This policy describes what the service does today. When the service changes, this page changes first.
Who is responsible
The controller under the GDPR is:
Sara Meindl
Höllriegelstraße 1a
2380 Perchtoldsdorf
Austria
support@agentletterdesk.com
Write to this address for every question and request about your data.
In short
- The text of a letter, its addresses and its enclosures stay on our server only until the letter reaches a final state: sent, failed, unresolved, cancelled or expired. Then they are deleted.
- We never store the PDF of a letter. The preview is drawn again each time you open it.
- Each letter and each enclosure passes an automatic content check on Cloudflare Workers AI before it gets a price.
- Our logs never contain letter text, sign-in codes, e-mail addresses or postal addresses.
- These pages set no cookies, have no analytics and load nothing from other servers.
What we process, and why
Your account
Your e-mail address, if you sign in with one. Your full name: it is the sender name on every letter. Your sender addresses (without the name). How you sign in: your e-mail address, a Google account ID, or the label of a tester access code. We need this to give you an account and to send letters in your name (GDPR Art. 6(1)(b), contract).
Your letters
While a letter waits for your approval, or while a send waits for the printer’s confirmation, we keep its content: the recipient’s name and address, your address, the text and the enclosures. We need it to show you the preview and to mail the letter (Art. 6(1)(b)).
After a letter is done, we keep a record without the text: letter ID, purpose, country, status, recipient name, whether we verified the recipient’s address, page count, price, postal service, the printer’s IDs, tracking number and times. We also keep a fingerprint of the PDF (SHA-256), which shows that a copy is the letter that was mailed, and two keyed hashes: one finds the same letter sent twice, one counts letters from one sender to one recipient. We need the record to show you the status and to prove what was mailed (Art. 6(1)(b)), and the hashes to prevent duplicates and abuse (Art. 6(1)(f), our legitimate interest in a postal service that cannot be used for harassment).
Sign-in and security
A session cookie keeps you signed in on our pages; we store only a hash of it. Sign-in codes are stored only as keyed hashes. With each code request we store a keyed hash of your network address (IP), to limit requests per network. To preselect your country on the address form, we read the country that Cloudflare derives from your connection; we do not store it. We count content checks per account for two hours, to protect the shared check capacity. Purposes: sign-in and protection against abuse (Art. 6(1)(b) and (f)).
Connected apps
When you connect an AI app, we store which app you connected, the permissions you granted, and its tokens as hashes. Access tokens are valid for one hour, refresh tokens for 30 days (Art. 6(1)(b)).
This website and our logs
To deliver a page, Cloudflare processes your IP address and the details of the request. Our logs hold the request method, the requested URL, status codes and error names. They never hold letter text, sign-in codes, e-mail addresses or postal addresses (Art. 6(1)(f), our legitimate interest in running and securing the service).
E-mails to us
If you write to us, we use your message and address to answer you (Art. 6(1)(b) or (f)).
The content check
Before a letter gets a price, and before an enclosure is added, two AI classifiers on Cloudflare Workers AI read its text. For an image or a scanned document, a model on Workers AI first turns it into text. The check looks for threats, harassment, stalking, extortion, hate, sexual content and letters that pretend to come from a court or an authority. We log only the category codes of a refusal, never the text.
The check decides automatically whether a letter can be prepared. A refused letter is not prepared and not sent; it has no other effect. If you think a refusal is wrong, write to us. Legal basis: Art. 6(1)(f), our legitimate interest, and the recipients’ interest, in a service that cannot be used to threaten or harass people.
Who else receives data
These companies process data for us, under data processing agreements:
- Cloudflare, Inc. (USA) runs our server, database and key store, delivers these pages, keeps our logs, and runs the content check on Workers AI.
- PostGrid Inc. (Canada) prints and mails letters within the United States. It receives the PDF with the sender’s and the recipient’s address. In test mode it does not print or mail anything. It keeps letters for its own retention period.
- Pingen AG (Switzerland) prints letters to European countries and hands them to the post or to DHL. It receives the PDF with the sender’s and the recipient’s address. In test mode it does not print or mail anything. It keeps letters for its own retention period.
- Resend (USA) sends the e-mail with your sign-in code. It receives your e-mail address and the code.
- Google signs you in if you choose “Continue with Google”. We receive your Google account ID, your e-mail address and whether Google verified it.
Your AI app. When you use Agent Letter Desk through an AI app, such as Claude by Anthropic or ChatGPT by OpenAI, the app sends us what you want in the letter and receives our answers: the letter text, the price, the preview link and the status. The provider of the app decides on its own processing. Its privacy policy applies.
The recipient of a letter receives the letter, with your name and address, once it is mailed.
Transfers outside the EU
Cloudflare stores and processes data on its network, which includes the USA. PostGrid is in Canada and Pingen in Switzerland: for both countries the European Commission decided that they protect personal data adequately. For transfers to the USA we rely on the EU–U.S. Data Privacy Framework where the recipient is certified under it, and otherwise on the EU standard contractual clauses.
How long we keep data
| Data | Kept |
|---|---|
| Letter text, addresses and enclosures | Until the letter reaches a final state. A preview that is not sent expires after 12 hours. A send that the printer does not confirm ends after at most 20 hours. |
| Record of a letter (no text) | As long as your account exists |
| Account: e-mail address, name, sender addresses | Until you delete your account |
| Sessions (hashed) | 30 days, or until you sign out |
| Sign-in codes and network address (keyed hashes) | A code works for 10 minutes; the rows are deleted after 25 hours |
| Content-check counters | 2 hours |
| Connected apps (hashed tokens) | Until you disconnect the app or delete your account |
| Logs at Cloudflare | At most 7 days |
When you delete your account, we delete your account data, sessions, addresses and connected apps at once, and we delete the content of letters that were not sent. The records of your letters lose your account, the recipient name, the tracking number and the printer’s ID. The rest (keyed hashes, status, times, price) stays for 30 days, so that the limits cannot be reset by deleting an account. Then it is deleted.
Your rights
You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interests (GDPR Art. 15 to 21). Write to support@agentletterdesk.com.
On your account page you can change your name and addresses, disconnect apps and delete your account yourself.
You can also complain to the Austrian data protection authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, www.dsb.gv.at.