This Privacy Policy describes how The Letter Tree ("we", "us", or "our") collects, uses, shares, and protects your personal information when you visit our website or use our handwritten letter mailing service. We respect your privacy and are committed to protecting it in compliance with applicable data protection laws.
1. Information We Collect
We collect information you provide directly to us when you place an order or contact us:
- Contact information: Your email address (used for order confirmations and customer support).
- Recipient information: The recipient's name and full mailing address (used solely to mail your letter).
- Letter content: The message you write, any special instructions (ink preference, doodles, etc.), and an optional sender name.
- Payment information: Payments are processed by Stripe. We do not collect or store your credit card number, CVV, or billing details on our servers. Stripe's privacy policy governs the handling of payment data.
- Communications: If you email us, we retain the content of your message and your email address to respond to your inquiry.
We also automatically collect limited technical information when you visit our website:
- Log data: Your IP address, browser type and version, pages visited, referring URL, and timestamps. This is used for security, rate limiting, and aggregated analytics.
- Local storage: If you begin writing a letter but do not complete the order, your draft is temporarily saved in your browser's local storage on your own device. This data is never sent to our servers unless you submit the order. You can clear it at any time through your browser settings.
2. How We Use Your Information
We use the information we collect for the following purposes:
- To process, fulfill, and deliver your handwritten letter order;
- To send you order confirmations, payment receipts, and important service updates;
- To respond to your customer support requests;
- To prevent fraud, abuse, and unauthorized transactions;
- To comply with legal obligations, such as responding to lawful requests from authorities;
- To improve our website and service based on aggregated, non-identifiable usage patterns.
We do not sell, rent, or trade your personal information to third parties for marketing purposes. We do not use your letter content for advertising or data mining.
3. How We Share Your Information
We share your information only in the following limited circumstances:
- Payment processing: With Stripe, our payment processor, to complete your transaction. Stripe receives your email address and payment details as needed. See Stripe's Privacy Policy for details.
- Mailing: The recipient's name and address are written on the physical envelope and handed to the postal service for delivery. This is inherent to our service.
- Legal compliance: We may disclose information if required by law, subpoena, or court order, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
- Service providers: We may use trusted cloud hosting providers (such as our server host) to operate the service. These providers are bound by confidentiality obligations and may only process data as instructed by us.
We do not transfer your personal data to third parties for any purpose other than as described above.
4. Data Retention
- Paid orders: Order records (including recipient address and letter content) are retained for as long as necessary to provide our service, resolve disputes, enforce our agreements, and comply with legal and tax record-keeping requirements. We typically retain order records for up to 5 years after the order date.
- Unpaid drafts: Orders that are created but never paid are automatically deleted from our database 24 hours after creation.
- Support emails: Retained for up to 2 years after the last communication, unless a longer retention is required by law.
5. Data Security
We take reasonable technical and organizational measures to protect your personal information:
- All data transmitted between your browser and our website is encrypted using TLS/SSL (HTTPS).
- Payment data is handled directly by Stripe, a PCI-DSS Level 1 certified payment processor.
- Our database is not directly accessible from the public internet and is protected by firewalls and rate limiting.
- Administrative access to order data is password-protected and restricted to authorized personnel.
- We apply security headers (including Content Security Policy and X-Frame-Options) to protect against common web attacks.
However, no method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
6. Your Data Protection Rights
Depending on your location, you may have the following rights regarding your personal data:
- Access: Request a copy of the personal information we hold about you.
- Correction: Request correction of inaccurate or incomplete information.
- Deletion: Request deletion of your personal data, subject to legal retention requirements. Note that once a letter has been physically mailed, the recipient's address and the letter content on the physical envelope cannot be recalled.
- Objection and restriction: Request that we stop or restrict processing of your data in certain circumstances.
- Data portability: Request your data in a structured, machine-readable format.
To exercise any of these rights, contact us at yangzhuo198@gmail.com. We will respond within 30 days. We may need to verify your identity before processing your request.
7. International Data Transfers
Our service is designed for customers worldwide. Your data may be processed and stored on servers located outside of your country of residence, including in the United States or other jurisdictions where our hosting providers operate. These jurisdictions may have different data protection laws than your country. By using our service, you consent to the transfer of your information to these locations as necessary to provide the service.
8. Cookies and Tracking
We do not use advertising cookies or third-party tracking pixels. We use a single essential session cookie to keep you logged into the admin dashboard (if you are an administrator) and to maintain basic application state. This cookie is strictly necessary and does not track you across other websites. Our website does not use Google Analytics or similar advertising trackers.
9. Children's Privacy
Our service is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately and we will delete it.
10. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. The "Last updated" date at the top of this page will indicate when revisions were made. If we make material changes, we will notify you by email (sent to the address associated with your account) or by posting a prominent notice on our website.
11. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:
The Letter Tree
Email: yangzhuo198@gmail.com
We will respond to all legitimate inquiries within 48 hours.