Privacy policy

1Who we are

Letterly (letterly.pro) is operated by Vicente Évora, a sole trader based in Portugal. Under the EU General Data Protection Regulation (GDPR), he is the controller of the personal data described in this policy: the person who decides why and how it is processed.

You can reach him about anything in this policy at vicente@letterly.pro. Letterly has not appointed a data protection officer, so write to that address instead.

In this policy, “we” means Letterly and Vicente, and “you” means the person using Letterly.

2What we collect

What you give us

• Account details: your name, email address and password. Your password is stored by our sign-in provider as a one-way hash, so we never see it. If you sign in with Google, Google gives us your name, email address and profile picture.
• Your newsletter: the RSS feed address you add, and the editions we read from it, including their text, links and images.
• Personas: the profile links you add and the public posts you pick as examples of a writing voice. These may be your posts or another writer’s.
• Your content: the posts Letterly writes for you, your edits, drafts and schedules, the instructions you give the agent and the composer, and messages you send to the agent chat.
• Brand settings: your colours, a logo if you upload one, and your image preferences.
• Newsletter statistics: if you connect them, the API key or access details you give us for beehiiv, Kit, Ghost or Mailchimp, and the statistics we fetch with them.
• Other things you tell us: your answers to the short onboarding survey, and anything you write to us by email.

What we receive from the accounts you connect

When you connect X, LinkedIn, Threads or Facebook, we receive an access token that lets Letterly post for you, and basic profile details such as your name, handle and profile picture, and for Facebook the Page you choose. We then publish the posts you schedule and read back how they did: impressions, likes, replies, reposts, clicks and follower counts.

What we collect automatically

• Public profile data: to track follower growth and to build personas, we fetch public information from social profiles, such as follower counts and recent public posts, through the data providers listed in section 5.
• Link clicks: when someone clicks a tracked link in one of your posts, we count the click so you can see how the post did. We do not identify the person who clicked.
• Usage data, only with your consent: Microsoft Clarity records how visitors use the site, such as the pages they visit, where they click and how far they scroll. Inside the workspace it is set to hide the text on screen, so it records how the app is used, not what you write.
• Visit counts: DataFast counts visits and where they came from without cookies, using a pseudonymous identifier that changes every day. On the free growth planner it also counts three actions: that a plan was made, that its PDF was downloaded, and that the trial button was pressed. It never receives your answers, and the PDF is made on your device.
• Technical data: like any website, our hosting providers receive your IP address, browser type and the pages you request, and keep them in short-lived logs for security.
• Bot protection: Cloudflare Turnstile checks that the sign in, sign up and password reset forms are being used by a person, using signals from your browser.

What we do not collect

We never see or store your card details: Polar handles payments (section 5). Letterly does not ask for sensitive data such as health information or political opinions. If your newsletter contains it, it is processed only to write your posts.

3How we use it, and on what basis

The GDPR only allows personal data to be used for a stated purpose and on a legal basis. These are ours.

Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (section 9).

We don’t use your data for advertising and we don’t sell it. We don’t make decisions about you based only on automated processing that have legal or similarly significant effects on you.

4How AI is used

Letterly writes posts with large language models. To do that, the text of your editions, your persona examples, your settings and instructions, and your recent posts are sent to OpenAI, either directly or through Make.com, which runs part of the writing pipeline. Images are generated with OpenAI’s image models from your brand settings and the text of the post.

Under OpenAI’s API terms, data sent through its API is not used to train OpenAI’s models. OpenAI may keep it for up to 30 days to watch for abuse, and then deletes it. We don’t train any AI model of our own on your content.

5Who we share it with

We share personal data only with the providers that run Letterly, only for the purposes in section 3, and under terms that require them to protect it. This is the current list.

The platforms you publish to, X, LinkedIn and Meta (for Threads and Facebook), and the newsletter platforms you connect, receive what you send them through Letterly. They are not our providers: their own privacy policies apply to what they do with it.

We may also disclose data if the law requires it, to protect Letterly or its users from fraud or abuse, or to whoever takes over Letterly if it is ever sold. In that last case, this policy keeps applying to your data.

6Transfers outside Europe

Letterly’s database is in the EU. Some providers in section 5 process data outside the European Economic Area, mainly in the United States: among them OpenAI, Netlify, Polar, Resend, Cloudflare and Microsoft. Each transfer is covered by the EU-US Data Privacy Framework, where the provider is certified under it, or by the European Commission’s standard contractual clauses. Ask us and we will tell you which one applies to a given provider.

7How long we keep it

• Your account and everything in it: for as long as your account is open. When you delete your account, its data is deleted from our database straight away: posts, personas, connected accounts, analytics, settings and plan records.
• Uploaded and generated images: your logo and the images stored for your posts are not yet removed automatically when you delete your account. Email vicente@letterly.pro and we will delete them.
• Backups: copies of deleted data can remain in our provider’s backups until those are replaced in the normal backup cycle.
• Payment records: Polar keeps them for as long as tax law requires.
• Emails with us: for as long as we need them to help you and to keep a record of what was agreed.
• Technical logs: kept by our hosting providers for a short time, usually no more than 30 days.
• Clarity data: Microsoft keeps recordings for 30 days and summary data for up to 13 months.

8Cookies and browser storage

Letterly stores a few small things in your browser. Most are needed for the site to work and don’t need your consent. Clarity is the exception, and it only runs after you allow it.

DataFast runs without cookies. We don’t use advertising or social media tracking cookies. You can change your choice at any time, and turning Clarity off also clears its cookies.

Change cookie settings

9Your rights

Under the GDPR, you have the right to:

• Access your data and get a copy. You can download most of it yourself in Settings, under Security, with Export your data.
• Correct it. Most details can be changed in your settings.
• Delete it. Settings, under Security, has Delete account, which removes your account and its data.
• Restrict processing while a question about it is being settled.
• Take it with you in a machine-readable format. The export is a JSON file.
• Object to processing based on our legitimate interests.
• Withdraw consent at any time, for Clarity through the cookie settings. This doesn’t affect what happened before.

To use any of these rights, email vicente@letterly.pro. We reply within one month, as the law requires, and may first ask you to confirm it is you.

If you think we have handled your data wrongly, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (cnpd.pt), or to the authority where you live. We would appreciate the chance to put it right first.

10How we protect it

Your data is stored with Supabase in the EU, and it is encrypted in transit and at rest. Row-level security means each account can only read its own data, and administrative access is limited to Vicente. Access tokens for your social accounts are stored so Letterly can post for you. You can disconnect an account at any time in Settings, under Integrations.

No system is perfectly secure. If a breach affects your data and puts your rights at risk, we will tell you and the data protection authority, as the law requires.

11Age limit

Letterly is for people aged 18 or over. We don’t knowingly collect data from anyone younger. If you believe someone under 18 has given us their data, email vicente@letterly.pro and we will delete it.

12People who don’t use Letterly

Some of the data we process is about people who are not Letterly users: writers whose public posts a user adds as a persona, and people who click a tracked link. We use persona posts only to describe a writing style for the user who added them, relying on that user’s legitimate interest, and link clicks only as counts.

If you are one of these people and want your data removed, email vicente@letterly.pro.

13Changes to this policy

If we change this policy in a way that matters, we will email account holders before the change takes effect. The effective date at the top shows the current version, and earlier versions are available on request.

14Contact

Vicente Évora, Letterly, Portugal. vicente@letterly.pro

See also the Terms of service.