confirmation, and one e-mail when Agent Letter Desk opens) and the e-mails about the status of your letters, from its EU region (Ireland, eu-west-1). It receives your e-mail address and the e-mail: the code, the confirmation link, the launch e-mail or the status of a letter.

**Sign in with Google.** If you choose “Continue with Google”, Google (Google Ireland Ltd.) confirms your identity and tells us your name and e-mail address, with your Google account ID and whether Google verified the address. Google acts as an independent controller; its privacy policy applies.

**Your AI app.** When you use Agent Letter Desk through an AI app, such as Claude by Anthropic, ChatGPT by OpenAI or Grok by xAI, the app sends us what you want in the letter and receives our answers: the letter text, the price, the preview link and the status. The provider of the app decides on its own processing. Its privacy policy applies.

**The recipient** of a letter receives the letter, with your name and address, once it is mailed.

## Übermittlung in Länder außerhalb der EU

Cloudflare stores and processes data on its network, which includes the USA. Support e-mails are stored at Google (Gmail), which also processes data in the USA. Resend, Inc. is a US company; it sends our e-mails from its EU region. Sentry (Functional Software, Inc.) is a US company; it stores our error reports in its EU region. PostGrid, Inc. is a US company (Delaware) and processes US letters in the USA. For this transfer we rely on the EU standard contractual clauses in PostGrid’s data processing addendum. Pingen is in Switzerland: the European Commission decided that Switzerland protects personal data adequately. For other transfers to the USA we rely on the EU–U.S. Data Privacy Framework where the recipient is certified under it, and otherwise on the EU standard contractual clauses.

## Wie lange wir Daten speichern

| Daten | Gespeichert |
| --- | --- |
| Letter text, addresses and enclosures | Until the letter reaches a final state. A preview that is not sent expires after 12 hours. A send that the printer does not confirm ends after at most 20 hours. |
| Record of a letter (no text) | As long as your account exists |
| PostGrid’s records of a letter, with the PDF and the addresses | Without a time limit. When we ask PostGrid to delete them: within 30 days, and in its backups usually within one year |
| Pingen’s copy of a letter: the PDF, and the sender’s and the recipient’s address | The PDF 1 month, the addresses 6 months (the shortest periods that Pingen offers) |
| Pingen’s other records of a letter: the status events (some with an image), the tracking number, and the recipient’s address as map coordinates after the addresses are deleted | Not published. Pingen’s privacy policy, in general: until the end of the contract or 18 months after the order |
| Status events of a letter (what happened, when, the printer’s code, the tracking number) and the record of which status e-mails went out | 15 months after we receive them, or until you delete your account |
| Account: e-mail address, name, sender addresses, preferences, the language of your first sign-in | Until you delete your account |
| Sessions (hashed) | 30 days, or until you sign out |
| Sign-in codes (keyed hashes), the e-mail address they were sent to, and the network address (keyed hash) | A code works for 10 minutes; the rows are deleted after 25 hours |
| Content-check counters | 2 hours |
| Content-check refusals (refusal ID, category codes, letter or file, time; no text) | 90 days, or until you delete your account |
| Waitlist: e-mail address, country, page language, time of sign-up and of confirmation | Not confirmed: 7 days. Confirmed: until we send the launch e-mail or cannot deliver it, or until you remove it or ask us to delete it |
| Waitlist sign-ups per network (keyed hash of the IP) | 2 hours |
| Connected apps (hashed tokens) | Until you disconnect the app or delete your account |
| Logs at Cloudflare | At most 7 days |
| Usage statistics (pseudonymous account code, app, country, service, price, codes) | 3 months; daily counts without the account code 90 days; our own notices at most 14 days |
| Error reports at Sentry | 30 days |

When you delete your account, we delete your account data, sessions, addresses and connected apps at once, and we delete the content of letters that were not sent. The records of your letters lose your account, the recipient name, the tracking number and the printer’s ID, and we delete their status events. The rest (keyed hashes, status, times, price) stays for 30 days, so that the limits cannot be reset by deleting an account. Then it is deleted. The copies at our print partners are not deleted with your account: they stay for the periods in the table above.

## Ihre Rechte

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interests (GDPR Art. 15 to 21). Write to [support@agentletterdesk.com](mailto:support@agentletterdesk.com).

On your [account page](https://agentletterdesk.com/account) you can change your name and addresses, disconnect apps and delete your account yourself.

You can also complain to the Austrian data protection authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, [www.dsb.gv.at](https://www.dsb.gv.at/).