Privacy Policy

Last updated: 3 October 2026. Deutsche Fassung: for users in Germany, the German version prevails.

This policy explains what personal data Letterbot AI processes when you use our website letterbot.ai, the Letterbot AI Chrome extension and the web app at letterbot.ai/app: why we process it, who receives it, how long we keep it and what rights you have.

1. Who is responsible

The controller under Article 4(7) GDPR is:

See also our legal notice. We have not appointed a data protection officer. You can reach us about any privacy matter at the email address above.

2. The short version

• When you use a writing tool, the text you give it is sent to our server and on to OpenAI to generate the result. For replies, the email you are replying to is included.
• We do not store the text of your emails or the generated results on our server. For each request we store a usage record: your user ID, your email address, which app and which tool you used, and the time.
• Login runs through Auth0, payments through Stripe.
• In Gmail, the extension uses InboxSDK, a library from Streak, which sends technical usage and error data to Streak.
• Our website (not the extension and not the web app) uses Google Analytics 4. It loads when you open a page, without asking for your consent first. Section 3.9 explains how to turn it off.
• Your settings stay in your browser.

3. What we process, why, and on what legal basis

3.1 Writing tools (Chrome extension and web app)

Data: the text you type, paste or select, the tone and language you choose and, for the reply tool, the email you are replying to. Together with each request we receive your user ID and the email address of your account. In Gmail, the extension reads the newest message of the thread (without the quoted history) only when you open the Letterbot panel in a reply window, and it sends text to our server only when you start a tool. Long texts are shortened before they are processed. Older versions of our desktop app, which we no longer offer, send the same data.

Purpose: to generate the text you asked for.

Legal basis: performance of the contract with you, Article 6(1)(b) GDPR.

Recipients: our API, hosted on Heroku, and OpenAI, which generates the text. We do not store the content of requests or results in our database.

Other people in your emails: the text you send may contain personal data of other people, for example the sender of an email you reply to. We process this data on the basis of your and our legitimate interest in handling your correspondence, Article 6(1)(f) GDPR. Please send only what you are entitled to share and what the task needs.

3.2 Usage records

Data: for each request to a writing tool we write one row to a PostgreSQL database hosted on Heroku: your user ID, your email address, the app you used (Chrome extension, web app or the old desktop app), the tool you used (for example reply or summary) and a timestamp. The row contains no email text and no generated text.

Purpose: to see which apps and tools are used, to detect abuse, and to plan capacity and costs.

Legal basis: our legitimate interest in operating, securing and improving the service, Article 6(1)(f) GDPR. You can object, see section 9.

Retention: these records are not deleted automatically. We keep them until you ask us to delete them or until your account is deleted. Section 8 explains how deletion works.

3.3 Account and login

Data: your email address, name and user ID, which we receive through Auth0 from the sign-in method you choose on the login page. Auth0 also processes technical login data such as your IP address and browser details. The extension keeps your profile (email address, name, user ID) in the browser's local extension storage. The web app keeps the Auth0 login session in your browser's local storage.

Sign-in with Google: if you sign in with Google, Google Ireland Limited processes the sign-in as its own controller and passes your name, email address and profile picture to Auth0. Your user ID is then derived from your Google account ID.

Purpose: to log you in and to link your usage and subscription to you.

Legal basis: contract, Article 6(1)(b) GDPR.

Recipient: Auth0, a service of Okta, Inc. We use an Auth0 tenant in the EU region.

3.4 Payments and plan check

Data: when you subscribe, our pricing page sends you to Stripe Checkout and passes your user ID, which Stripe stores with the subscription. Stripe collects your payment details, billing details and email address and creates a customer and a subscription. We never receive full card numbers. When you log in, when your browser starts, when you open the extension, when you reach your daily limit and about once an hour while you are logged in to the extension (in the web app: when you open it), our server asks Stripe which active plan belongs to your user ID or email address, so that the limits of your plan apply.

Purpose: to take payment and to give you the features of your plan.

Legal basis: contract, Article 6(1)(b) GDPR, and our legal duty to keep accounting records, Article 6(1)(c) GDPR (in Germany six to ten years, depending on the type of record).

Recipient: Stripe (Stripe Payments Europe, Limited, Ireland, and Stripe, Inc., USA). For its own legal duties and for fraud prevention Stripe acts as an independent controller, see Stripe's privacy policy.

3.5 Data stored on your device

Chrome extension: your settings (tone, language, color theme and, if you set one, your email signature) are kept in Chrome's sync storage, so Google syncs them between your own devices if you have Chrome sync turned on. Your profile, your plan with today's usage count, and whether you have seen the review prompt and update notices are kept in local extension storage.

Web app: your language, plan, daily request counter, email signature, saved templates, color theme, whether you dismissed the install hint, and the Auth0 login session are kept in your browser's local storage.

