LEGAL DOCUMENT

Privacy Policy

Version 1.0 · effective 2026-07-29

1. About this Policy

1. This Policy explains how The Old Letters, referred to as “TOL” or the “Service”, processes personal data when a person uses https://theoldletters.com, an Account, private correspondence, a Subscription, support or security features.
2. It reflects in particular Regulation (EU) 2016/679, the General Data Protection Regulation or “GDPR”, the Polish Personal Data Protection Act, Polish Electronic Communications Law and the Polish Act on Providing Services by Electronic Means.
3. Cookies, local storage and similar technologies are described separately at https://theoldletters.com/en/cookie-policy.

2. Controller

1. The controller is Joanna Szamota, carrying on a sole-trader business under the registered name “Joanna Szamota Blackgrain Workshop”, ul. Zachodnia 24, 05-822 Milanówek, Masovian Voivodeship, Poland, NIP 5291840195, REGON 521704456.
2. Privacy enquiries may be sent to support@theoldletters.com.
3. The controller has not appointed a data protection officer unless that obligation arises in the future. Questions should be sent to the address above.
4. TOL Users remain the independent authors and recipients of their correspondence. The controller determines the purposes and means of processing needed to operate the Service but does not use private Letter content for its own advertising, profiling or AI-model training purposes.

3. Key points

1. TOL processes Account data, technical data, correspondence metadata, Subscription information and content supplied to support.
2. Letter content and attachments are end-to-end encrypted on the User’s device before transmission to TOL infrastructure. Content encryption does not automatically cover the technical metadata required to deliver a message.
3. TOL does not sell personal data or disclose private correspondence to advertisers.
4. TOL does not use Letter content for behavioural advertising, marketing profiles or training artificial intelligence models.
5. Complete payment-card data is processed by the payment provider rather than stored by TOL.
6. Data may be processed by infrastructure, authentication, payment, anti-bot, transactional-email and support suppliers only to the extent needed to provide the Service.
7. Users have GDPR rights including access, rectification, erasure, restriction, portability, objection and the right to complain to a supervisory authority.

4. Data we process

4.1. Account and identity data

We may process:

1. email address;
2. display name, first name, nickname or initials supplied by the User;
3. internal Account identifier;
4. Account creation date, last sign-in, Account status and language;
5. sign-in method, email confirmation and active-session information;
6. security settings and access-recovery information; passwords are stored only in a technically protected form and TOL does not have access to plaintext passwords;
7. an avatar or other profile data if enabled;
8. an 18-or-over declaration and verification data only where necessary to resolve a reasonable age concern;

4.2. Private correspondence data

We process:

1. encrypted Letter content;
2. encrypted attachments;
3. sender and recipient identifiers;
4. creation, sending, delivery, opening, archiving or deletion time;
5. thread, mailbox or Space identifier;
6. delivery status and technical error information;
7. selected stationery, envelope, seal, theme and visual settings;
8. message or attachment size;
9. information necessary for key distribution and synchronisation, where required by the feature.

Letter content and attachments are encrypted end-to-end on the User’s device. Metadata necessary to deliver a message cannot be completely hidden from the system because the Service must know where and when to route encrypted data.

4.3. Contacts, invitations and Duo or Family Spaces

We may process:

1. Account and relationship identifiers;
2. an invitee’s email address where they do not yet have an Account;
3. the sender, date, status, expiry and use of an invitation;
4. membership, role, permissions and billing administrator of a Space;
5. blocking or relationship termination information;
6. sharing settings chosen by members;

An inviter should provide only the address of a person whom they have a reasonable basis to contact and must not use invitations for spam or marketing.

4.4. Payment and Subscription data

We may process:

1. selected Plan, currency, price, Billing Period and Subscription status;
2. Stripe customer, Subscription, payment, invoice or coupon identifiers;
3. payment, renewal, cancellation, refund or failure status;
4. billing information required for an accounting document;
5. country, postcode and tax information where required;
6. limited payment-method information such as card brand and last digits where provided by the operator.

TOL does not store the complete card number, CVC or online-banking credentials.

4.5. Technical, log and security data

We may process:

1. IP address and an approximate country or region derived from it;
2. date, time, session identifier and sign-in events;
3. device type, operating system, browser, application version and language;
4. technical identifiers, session tokens and local-storage data necessary for operation;
5. requested resources, response codes, errors and performance diagnostics;
6. attempted abuse, rate limits, blocks, suspicious sign-ins and security changes;
7. signals generated by Cloudflare Turnstile or a comparable anti-bot mechanism;
8. consent and document-acceptance history, including version, date and technical evidence.

We do not use these data to build an interests profile from correspondence content.

4.6. Support, complaints and abuse reports

We may process:

1. email address, name and report content;
2. support communication history;
3. technical identifiers required to solve the issue;
4. documents or screenshots supplied voluntarily;
5. decrypted Letter content only where the User supplies it themselves;
6. request, decision, remediation and appeal information;
7. risk category, confidentiality preference, and urgency assessment;
8. an evidence package selected by the reporter containing only specific Letters, attachments or metadata knowingly disclosed for the report;
9. access logs for evidence, escalation and contact with competent authorities or specialised bodies.

Users must not send passwords, complete card details or a recovery phrase.

4.7. Marketing data

Where a User separately subscribes to a newsletter or marketing, we may process:

1. email address;
2. language and market;
3. date, source and scope of consent;
4. opt-out information;
5. opening or click information only where lawful and covered by any required consent to optional technologies.

A newsletter is not a condition of using TOL.

4.8. Aggregated Service-use events

To assess whether the Service's core journeys work, TOL counts only predefined product events such as a public-page view, registration start, first Letter sent or Subscription start. An event may include language, a coarse interface placement, Plan identifier, currency or billing period. Events are immediately combined into daily totals and do not contain an Account identifier, email address, invitation code, Letter or Correspondence identifier, text, title, attachment, key or other free-form field. TOL does not use cookies, localStorage or a third-party analytics pixel for this purpose and does not create an individual User journey.

5. Sources of data

We receive data:

1. directly from the User during registration, Service use, payment and support contact;
2. from other Users when they invite a person, address a Letter to them or add them to a Space;
3. automatically from the device and infrastructure during use;
4. from payment, hosting, authentication, security and transactional-email suppliers;
5. from competent authorities or persons reporting abuse where circumstances require it.

6. Purposes and legal bases

7. Legitimate interests

Where Article 6(1)(f) GDPR is used, our legitimate interests are:

1. protecting Accounts, correspondence, payments and infrastructure;
2. detecting abuse, spam, bots, intrusion and fraud;
3. maintenance, diagnosis and stability improvement without analysing private Letter content;
4. support, dispute handling and legal claims;
5. sending a limited, expected invitation within a User relationship;
6. aggregated business statistics without profiling private correspondence.

A User may object for reasons relating to their particular situation. An objection to direct marketing is unconditional.

8. Special-category data and data about other persons

1. TOL does not require health, religion, political opinion, origin, sexuality or other special-category data in a profile.
2. A User may nevertheless include private information in an encrypted Letter. TOL technically processes encrypted data to transmit and store it without using the semantic meaning for its own purposes.
3. Users should respect recipient and third-party privacy and provide only data that they are entitled to use.
4. If a User voluntarily discloses special-category data in a decrypted support report, they should limit it to what is necessary. Depending on the matter, the basis may be explicit consent, legal claims or another basis provided by law.

9. Encryption and limits of confidentiality

1. TOL encrypts Letter content and attachments end-to-end on the User’s device. The server stores encrypted content and does not hold the key needed to read it.
2. Private keys are protected by the User’s password. Losing both the password and recovery code may permanently prevent access to encrypted correspondence.
3. Even where content is encrypted, TOL may see metadata needed to supply the Service, including participant identifiers, time, status, size and technical information.
4. Content decrypted on a recipient’s device is outside TOL’s exclusive control. The recipient may copy, photograph or disclose it, even where that would violate law or agreed rules.
5. The Provider may be required to disclose data it holds to a competent authority pursuant to a valid legal request. This does not create a capability to decrypt data where the Provider lacks the relevant key.
6. TOL does not create hidden key access solely to enable future reading of private Letters. A material architectural change affecting this statement requires documentation updates and User notice.

