Privacy Policy

Last updated: 21 May 2025

Who we are

Told in Letters is operated by Romero as a sole trader, based in the United Kingdom. We are the data controller for the personal information described in this policy.

For any privacy question or request, contact us at hello@toldinletters.co.uk.

What this service does, in brief

Someone (the buyer) purchases a guided life-story journal as a gift for a family member (the storyteller). The storyteller answers questions about their life. We compose those answers into a keepsake, including a personal opening letter, and deliver it as a PDF by email.

The information we collect

• From the buyer:name, email address, and the recipient's name. Payment is processed by Stripe; we do not see or store your card details.
• From the storyteller: name, email address, and the answers they choose to provide.
• The answers themselves: these are free-text personal stories. They may include sensitive information about the storyteller and about other people they mention.

Sensitive information

Life-story answers can include what data protection law calls special category data, for example details about health, religious or political beliefs, or sexuality, relating to the storyteller or to people they mention. By taking part, the storyteller chooses what to share, and consents to us processing this information for the sole purpose of creating their keepsake. They can skip any question and can ask us to delete their information at any time.

Why we process your information, and our lawful basis

• To provide the keepsake you bought or are taking part in (lawful basis: performance of a contract).
• To send service emails such as the invitation link and the finished keepsake (performance of a contract).
• For special category data within the answers, our basis is your explicit consent, given when the storyteller begins answering.

We do not use your information for advertising, and we do not sell it.

Who we share information with

We use a small number of trusted service providers to run the service. Each only receives what it needs:

• Stripe (USA) processes payments. They receive your name and email for receipts; card details go directly to Stripe and we never see them.
• Resend (USA) sends our emails, including the keepsake PDF attachment.
• Turso (EU) stores our database, hosted in AWS EU West (Ireland).
• Vercel (USA, with EU edge locations) hosts and runs the website.
• Google(USA) provides the AI service (Gemini) that composes the opening letter. To do this, the storyteller's answers are sent to Google to generate the text. Google processes this data under their Cloud Data Processing Addendum, which includes Standard Contractual Clauses for international transfers.

We may also disclose information if required by law.

Storing your information internationally

Our database is hosted in the EU (Ireland). Some of our service providers, including Stripe, Resend, Vercel, and Google, are based in the United States. Where data is transferred outside the UK, we rely on adequacy decisions or Standard Contractual Clauses approved by the UK government.

How long we keep your information

We keep the answers and the finished keepsake indefinitely, so that we can re-send the keepsake if you lose it, or produce a printed copy if you ask for one later. You can ask us to delete your information at any time using the “Delete my data” button on your order page, or by emailing hello@toldinletters.co.uk. When you do, we permanently erase the answers, the keepsake, and the associated account records.

Your rights

Under UK data protection law you have the right to access your information, correct it, have it erased, restrict or object to its processing, and receive a copy in a portable format. To exercise any of these, contact hello@toldinletters.co.uk. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Cookies

We use a single essential cookie to keep you signed in while you use the service. It is necessary for the site to work and is not used for tracking or advertising. We do not use any analytics or advertising cookies.

Children

This service is intended for adults. It is not directed at children, and we do not knowingly collect information from anyone under 18.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed.