LetterCraft.
Create a letter

LetterCraft

Privacy Policy

Last updated: October 9, 2026

This policy describes how LetterCraft handles information when you visit our website, create an account, generate or save business documents, and purchase a subscription. For privacy questions, contact contact@lettercraftai.com.

1. Information we collect

  • Account information: your email address, account identifier, profile name, optional uploaded avatar, and authentication information. Email and password authentication is handled by Supabase Auth.
  • Google sign-in information: when you choose Google sign-in, Google provides basic identity information, such as your name, email address, profile picture when available, and Google account identifier. We do not receive your Google password or request access to Gmail, Google Drive, or your contacts for sign-in.
  • Document content: titles, drafts, document text, company and recipient details, employment information, generation instructions, and images you submit, such as logos or letterhead backgrounds. Documents can contain information about other people; only submit information you are authorized to use.
  • Billing information: your selected plan, Stripe customer and subscription identifiers, payment amounts, currency, payment status, and billing dates. Stripe collects payment details through its hosted checkout and billing portal; our application does not store full card numbers or card security codes.
  • Usage and technical information: document generation and download events, template types, timestamps, and operational error logs. Hosting and service providers may also process IP addresses, browser information, and request logs when delivering and securing the service.
  • Support communications: your email address and information you include when contacting us.

2. How we use information

We use information to authenticate users, maintain accounts, generate and store requested documents, provide downloads, process subscriptions, calculate remaining credits, offer customer support, and operate and secure the service. Administrators use account, billing, and usage records to manage subscriptions, investigate problems, prevent misuse, and understand which document features are used.

3. Who receives information and how it is disclosed

Information is transferred through website requests, authentication redirects, server-to-server API calls, signed payment webhooks, and support email, as appropriate to the feature you use. The services involved include:

  • Supabase: processes authentication and stores account profiles, saved documents and drafts, uploaded avatars, subscription records, payment records, and usage logs.
  • Hostinger: hosts the application and processes website traffic and operational data needed to deliver it.
  • Stripe: receives your account email and identifiers to create billing records, and collects payment information directly during checkout. Stripe sends subscription and payment updates to our server through signed webhooks.
  • Google: processes authentication when you select Google sign-in. The website also requests fonts from Google Fonts, which involves sending technical request information, such as your IP address and browser headers, to Google.
  • Anthropic: when external AI generation is enabled and you use it while signed in, our server sends the selected document type, relevant text fields, and additional instructions to Anthropic to generate text. The current AI request does not include uploaded image files or the existing body-text field. Text you place in other fields or instructions is included. If external AI is unavailable or disabled, the application can generate text using its built-in composer.
  • Support email providers and authorized personnel: process messages you send us. Authorized administrators can access account and document records for operating and supporting the service.

We do not sell your personal information or share it for third-party advertising. We may disclose relevant information when required by applicable law or to protect the service, users, or others from fraud, abuse, or security threats. Service providers process information under their applicable terms and privacy policies. Their processing locations and retention practices may differ from ours.

4. Cookies and browser storage

The guided FAQ chat matches questions against prepared answers in your browser. Chat messages are not sent to an AI service or saved by the application and are cleared when the page is reloaded. Pricing questions retrieve current public plan information from Supabase. If you choose to email support, the information you send is handled as a support communication.

We use authentication cookies to maintain your sign-in session and support secure login flows. The dashboard uses browser local storage to remember your appearance preference. Blocking or deleting authentication cookies may prevent sign-in or sign you out. The application does not currently integrate advertising trackers.

5. Retention and deletion

Saved documents and drafts remain associated with your account until deleted. You can delete documents in the dashboard and update your profile there. To request account deletion or assistance accessing your information, email us from your registered address. We may verify your identity before acting on a request. Active subscriptions must be cancelled before account deletion is completed.

Deleting an account removes its profile and associated saved documents from the application database. Some payment, subscription, and usage records may remain for accounting, security, and service administration; removing an account does not automatically erase Stripe records or provider backups and logs. Retention by external providers follows their policies and any applicable requirements.

6. Security practices

The production service uses HTTPS to protect information in transit. The application checks authentication and account roles on protected server routes and uses Supabase row-level security to restrict access to account-owned records. Uploaded avatars use a private storage bucket and temporary signed URLs. Server credentials are kept out of frontend code, and Stripe webhook signatures are verified before payment updates are processed.

These measures reduce risk but cannot guarantee absolute security. Protect your credentials and avoid submitting unnecessary sensitive information in documents or AI instructions.

7. Your choices and privacy requests

You can choose email/password or Google sign-in, edit profile information, delete saved documents, and manage subscriptions through the dashboard. You may also remove LetterCraft access through your Google account settings; this does not itself delete your LetterCraft account or cancel a subscription.

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, or to object to or restrict certain processing. Send requests to contact@lettercraftai.com. We will assess requests under applicable requirements.

8. International processing

Our service providers may process or store information in countries other than your own. The locations depend on the hosting, database, authentication, payment, and AI services used, and those countries may have different data-protection rules.

9. Children’s privacy

LetterCraft is intended for business and professional use, not for children. If you believe a child has provided personal information without appropriate authorization, contact us so we can investigate and address it.

10. Changes and contact

We may update this policy as the service or its practices change. The updated policy will appear on this page with a revised date. For questions or requests, email contact@lettercraftai.com.