10. Whether data are required

1. Required data are necessary for an agreement, security or settlement.
2. Without an email address or required authentication data, an Account cannot be created.
3. Without payment data, a paid Plan cannot be purchased, although a free Plan may remain available.
4. Profile data, newsletters and optional preferences are voluntary.

11. Recipients and suppliers

Data may be disclosed only as necessary to the following recipients:

1. Processors receive data under data-processing agreements and the controller’s instructions.
2. The table above is the current list of key suppliers and their roles.
3. TOL does not give advertisers data enabling them to read or profile private correspondence.

12. Transfers outside the EEA

1. Some suppliers have entities or infrastructure outside the European Economic Area, particularly in the United States.
2. Where data are transferred outside the EEA, the GDPR transfer mechanism used may include:
3. a European Commission adequacy decision;
4. the recipient’s participation in a recognised adequacy framework where the transfer is covered;
5. European Commission Standard Contractual Clauses together with a transfer assessment and supplementary safeguards;
6. another lawful instrument or derogation.
7. Processing scope and location depend on the selected project region, account configuration and supplier subprocessors.
8. Information about safeguards may be requested at support@theoldletters.com, subject to trade-secret and security restrictions.

13. Retention

We apply the following retention periods:

1. Data are erased or anonymised after the period unless a further legal retention duty applies.
2. Backup data are not used for ordinary business purposes and are removed when the copy is overwritten.
3. Anonymous statistics that cannot reasonably be linked to an individual may be retained longer.

14. Data-subject rights

A person may request:

1. access and a copy;
2. rectification of inaccurate and completion of incomplete data;
3. erasure where a legal ground exists;
4. restriction of processing;
5. portability of supplied data processed automatically on consent or contract;
6. objection to legitimate-interest processing for reasons relating to the person’s situation;
7. unconditional objection to direct marketing;
8. withdrawal of consent at any time without affecting earlier lawful processing;
9. protection from a solely automated decision producing legal or similarly significant effects, subject to legal exceptions;
10. notice of a personal-data breach where law requires it.

Exercising rights

1. Send a request to support@theoldletters.com.
2. To protect the Account, we may request reasonable identity confirmation and will not ask for more data than necessary.
3. We respond without undue delay, normally within one month. A complex request may be extended as permitted by GDPR, with notice.
4. Requests are generally free. GDPR permits a reasonable fee or refusal for manifestly unfounded or excessive requests.
5. Access and portability must not adversely affect other persons’ rights and freedoms, particularly their correspondence secrecy.
6. If TOL cannot technically decrypt content without a User key, we may provide encrypted data and available metadata but cannot promise plaintext recovery.

15. Supervisory complaint

1. A person who believes data are processed unlawfully may complain to the President of the Polish Personal Data Protection Office, or another competent supervisory authority under GDPR.
2. Contact details are available at https://uodo.gov.pl.
3. We encourage prior contact so that TOL can investigate, but this is not a condition of a complaint.

16. Automated decisions and bot protection

1. TOL does not make solely automated decisions producing legal or similarly significant effects without a lawful basis and safeguards.
2. Security systems may automatically assess sign-in, sending, payment or traffic risk and temporarily require additional verification, apply a limit or block a suspicious request.
3. Cloudflare Turnstile may analyse technical device and traffic signals to distinguish a person from automated abuse.
4. A User may report an erroneous automated block and request human review where this does not undermine other persons’ security.

17. Data security

Measures in use include:

1. HTTPS/TLS transport encryption;
2. client-side Letter-content encryption as documented;
3. password hashing by the authentication supplier;
4. access control, least privilege and separation of administrative roles;
5. database Row Level Security and access policies;
6. multi-factor authentication for administrative accounts;
7. privileged-operation logging and access reviews;
8. anti-bot measures, rate limiting and abuse detection;
9. backups and restoration procedures;
10. vulnerability, update and secrets management;
11. confidentiality obligations and access authorisations;
12. incident and breach response procedures.

