Draft for professional review — not yet in force.

Privacy notice

Who we are

The controller of your personal data is DA GUIA LTD (company number 12208093, England and Wales), trading as HandleTheLetter. Contact: privacy@handletheletter.com.

What we process

Account data: email address, password hash, language and country preferences, and optional sender details you save (name, address, phone, email).

Documents: the files, photos and text you upload or create, the text we extract from them, our explanations, drafts and signed copies. Documents may contain special category data (for example health or immigration information); we process it only to provide the service you request.

Billing data: plan, payments and document credits. Card details are handled by our payment provider and never reach our servers.

Technical data: security logs and rate-limit counters, without document content.

Why we process it (lawful bases)

To provide the service you ask for (contract). To keep the service secure and prevent abuse (legitimate interests). To meet accounting and tax duties (legal obligation). For special category data contained in your documents, we rely on your explicit consent, which you give when you choose to process the document, and you can withdraw it by deleting the document.

AI processing

Documents are processed by AI models to read, explain, translate and write. Models run through our infrastructure provider, Cloudflare (Workers AI). We do not use your documents to train AI models, and we do not allow our providers to do so. Any future use for quality improvement would require your separate, explicit and optional consent.

Storage, retention and deletion

Files are stored privately and encrypted at rest by our provider; all connections are encrypted in transit. You can delete any document, case or your whole account at any time. You can also choose not to keep the original images of a document after it has been read.

Deleted documents are removed from active storage immediately and from backups within the backup cycle stated in our retention schedule [to be confirmed]. Payment records are kept for the period required by law without being linked to your documents.

Who we share data with

Processors that help us run the service: Cloudflare (hosting, storage, AI processing), Stripe (payments), and our email provider (account emails). [Full subprocessor list, locations and transfer safeguards to be confirmed before launch.] We never sell your data and never share documents with advertisers.

International transfers

Where data is processed outside the UK or EEA we rely on appropriate safeguards such as the UK International Data Transfer Addendum or EU Standard Contractual Clauses. [To be confirmed per provider and region.]

Your rights

You can access, download (Account → Download all my data), correct and delete your data, object to or restrict processing, and withdraw consent. You can complain to the Information Commissioner's Office (ico.org.uk) or your local data protection authority.