Data & Security
Letters carry names, postal addresses and often a reason for writing. If you are being asked to sign off on a tool that handles that, these are the answers you are likely to need.
Where does the data live?
In the EU. Servers and encrypted backups are with Hetzner in Germany. Where one of the providers below processes data outside the EEA, transfers rely on Standard Contractual Clauses or an adequacy decision.
Who is responsible for what?
There are two kinds of personal data, and they are not treated the same.
- Your account data — email, name, hashed password or the sign-in ID Google or Microsoft gives you, plan and billing status. For this we are the controller.
- Recipient data you upload — the names and addresses in your CSVs, and the letters generated from them. For this you are the controller and we are your processor. We store and process it only to produce your letters, on your instructions, and never for our own purposes.
If a letter recipient contacts us directly, we will point them to you as the controller, assist you in answering, and pass on anything we receive.
Who else touches it?
- Hetzner (DE) — hosting and backups
- Cloudflare — DNS, network security, email routing, and counting visits to our public pages (Cloudflare Web Analytics)
- Stripe — payments
- Resend — transactional email, EU sending region
- Cal.com — demo booking, only if you book a demo: the time you pick, your name and email, and your answers
- Google — optional Google sign-in. Fonts are served from our own servers, so simply visiting the site sends nothing to Google.
- Microsoft — optional Microsoft sign-in, for work and school accounts: your name, email address and the IDs Microsoft gives you and your organisation, never your mail, files or calendar
- A print partner you choose (Docmail, Stannp, Pingen, Lob and similar) — only when you send a mailing through them, at your instruction
That is the complete list. We do not run advertising, sell data, or use your content to train models.
How long is it kept?
Saved letters stay until you delete them or close your account. Recipient names, addresses and letter text in a mailing are removed 30 days after the mailing is made; a stub of the mailing — its date and how many letters — is kept. Recipients you type or paste into Merge & send are saved as a draft as you go, so closing the window loses nothing; a draft is deleted 30 days after it is first saved, whether or not you make a mailing from it. Backups roll on a 30-day cycle. After account deletion, personal data is removed within 30 days, apart from the minimal records we are required to keep for tax or legal reasons.
How is it secured?
Passwords are stored hashed with bcrypt. Anyone can turn on two-step sign-in, which asks for a six-digit code from an authenticator app after the password, with one-time recovery codes in case a phone is lost; on the Business plan the workspace owner can require it of everyone who signs in with a password. Traffic is encrypted in transit over TLS. Access to production systems is key-based. Card details never reach our servers — Stripe handles payments and we store only your plan and a Stripe reference.
No system is perfectly secure. If a breach affects your account data we will tell you, and the Data Protection Commission, as the GDPR requires. If it affects recipient data you uploaded, we will tell you within 24 hours of becoming aware of it, with what we know, so that you — as its controller — can notify the Commission and the people affected where the GDPR requires; then we keep you updated. The terms we process recipient data on are Schedule 1 to the Terms.
What rights do people have?
Under the GDPR you can request access, correction, deletion, restriction, portability, or object to processing. Email hello@modletter.com and we will respond within a month. You can also complain to the Irish Data Protection Commission (dataprotection.ie).
Cookies
Only what is needed to keep you signed in. No advertising or cross-site tracking, and therefore no cookie banner. The walkthrough videos on the home page play from YouTube. Nothing loads from YouTube until you press play; YouTube may then set its own cookies under Google's privacy policy. Visits to the public pages are counted with Cloudflare Web Analytics, which sets no cookie, stores nothing on your device and is not loaded inside the app.
Who are we?
ModLetter is operated from Ireland by Eoin Cummins. Our terms are governed by Irish law, with disputes subject to the Irish courts.
Revised 2 November 2026. You can sign in with a Microsoft work or school account, so Microsoft is named beside Google. Nothing about where data lives, who handles it or how long it is kept has changed.
Revised 30 October 2026. The print partners are listed in the order the app shows them: Docmail, Stannp, Pingen, then Lob. Nothing about where data lives, who handles it or how long it is kept has changed.
Revised 28 October 2026. Pingen, one of the print partners you can choose, is now named beside Docmail, Lob and Stannp. Nothing about where data lives, who handles it or how long it is kept has changed.
Revised 23 October 2026. Visits to the public pages are now counted with Cloudflare Web Analytics, which sets no cookie and is not loaded in the app. Nothing about your account or recipient data has changed.
Revised 22 October 2026. Two-step sign-in is available to every account, and on Business the workspace owner can require it. Recipients typed into Merge & send are kept as a draft for 30 days at most, and the walkthrough videos on the home page play from YouTube once you press play.
Revised 21 October 2026. Recipient content is removed 30 days after a mailing is made, not 90; a breach that touches recipient data is told to you within 24 hours; the data processing terms are Schedule 1 to the Terms.
Revised 18 October 2026. The app now calls a template a letter and a run a mailing, and this page uses the same words. Docmail, one of the print partners you can choose, is now named beside Lob and Stannp. Nothing about where data lives, who handles it or how long it is kept has changed.