Security is a process, not a guarantee. Users must also protect devices, email and recovery materials.

18. Data and communications-security breaches

1. We maintain procedures to assess incidents, mitigate impact and document breaches.
2. Where a breach is likely to create a risk to rights and freedoms, it is reported to the competent authority within the period required by law.
3. Where the risk is high, affected persons are notified unless a statutory exception applies.
4. For data covered by communications secrecy, applicable duties under Polish Electronic Communications Law are also followed.

19. Adults only

1. The Service is intended only for persons aged 18 or over. We do not operate accounts for minors, do not direct the Service to children, and do not knowingly collect data from anyone under 18.
2. Registration requires a declaration of adulthood. The current registration form does not request a date of birth and we do not store it. If a different proportionate age-assurance method becomes necessary, we will explain its scope, purpose, legal basis and retention period before collecting additional data.
3. Because the Service is not offered directly to a child, Article 8 GDPR and the varying national child-consent thresholds do not apply to it.
4. If we obtain credible information that an Account belongs to a person under 18, we promptly restrict the Account, then close it and erase the associated data, except data required by law. We do not use such data for any other purpose.
5. Anyone may report a suspicion that an Account belongs to a minor to support@theoldletters.com. No Account is required, and such reports are prioritised.
6. We do not apply behavioural advertising, marketing profiling, or use of Letter content for training artificial intelligence models to any User.
7. Reports concerning child sexual abuse material continue to be handled regardless of the Service's age profile. An adult User can report such content, and we escalate the matter to the competent authorities and specialist organisations.

19a. Users outside Poland

1. The Service is available globally. The controller is established in Poland but processes data of Users in other countries.
2. The Service is not directed to children. We nevertheless assess child-specific obligations by reference to how the Service is actually used, not only its 18+ declaration. Our current position is that the UK Age Appropriate Design Code does not apply because access is intended to be effectively restricted to adults. We keep that position under regular review, including the likelihood of significant child access and the effectiveness and proportionality of the age-assurance measures used.
3. Regardless of jurisdiction, the controller does not use behavioural advertising, does not profile Users for marketing, and does not use Letter content to train artificial intelligence models.
4. A person invited to the Service who is not yet a User receives an Article 14 GDPR notice in the body of the invitation email, together with the ability to decline the invitation and block further invitations without creating an Account.
5. The Provider's current position, subject to continuing review and independent advice from a qualified UK specialist, is that The Old Letters is designed to fall within the email-service exemption in paragraph 1 of Schedule 1 to the UK Online Safety Act 2023. This is not a determination by Ofcom or a court. A change to features or actual use may change the assessment. Safety and reporting information for UK users is available at https://theoldletters.com/legal/uk-illegal-content.

20. External links and services

1. The Service may link to external sites or services. Their operators are separate controllers with their own policies.
2. Opening a link may disclose data to that operator. Users should review its privacy information.
3. TOL is not responsible for practices of entities it does not control, subject to mandatory law.

21. Cookies and similar technologies

1. TOL may use cookies, local storage, session storage, tokens and other device technologies.
2. Necessary technologies may operate without consent where required to transmit a communication or provide a function explicitly requested by the User.
3. Optional technologies, particularly analytics or marketing, are enabled only after voluntary consent where required.
4. Details, controls and the current inventory are in the Cookie Policy.

22. Changes to this Policy

1. This Policy may change because of law, functions, suppliers, security or processing practices.
2. Material changes will be communicated in the Service, by email or on another Durable Medium before they take effect where required or reasonable.
3. A change to consent-based processing cannot be obtained by silence or continued use. Any required consent will be collected separately.
4. We retain evidence of previous versions and provide it on request where required.

23. Contact

Privacy questions, requests and reports may be sent to:

Joanna Szamota Blackgrain Workshop ul. Zachodnia 24 05-822 Milanówek, Poland Email: support@theoldletters.com