# Privacy policy Last updated: 13 October 2026 This policy describes what the service does today. When the service changes, this page changes first. ## Who is responsible The controller under the GDPR is: Sara Meindl Höllriegelstraße 1a 2380 Perchtoldsdorf Austria [support@agentletterdesk.com](mailto:support@agentletterdesk.com) Write to this address for every question and request about your data. ## In short - The text of a letter, its addresses and its enclosures stay on our server only until the letter reaches a final state: sent, failed, unresolved, cancelled or expired. Then they are deleted. - We never store the PDF of a letter. The preview is drawn again each time you open it. - Each letter and each enclosure passes an automatic content check on Cloudflare Workers AI before it gets a price. - Our logs never contain letter text, sign-in codes, e-mail addresses or postal addresses. - These pages set no cookies, have no analytics and load nothing from other servers. ## What we process, and why ### Your account Your e-mail address, if you sign in with one. Your full name: it is the sender name on every letter. Your sender addresses (without the name). How you sign in: your e-mail address, a Google account ID, or the label of a tester access code. We need this to give you an account and to send letters in your name (GDPR Art. 6(1)(b), contract). ### Your letters While a letter waits for your approval, or while a send waits for the printer’s confirmation, we keep its content: the recipient’s name and address, your address, the text and the enclosures. We need it to show you the preview and to mail the letter (Art. 6(1)(b)). After a letter is done, we keep a record without the text: letter ID, purpose, country, status, recipient name, whether we verified the recipient’s address, page count, price, postal service, the printer’s IDs, tracking number and times. We also keep a fingerprint of the PDF (SHA-256), which shows that a copy is the letter that was mailed, and two keyed hashes: one finds the same letter sent twice, one counts letters from one sender to one recipient. We need the record to show you the status and to prove what was mailed (Art. 6(1)(b)), and the hashes to prevent duplicates and abuse (Art. 6(1)(f), our legitimate interest in a postal service that cannot be used for harassment). ### Sign-in and security A session cookie keeps you signed in on our pages; we store only a hash of it. Sign-in codes are stored only as keyed hashes, with the e-mail address they were sent to. With each code request we store a keyed hash of your network address (IP), to limit requests per network. To preselect your country on the address form, we read the country that Cloudflare derives from your connection; we do not store it. We count content checks per account for two hours, to protect the shared check capacity. Purposes: sign-in and protection against abuse (Art. 6(1)(b) and (f)). ### Connected apps When you connect an AI app, we store which app you connected, the permissions you granted, and its tokens as hashes. Access tokens are valid for one hour, refresh tokens for 30 days (Art. 6(1)(b)). ### This website and our logs To deliver a page, Cloudflare processes your IP address and the details of the request. Our logs hold the request method, the requested URL, status codes and error names. They never hold letter text, sign-in codes, e-mail addresses or postal addresses (Art. 6(1)(f), our legitimate interest in running and securing the service). ### E-mails to us If you write to [support@agentletterdesk.com](mailto:support@agentletterdesk.com), Cloudflare Email Routing (Cloudflare, Inc.) forwards your message to our mailbox at Gmail (Google LLC, USA, through Google Ireland Ltd.), where we read and answer it. We use your message and address to answer you (Art. 6(1)(b) or (f)). We keep support e-mails as long as we need them to answer and for our records. ## The content check Before a letter gets a price, and before an enclosure is added, two AI classifiers on Cloudflare Workers AI read its text. For an image or a scanned document, a model on Workers AI first turns it into text. The check looks for threats, harassment, stalking, extortion, hate, sexual content and letters that pretend to come from a court or an authority. We log only the category codes of a refusal, never the text. The check decides automatically whether a letter can be prepared. A refused letter is not prepared and not sent; it has no other effect. If you think a refusal is wrong, write to us. Legal basis: Art. 6(1)(f), our legitimate interest, and the recipients’ interest, in a service that cannot be used to threaten or harass people. ## Cookies Only the sign-in and account pages set cookies, and only these: - `__Host-ald_session`: keeps you signed in, 30 days or until you sign out. - `__Host-ald_pending`: holds the e-mail address that waits for its sign-in code, signed, 10 minutes. - `__Host-ald_google`: the state of a Google sign-in, signed, 10 minutes. They are strictly necessary for the sign-in that you ask for, so they need no consent (§ 165 (3) TKG 2021). The other pages, this one included, set no cookies. ## Who else receives data These companies process data for us, under data processing agreements: - **Cloudflare, Inc.** (USA) runs our server, database and key store, delivers these pages, keeps our logs, and runs the content check on Workers AI. - **PostGrid Inc.** (Canada) prints and mails letters within the United States. It receives the PDF with the sender’s and the recipient’s address. In test mode it does not print or mail anything. It keeps letters for its own retention period. - **Pingen AG** (Switzerland) prints letters to European countries and hands them to the post or to DHL. It receives the PDF with the sender’s and the recipient’s address. In test mode it does not print or mail anything. It keeps letters for its own retention period. - **Resend, Inc.** (USA) sends the e-mail with your sign-in code, from its EU region (Ireland, eu-west-1). It receives your e-mail address and the code. **Sign in with Google.** If you choose “Continue with Google”, Google (Google Ireland Ltd.) confirms your identity and tells us your name and e-mail address, with your Google account ID and whether Google verified the address. Google acts as an independent controller; its privacy policy applies. **Your AI app.** When you use Agent Letter Desk through an AI app, such as Claude by Anthropic, ChatGPT by OpenAI or Grok by xAI, the app sends us what you want in the letter and receives our answers: the letter text, the price, the preview link and the status. The provider of the app decides on its own processing. Its privacy policy applies. **The recipient** of a letter receives the letter, with your name and address, once it is mailed. ## Transfers outside the EU Cloudflare stores and processes data on its network, which includes the USA. Support e-mails are stored at Google (Gmail), which also processes data in the USA. PostGrid is in Canada and Pingen in Switzerland: for both countries the European Commission decided that they protect personal data adequately. For transfers to the USA we rely on the EU–U.S. Data Privacy Framework where the recipient is certified under it, and otherwise on the EU standard contractual clauses. ## How long we keep data | Data | Kept | | --- | --- | | Letter text, addresses and enclosures | Until the letter reaches a final state. A preview that is not sent expires after 12 hours. A send that the printer does not confirm ends after at most 20 hours. | | Record of a letter (no text) | As long as your account exists | | Account: e-mail address, name, sender addresses | Until you delete your account | | Sessions (hashed) | 30 days, or until you sign out | | Sign-in codes (keyed hashes), the e-mail address they were sent to, and the network address (keyed hash) | A code works for 10 minutes; the rows are deleted after 25 hours | | Content-check counters | 2 hours | | Connected apps (hashed tokens) | Until you disconnect the app or delete your account | | Logs at Cloudflare | At most 7 days | When you delete your account, we delete your account data, sessions, addresses and connected apps at once, and we delete the content of letters that were not sent. The records of your letters lose your account, the recipient name, the tracking number and the printer’s ID. The rest (keyed hashes, status, times, price) stays for 30 days, so that the limits cannot be reset by deleting an account. Then it is deleted. ## Your rights You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interests (GDPR Art. 15 to 21). Write to [support@agentletterdesk.com](mailto:support@agentletterdesk.com). On your [account page](https://agentletterdesk.com/account) you can change your name and addresses, disconnect apps and delete your account yourself. You can also complain to the Austrian data protection authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, [www.dsb.gv.at](https://www.dsb.gv.at/).