💌 We believe love should be simple and private. We collect as little data as possible, we ask for your consent where the law requires it, and we never sell your data to anyone.
The Site lettertomylove.com is operated by a private individual based in Ukraine, who acts as the "data controller" for the personal data described here. For any privacy question or to exercise your rights, contact us at hello@lettertomylove.com. The operator's full name and postal address are available on request and are provided where required by applicable law.
This Policy explains what personal data we process when you use the Site, why, on what legal basis, how long we keep it, and what rights you have. It applies to visitors worldwide and is designed to meet the standards of the EU/EEA General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection (nFADP), and the California Consumer Privacy Act (CCPA/CPRA), among others.
When you submit a letter, we collect:
If you choose to subscribe to project updates, we collect your email address. Email is entirely optional and is collected only with your consent.
We do not collect your name or other identifying information unless you choose to include it in the letter text itself. Please avoid doing so.
Under the GDPR and similar laws, we rely on the following legal bases:
| Data | Purpose | Legal basis |
|---|---|---|
| Letter content & cities | Public anonymous display, the core service you requested | Legitimate interest, Art. 6(1)(f) — operating the service you chose to use |
| IP fingerprint (irreversible hash) | Abuse and spam prevention | Legitimate interest, Art. 6(1)(f) |
| Email address | Sending project updates you asked for | Consent, Art. 6(1)(a) — withdrawable at any time |
| Cookies (functional) | Remembering your language and consent choices | Necessary for the service / consent for non-essential |
We use the data we collect exclusively to:
We do not use your data for advertising, behavioural profiling, or any commercial purpose, and we never sell it.
If you subscribe, we use your email only to send occasional project updates. Your consent is voluntary and separate from any other action. You can withdraw it at any time — every email contains an unsubscribe link, or you can email us. Withdrawing consent does not affect the lawfulness of processing before withdrawal.
We use minimal cookies/local storage for basic functionality — remembering your language preference, your cookie-consent choice, the city you pick for the "letters to your city" view (including its name in the languages you switch to), and which letters you have liked.
All of it stays on your device, with one exception: your chosen language is also kept in a small cookie that is sent to our server with each request. This is what lets the page open in the language you chose instead of briefly appearing in another one and switching. The cookie holds nothing but a two-letter language code, expires after a year, and is not used to recognise or follow you.
We do not use advertising or cross-site tracking cookies. Where the law requires it, non-essential cookies are set only after you give consent through our cookie banner, and you can change your choice at any time.
Letters are displayed publicly without any author information. We strongly encourage you not to include personal details (full name, address, phone number) in your letter text.
We rely on the following providers, who process data on our behalf under their own safeguards:
Our providers may store or process data on servers located outside your country, including outside the European Economic Area (for example, in the United States). Where personal data is transferred internationally, we rely on appropriate safeguards recognised under the GDPR — such as the European Commission's Standard Contractual Clauses and, where available, providers' EU/EEA data regions and adequacy decisions. You can request more detail about these safeguards by contacting us.
We keep personal data only as long as needed for the purposes above:
If you ask us to delete your letter or data, we will action your request within 30 days (and sooner where feasible). Limited copies may persist in routine backups for a short period before being overwritten.
We apply reasonable technical and organisational measures to protect your data — including encrypted connections (HTTPS), restricted administrative access, and secure cloud storage. No method of transmission or storage is completely secure, but we work to protect your information and to limit what we collect in the first place.
Submitted letters may be screened by automated tools to detect prohibited content (for example, hate speech or spam) before publication. This screening does not produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR; a human can review any decision on request.
Depending on your location, you may have the right to:
California residents (CCPA/CPRA): you also have the right to know what personal information we collect, to request its deletion, and to non-discrimination for exercising your rights. We do not sell or share personal information as defined by the CCPA.
To exercise any right, contact hello@lettertomylove.com. We will respond within the time limits set by applicable law.
The Site is not directed at children under 16, and we do not knowingly collect data from them. If you believe a child under 16 has provided personal data, please contact us and we will delete it promptly.
We may update this Policy from time to time. The "Last updated" date at the top reflects the latest version. Material changes will be highlighted where appropriate.
For any privacy-related question or request: hello@lettertomylove.com.