Privacy Policy
1. Two kinds of personal data
Your account data — email, name, hashed password or the sign-in ID Google or Microsoft gives you, plan and billing status. For this, we are the controller.
Recipient data you upload — names and postal addresses in your CSVs and the letters generated from them. For this, you are the controller and we are your processor: we store and process it only to produce your letters, on your instructions, and never for our own purposes. The terms we process it on — the data processing agreement Article 28 of the GDPR requires — are Schedule 1 to the Terms.
2. What we collect and why
- Account data — to operate your account, authenticate you, and provide support (contract).
- Letters, mailings and merge data — to provide the service you're using (contract).
- Billing events — handled by Stripe; we store your plan and Stripe references, never card numbers (contract / legal obligation).
- Transactional email events — password resets, mailing notifications, sent via Resend (contract).
- Basic server logs — IP and request data for security and debugging, kept briefly (legitimate interest).
- Demo requests — if you book a demo, what you type into the Book a demo form (name, work email, company, role and your answers), to prepare the call. If none of the times suit, you can ask for the walkthrough by email instead, and we send it once. Kept for 12 months, then deleted (legitimate interest).
- Letter check by email — if you ask the letter check on our home page to email you its result: your email address, the result (for each print partner, whether your letter fits and which of its areas have ink in them, by sheet number) and, if you came from one of our emails or letters, the code in its link. Never your letter: it is checked in your browser and is not sent to us. We email the result, then two short follow-ups over the next ten days, each with a link to stop them. Kept for 30 days, then deleted (consent).
- QR scan records — if you use scan tracking, the code on a letter and the time it was scanned. Nothing about the person scanning. See section 3 (contract).
After you sign up we send a few short emails about writing and posting your first letter. They stop once your first letter goes out, and every one has a link to stop them straight away. We also email you about your account: mailings, approvals, security, and when you've used most of the month's letters.
We do not run advertising, sell data, or use your content to train models.
3. Tracked QR codes
If you turn on scan tracking, each letter in a mailing is printed with a QR code carrying a short link that is unique to that letter — modletter.com/r/ followed by a random code. When someone scans it, we send them to the web address you chose and record that the scan happened.
A scan record is two things: the code, and the time. We do not record the IP address, the device, the browser, the approximate location, or anything else about the person scanning, and we set no cookie on them. There is no way for us to recognise the same person on a second scan, or across two letters.
Nothing is recorded unless somebody chooses to act. There is no equivalent of an email tracking pixel here — no measurement happens when a letter is delivered, opened or read. A scan is a deliberate action taken by a person holding a piece of paper.
Roles. You are the controller: you decide to print the codes and you know which letter went to which recipient. We are your processor. On its own, a scan record identifies nobody — it is a random code and a timestamp — but for as long as your mailing's recipient data exists you can connect the two, which makes it personal data in your hands. After the 30-day removal described below, that connection no longer exists for anyone, including you.
The link outlives the mailing. A letter can be scanned years after it was posted, so a short link keeps working after the mailing is deleted, after the recipient data is removed, and after an account is closed. What survives is the code, the web address it points to, and the times it was scanned — never a name or an address. This is deliberate: the promise is to the person holding the letter, not to the account that sent it.
What you need to do. Tracking people's responses is your decision as controller, and your own privacy notice has to cover it. Wording you are welcome to use:
“Letters we send you may carry a QR code that is unique to your letter. If you scan it, we record that the code was scanned and when. We do not record your location, your device, or anything else about you. We use this only to understand how many people responded to a mailing.”
If a recipient asks not to be counted, they can simply not scan the code — the address it leads to is always reachable by other means, and you should be willing to give it to them. Recipients can also contact you, as controller, and we will help you respond.
4. Where data lives and who helps us process it
Data is hosted in the EU (Hetzner, Germany), with encrypted backups on Hetzner storage. Our sub-processors:
- Hetzner (DE) — hosting and backups
- Cloudflare — DNS, network security, email routing, and counting visits to our public pages (Cloudflare Web Analytics)
- Stripe — payments
- Resend — transactional email (EU sending region)
- Cal.com — demo booking: the time you pick, your name and email, and your answers as notes on the booking. Only if you book a demo
- Google — optional Google sign-in. Webfonts are served from our own servers, so simply visiting the site sends nothing to Google.
- Microsoft — optional Microsoft sign-in, for work and school accounts. We receive your name, your email address and the IDs Microsoft gives you and your organisation, and nothing else: never your mail, files or calendar.
- Print partners you choose (e.g. Docmail, Stannp, Pingen, Lob) — only when you send a mailing through them, at your instruction
Where a provider processes data outside the EEA, transfers rely on Standard Contractual Clauses or an adequacy decision.
Short links for tracked QR codes are served from these same EU servers. Redirecting a scan involves no third party and adds no sub-processor.
