Privacy Policy

Effective date: 8 November 2026This Privacy Policy explains how LetterAPI ("LetterAPI", "we", "us", "our") collects, uses, shares and protects personal data when you use letterapi.uk, our dashboard, API and related services (the "Platform"). It forms part of our Terms of Service, and capitalised terms not defined here have the meaning given there. By using the Platform you acknowledge this Policy. We process personal data in line with the UK GDPR and the Data Protection Act 2018.

1. Who is responsible for your data 2. Data we collect 3. How and why we use data 4. Who we share data with 5. International transfers 6. How long we keep data 7. Your rights 8. Security 9. Your responsibilities for Order Data 10. Children 11. Third-party links and services 12. Changes to this Policy 13. Contact

1. Who is responsible for your data

1.1 For account, billing, security and website data, LetterAPI is the data controller.1.2 For the content of letters and recipient details that you submit in orders ("Order Data"), you are the controller and we act as your processor, with the Shop that fulfils the order acting as our sub-processor. You are responsible for having a lawful basis to send us that data and for giving recipients any notices the law requires.1.3 You can contact us about privacy matters through the Contact page on the website.

2. Data we collect

2.1 Account data: your email address, name, one-time passcode sign-in activity, role (customer, shop or admin), API keys (stored so we can validate requests), and settings and preferences.2.2 Order Data: letter content and attachments, sender and recipient names and postal addresses, selected options, Shop selection, order status history, messages exchanged with Shops, and generated PDFs, labels and previews. Order Data may include sensitive or special category information if you choose to put it in a letter. We do not need it, and you are responsible for what you include.2.3 Payment data: payment amounts, credit balances, transaction and credit history and payment status. Card details are collected and processed by our payment provider (currently Stripe) and are not stored by us.2.4 Shop applicant data: business name, contact details, address, capabilities and pricing information supplied when applying as a Shop.2.5 Communications: messages you send via the Contact page, support requests, and notification and email delivery records.2.6 Technical data: IP address, device and browser type, request logs, API usage, error logs, timestamps and security signals.2.7 Cookies and similar technologies: strictly necessary cookies or storage used to keep you signed in, maintain your session and security, and remember dashboard preferences and unsaved drafts in your browser. We do not use these for advertising. If we add analytics or other non-essential cookies we will ask for consent where the law requires.

3. How and why we use data

3.1 To provide the Platform and perform our contract with you: creating accounts, authenticating you, processing orders and payments, routing orders to Shops, generating documents, and showing order status. Lawful basis: contract.3.2 To keep the Platform secure and prevent fraud and abuse: monitoring, rate limiting, investigating suspicious activity, enforcing our Terms and protecting our users, Shops and carriers. Lawful basis: legitimate interests.3.3 To communicate with you: transactional emails such as sign-in codes, order and status notifications, receipts, shop messages, service announcements and replies to enquiries. Lawful basis: contract and legitimate interests.3.4 To improve and maintain the Platform: debugging, performance, capacity planning and product development using logs and usage data. Lawful basis: legitimate interests.3.5 To comply with legal obligations and defend legal claims: accounting, tax, regulatory and court requests, and keeping evidence of transactions and disputes. Lawful basis: legal obligation and legitimate interests.3.6 Where we rely on consent we will say so, and you may withdraw it at any time without affecting earlier processing.3.7 We do not sell personal data. We do not use Order Data for our own marketing, and we do not carry out solely automated decision-making that has legal or similarly significant effects on you.

4.1 Shops: the Shop handling your order receives the letter content, recipient and sender details and options it needs to print and send the item, plus messages about that order. Shops are independent businesses and must handle the data under our Terms and the law, but their own practices also apply.4.2 Postal carriers and couriers (such as Royal Mail): they receive delivery names and addresses as needed to deliver mail.4.3 Service providers acting on our behalf: payment processing (Stripe), hosting, database and storage providers, email delivery, document and PDF conversion, and scheduling or contact tools embedded on the website.4.4 Professional advisers, insurers, auditors and, where needed, potential buyers or investors during a merger, sale or reorganisation, under confidentiality.4.5 Authorities and others where we believe disclosure is required by law, court order or regulation, or is reasonably necessary to protect rights, property, safety, or to investigate fraud, abuse or breaches of our Terms. We decide in our discretion whether and how to respond to such requests.4.6 With your instruction, such as when you connect an integration or use webhooks that send order data to your own systems.

5. International transfers

5.1 Some of our service providers may process data outside the United Kingdom. Where that happens, we rely on appropriate safeguards required by UK law, such as adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

6. How long we keep data

6.1 We keep personal data only for as long as we reasonably need it for the purposes above, including to meet legal, accounting and reporting requirements and to resolve disputes and enforce our Terms.6.2 Account data is kept while your account is open and for a reasonable period afterwards. Transaction, credit and order records are generally kept for at least six years for accounting and limitation purposes. Order Data, including letter content and addresses, is kept for as long as we need it to operate the order history, support, fraud prevention and dispute handling, and may then be deleted or anonymised.6.3 Backups and logs may keep data for a limited time after deletion. Data we are required or entitled to keep for legal reasons will not be deleted on request.

7. Your rights

7.1 Under UK data protection law you may have the right to: access your personal data; have inaccurate data corrected; have data erased; restrict or object to processing; data portability; withdraw consent; and not be subject to certain automated decisions. These rights are not absolute and apply only in the circumstances set out in the law.7.2 To exercise a right, contact us through the Contact page. We may ask you to verify your identity. We will respond within the time required by law and may refuse or limit requests that are manifestly unfounded, excessive, or where an exemption applies.7.3 If your data is in someone else's Order Data (for example you received a letter sent through the Platform), the sender is the controller. You should contact them first, though you may also contact us and we will pass your request on where appropriate.7.4 You have the right to complain to the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to deal with your concern first.

8. Security

8.1 We use reasonable technical and organisational measures to protect personal data, including access controls, encrypted connections, and restricting production access. No system is completely secure, and we cannot guarantee the security of data sent to or stored on the Platform, or handled by Shops, carriers and other third parties.8.2 You are responsible for keeping your credentials and API keys secure and for the security of your own systems that connect to the Platform.8.3 If a personal data breach occurs that the law requires us to report, we will notify the ICO and affected parties as required.

9. Your responsibilities for Order Data

9.1 You must only submit personal data you are entitled to use, make sure it is accurate and limited to what is necessary, and not include special category data, criminal offence data or payment card numbers unless essential and lawful.9.2 You must comply with data protection, privacy and direct marketing laws (including PECR where it applies) for every letter you send, and you are solely liable for non-compliance.9.3 Our Terms of Service set out the indemnity you give us for claims arising from Order Data.

10. Children

10.1 The Platform is for businesses and adults aged 18 or over. We do not knowingly collect data from children through account registration. If you believe a child has given us personal data, contact us and we will take reasonable steps to delete it.

11. Third-party links and services

11.1 The Platform may link to or embed third-party sites and tools. We do not control them and are not responsible for their privacy practices. Please read their policies.

12. Changes to this Policy

12.1 We may update this Policy from time to time by posting the new version on this page with a new effective date. Material changes will be notified where the law requires. Continued use of the Platform after an update means you accept it.

13. Contact

13.1 For questions or requests about this Policy or your personal data, use the Contact page on the website.

LetterAPIPrint and post letters in the UK, from one letter to thousands.