Privacy Policy

Version 2026-11-07.3 · Last updated November 7, 2026

The short version. We collect what we need to run your inbox and bill you, and nothing for advertising. We don't sell data, don't show ads, and don't use tracking or analytics cookies. Your personal email is never shared with the sites you sign up to. We keep access records (IP address, date, browser) because Brazilian law requires it and to protect you and us against fraud and payment disputes.

1. Who is responsible

The controller of your personal data is the company that operates letterscove, organized under the laws of Brazil. For anything about your data, including requests to our data protection officer (encarregado), write to [email protected].

This policy follows Brazil's Lei Geral de Proteção de Dados (LGPD, Lei 13.709/2018) and, for people in the EU, EEA and UK, the GDPR.

2. What we collect

Account: your @letterscove.com addresses, your password (stored only as a one-way hash, which we can't read), and your plan.
Personal email: the email you give at checkout, whether you've confirmed it, and the confirmation and reset links we send to it.
Messages: the emails your addresses receive, with their attachments, sender, subject and date, until they're deleted.
Billing: your Stripe customer and subscription identifiers, plan, billing period, payment status and invoices. Card details are entered directly with Stripe and never reach our servers.
Acceptance of the Terms: the version you accepted, when, and the IP address and browser used.
Access records: the date, time, IP address and browser of sign-ups, logins and password changes, and our servers' technical logs of requests.
Connected sites: which sites you've allowed to sign you in with letterscove, and when.

We don't ask for your name, phone number or address.

3. Why we use it, and on what legal basis

To provide the inbox, receive and show your messages, log you in, and let you recover access: performance of the contract (LGPD art. 7, V; GDPR art. 6(1)(b)).
To bill you, send receipts and billing notices, and keep accounting records: performance of the contract and legal obligations (art. 7, II and V; GDPR art. 6(1)(b) and (c)).
To keep access records for at least 6 months, as Brazil's Marco Civil da Internet (Lei 12.965/2014, art. 15) requires: legal obligation (art. 7, II; GDPR art. 6(1)(c)).
To prevent fraud and abuse, secure the service, and answer payment disputes and legal claims: our legitimate interests and the regular exercise of rights in judicial, administrative or arbitral proceedings (art. 7, VI and IX; GDPR art. 6(1)(f)).
To tell you about important changes to the service, these policies or prices: performance of the contract.

We don't use your data for advertising, don't profile you, and don't make automated decisions about you that have legal effects.

4. Your messages

Messages are processed automatically to store them, show them to you and enforce your plan's limits. People at our company don't read them, except when you ask us to look at a specific message, when needed to investigate abuse or a security problem, or when the law requires it. When we answer a payment dispute, we may say how many messages your inbox received and when, but never what they said.

We share data only with companies that process it on our behalf, under contract, to run the service:

Stripe (payments and subscriptions; United States and other countries).
Cloudflare (DNS, protection of the site, and receiving incoming email before it reaches our server; global network).
netcup (the servers where the service and your messages are stored; Germany).
Amazon Web Services (sending our emails to you, such as confirmation and password reset links; United States).

We also share data:

with Stripe and the card networks, when you dispute a charge: the records listed in section 10 of the Terms, never message content;
with sites you choose to sign in to with letterscove: only what their consent screen shows (your @letterscove.com address and, for some, whether your plan is active). Never your personal email;
with authorities, when a valid legal order requires it, limited to what it requires;
with a buyer or successor, if the service is sold or merged, under this same policy.

We don't sell or rent personal data.

6. International transfers

Some of the providers above process data outside Brazil (and outside the EU). These transfers are needed to provide the service you asked for and rely on the providers' standard contractual clauses and security commitments, as allowed by LGPD art. 33 and GDPR chapter V.

7. How long we keep it

Messages: until you delete them; on Lite, at most 30 days; and at most 30 days after your subscription ends.
Account data: while your account exists, and 30 days after the subscription ends.
Billing and tax records (kept by Stripe and in our accounting): for 5 years, as Brazilian tax law requires.
Access records and acceptance of the Terms: 12 months (the law requires at least 6), longer only if needed for an ongoing dispute or legal claim.
Retired addresses: we keep only the name of each address, forever, so it's never given to anyone else.

8. Cookies

We set one cookie, which keeps you logged in. It's essential and isn't used for tracking. We don't use analytics or advertising cookies. Cloudflare may set a security cookie to tell people from bots, and Stripe sets its own cookies on the payment form for fraud prevention, under Stripe's privacy policy.

9. Security

Connections are encrypted (HTTPS). Passwords are stored only as one-way hashes. Messages open in an isolated viewer where scripts never run and external images stay blocked until you allow them. Access to the servers is restricted. No system is perfectly secure; if a breach affects your data, we'll notify you and the authorities as the law requires.

10. Your rights

You can ask us to confirm whether we process your data; give you access to it or a copy in a portable format; correct it; anonymize, block or delete data that's unnecessary or processed unlawfully; tell you who we share it with; and review decisions. You can also object to processing based on legitimate interests, and complain to Brazil's data protection authority (ANPD) or, in the EU and UK, your local authority.

Write to [email protected] from your personal email or mention your @letterscove.com address. We may ask you to confirm it's you. We answer within 15 days. Some data must be kept even after a deletion request, such as billing records and access records the law requires us to keep, until those periods end.

You can delete messages at any time in your inbox, and change your personal email in your account.

11. Children

The service is for adults. We don't knowingly collect data from anyone under 18. If you believe a minor has an account, write to us and we'll close it.

12. Changes to this policy

We may update this policy. For material changes, we'll email you or show a notice in your account before they take effect.

13. Contact

Email: [email protected].