5. How long we keep things
Account data: while your account exists. Saved letters (the ones you write): until you delete them or your account. Brand assets and uploaded typefaces: the same — they are your brand, not recipient data, and the 30-day removal below does not apply to them; they go when you delete them, their kit, or your account. Recipient content in a mailing — the CSV rows and the generated letter text — is removed 30 days after the mailing is made. A stub of the mailing remains (name, date, letter count, status) so usage and history are not rewritten. QR scan records outlive that removal and are kept while the short link is expected to work — they hold no recipient data, and after the 30-day removal nothing connects a code to a person. Returned mail, on the Pro and Business plans: each letter posted through a print partner keeps a one-way fingerprint of who it went to, made from the name, first address line and postcode (the town where there is no postcode). It cannot be turned back into a name or an address; it lets us warn you before you post again to someone whose letter came back. It is deleted 60 days after the letter was posted or, if the letter came back, 12 months after it came back. Whether a letter came back, and why, stays with the mailing's record. Recipients you type or paste into Merge & send are saved as a draft as you go, so closing the window loses nothing; a draft is deleted 30 days after it is first saved, whether or not you make a mailing from it. Backups: rolling 30 days. After account deletion, personal data is removed within 30 days except minimal records required for tax or legal reasons.
6. Your rights
Under the GDPR you can request access, correction, deletion, restriction, portability, or object to processing — email hello@modletter.com and we'll respond within a month. You can complain to the Irish Data Protection Commission (dataprotection.ie).
If you are a letter recipient whose data was uploaded by one of our customers, that customer is the controller — contact them first; we will assist them in honouring your rights, and pass on any request we receive.
7. Security
Passwords are stored hashed (bcrypt), traffic is encrypted in transit (TLS via Cloudflare), access to production systems is key-based, and payment details never touch our servers. No system is perfectly secure. If a breach affects your account data, we will notify you and the DPC as the GDPR requires. If it affects recipient data you uploaded, we will tell you within 24 hours of becoming aware of it, with what we know, so that you, as its controller, can notify the DPC and the people affected where the GDPR requires; then we keep you updated as we learn more.
8. Cookies
We use only essential cookies/storage for keeping you signed in. No advertising or cross-site tracking cookies, so no cookie banner theatre.
The walkthrough videos on our home page are hosted on YouTube (Google). Nothing is loaded from YouTube until you press play; once you do, YouTube may set cookies and process your data under Google's privacy policy.
Visits to our public pages (the home page, this page, the Terms, Data & security, and the page-not-found page) are counted with Cloudflare Web Analytics. It sets no cookie and stores nothing on your device, and it is not loaded anywhere in the app you sign into.
9. Changes
We'll post updates here and flag material changes by email or in-app.
Revised 2 November 2026. One addition: you can sign in with a Microsoft work or school account, so Microsoft is named beside Google among those who help us (section 4), and the sign-in ID it gives you is account data (section 1). Nothing else about what we collect, keep or share has changed.
Revised 31 October 2026. One addition, describing something the app now does: returned mail on the Pro and Business plans, and the one-way fingerprint of who each posted letter went to that it keeps — 60 days, or 12 months after a letter came back (section 5). Nothing else about what we collect, keep or share has changed.
Revised 30 October 2026. The print partners are listed in the order the app shows them: Docmail, Stannp, Pingen, then Lob. Two additions, each describing something the site now does: the letter check on the home page can email you its result, with two follow-ups you can stop (kept 30 days), and the Book a demo form can email you the walkthrough instead of a time. Nothing else about what we collect, keep or share has changed.
Revised 28 October 2026. Pingen, a print partner in Switzerland that posts across Europe, is now named beside Docmail, Lob and Stannp. Nothing else about what we collect, keep or share has changed.
Revised 23 October 2026. Visits to our public pages are now counted with Cloudflare Web Analytics, which sets no cookie and is not loaded in the app; Cloudflare's entry in the list of sub-processors says so. Nothing else about what we collect, keep or share has changed.
Revised 22 October 2026. Three additions, each describing something the app now does: the getting-started emails after sign-up and how to stop them, the draft that Merge & send keeps while you type recipients (deleted after 30 days), and the walkthrough videos on the home page, which play from YouTube. Nothing else about what we collect, keep or share has changed.
Revised 21 October 2026. Recipient content is removed 30 days after a mailing is made, not 90. A breach that touches recipient data is told to you within 24 hours, so that you, its controller, can notify the DPC; the terms we process it on are Schedule 1 to the Terms.
Revised 18 October 2026. The app now calls a template a letter and a run a mailing, and this page uses the same words. Docmail, one of the print partners you can choose, is now named beside Lob and Stannp. Nothing about what we collect, keep or share has changed.