Privacy Policy
Last updated: May 2026
Who runs Everletter.me
Everletter.me is developed and operated by Hansotto Kristiansen, based in Denmark. For any question about this policy or your data, or to exercise your rights under the GDPR, contact info@everletter.me.
1. What we collect
Everletter.me collects only what is necessary to run the service:
- Your email address, used to sign you in and deliver letters.
- Your display name (alias), set by you after signing up and used in notifications.
- Email addresses of your series readers, provided by you when you invite them.
- The letters, drafts, and images you create inside Everletter.me.
We do not collect phone numbers. Card details are collected and processed directly by Stripe, our payment provider - we never see or store your full card number.
2. How we protect your content
Your letters and images are encrypted before they are stored. Your content can only be read by you and the readers you have chosen to share it with.
We do not have the ability to read the content of your letters or view your images in the normal course of operating the service.
3. Cookies and tracking
Everletter.me does not use tracking cookies, advertising cookies, or any third-party analytics. We do not track your behaviour across other websites. The only session data stored in your browser is what is strictly necessary to keep you signed in.
4. How we use your data
Your data is used exclusively to:
- Authenticate you via one-time login codes sent to your email.
- Deliver your letters and images to the readers of your series.
- Send operational emails such as series invitation confirmations and closure notices.
We do not sell your data, share it with advertisers, or use it for profiling.
5. Email delivery
Outgoing emails are sent through Brevo (Sendinblue SA), a transactional email provider headquartered in Paris, France and operating within the EU. Your email address and letter content are processed by Brevo solely for delivery purposes, under their Data Processing Agreement. Brevo is GDPR-compliant by default and your data remains within the European Economic Area.
Authentication is handled by Supabase, hosted in Frankfurt, Germany. Your email address is shared with Supabase to issue and verify your login codes, under their Data Processing Agreement, and stays within the European Economic Area.
5a. Payment processing
Payments are processed by Stripe, Inc., a US-based payment provider - the only service we rely on that is not EU-based. Stripe handles your card details directly under their Data Processing Agreement and Standard Contractual Clauses; we never see or store your full card number.
If you delete your account, your Stripe customer profile and stored payment method are deleted. Stripe retains records of past transactions, as required by its own financial compliance obligations.
6. Where your data is stored
Your account information and letter content are stored in the European Union. Images are stored on Microsoft Azure Blob Storage in a European region. Encryption keys are managed by Azure Key Vault, also in the EU. Microsoft's GDPR Data Processing Agreement and Standard Contractual Clauses apply automatically to all Azure services.
7. Data retention
Your data is kept for as long as your account is active. You can delete your account at any time from the Settings page, which permanently removes your series, letters, images, and account information from our systems.
8. Your rights
You have the right to access, correct, or delete the personal data we hold about you. You can download a copy of your data from your profile settings at any time, or reach us using the contact details above. You also have the right to lodge a complaint with your local data protection authority.
9. Changes to this policy
We may update this policy as the service evolves. We will note the date of the most recent change at the top of this page.