Website: if you pick a color theme or turn off Google Analytics (section 3.9), your choice is kept in your browser's local storage. When you log in, the login page and the web app set a cookie that records that you are logged in (auth0.<id>.is.authenticated, kept for one day) and keep temporary login data in your browser's session storage.

This data stays on your device, except where it is part of a request described above. Storing it is strictly necessary for the service you asked for (section 25(2) no. 2 TDDDG). You can delete it by removing the extension or clearing the site data in your browser.

3.6 InboxSDK in Gmail

The extension uses InboxSDK, a library from Rewardly, Inc., which trades as Streak (USA), to work reliably inside Gmail. While Gmail is open and the extension is installed, InboxSDK sends technical usage events and error reports to servers operated by Streak. Based on our review of the library code, these events contain, for example, the event type, timestamps, a session ID, the extension ID, the website it runs on (mail.google.com) and a hashed form of your Gmail address. Error reports contain technical error details.

Streak processes this data as an independent controller for operating and improving InboxSDK, see Streak's privacy policy.

Purpose: a reliable Gmail integration. Legal basis: our legitimate interest in a Gmail integration that works reliably, Article 6(1)(f) GDPR. Recipient: Streak (Rewardly, Inc.), USA, see section 6.

3.7 Server logs and rate limiting

Our API runs on Heroku. Heroku and our monitoring tool New Relic (EU data region) record technical request data such as IP address, time, URL path, status code and user agent. Our server also holds your IP address in memory to limit the number of requests per minute and per day, which prevents abuse and controls costs. These counters are cleared every day. The plan check sends your email address and user ID as part of the web address, so they can appear in Heroku's request logs.

Purpose: security, stability and abuse prevention. Legal basis: legitimate interest, Article 6(1)(f) GDPR. Retention: Heroku keeps only the most recent 1,500 lines of our logs, for at most one week. New Relic keeps request and error events for 8 days.

3.8 Website hosting

letterbot.ai, including the web app, is hosted on Cloudflare Pages by Cloudflare, Inc. Cloudflare processes your IP address and request data to deliver the site and to protect it against attacks. The step that sends you to Stripe Checkout also runs on Cloudflare. Legal basis: legitimate interest, Article 6(1)(f) GDPR. Retention: we do not store this request data ourselves. Cloudflare keeps it only as long as it needs it to deliver and protect the website, see Cloudflare's privacy policy.

The website's fonts are hosted on our own server. We do not load Google Fonts.

3.9 Website: Google Analytics 4

Our website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). The Chrome extension and the web app themselves do not use Google Analytics. The pricing page they open is part of our website, so Google Analytics runs there too. That page receives your user ID in its address so that your subscription can be linked to your account. It removes the user ID from the address before Google Analytics starts, so Google Analytics does not receive it.

How it runs: Google Analytics loads as soon as you open a page of our website. We do not currently ask for your consent before it loads.

Data: the pages you view, the page you came from, clicks on our download and web app buttons, and data that Google Analytics measures automatically, such as scrolling, clicks on links to other sites, time of visit, approximate location, device type, browser, operating system, screen size and language. Google Analytics sets cookies (_ga and _ga_RFT2H2DRBL) that store a random ID. They expire two years after your last visit. According to Google, Google Analytics 4 does not log or store IP addresses: for visitors in the EU it uses the IP address only to derive an approximate location and then discards it.

Purpose: to understand how visitors use our website and which pages and buttons lead to installs, so that we can improve the website.

Legal basis: our legitimate interest in measuring and improving our website, Article 6(1)(f) GDPR.

Recipient: Google processes this data on our behalf as a processor (Article 28 GDPR). Data can be transferred to Google LLC in the USA, see section 6.

Retention: Google Analytics deletes event data linked to the cookie ID after at most 14 months. The cookies expire two years after your last visit.

How to stop it: you can object at any time (section 9). The simplest way is the button below. It stores a note (lb-ga-optout) in your browser's local storage. As long as the note is there, our website does not load Google Analytics in this browser, and the button also deletes the existing Google Analytics cookies for letterbot.ai. This works on phones too. It applies only to the browser you use, and if you clear the site data for letterbot.ai, the note is gone and you need to click the button again.

You can also install Google's opt-out browser add-on (desktop browsers only), block or delete cookies for letterbot.ai in your browser settings, or use a content or tracking blocker. More information: Google Privacy Policy and how Google uses information from sites that use its services.

3.10 Contact by email

If you write to us by email, we process your message and email address to answer you. Legal basis: Article 6(1)(b) GDPR if your message concerns a contract with us, otherwise our legitimate interest in answering, Article 6(1)(f) GDPR. We delete such emails once the matter is closed, unless we must keep them for legal reasons.

4. Recipients

• OpenAI (OpenAI Ireland Ltd. and OpenAI, L.L.C., USA): generates text. According to OpenAI, data sent through its API is not used to train its models unless the customer opts in, and we have not opted in. OpenAI states that API data may be kept in abuse monitoring logs for up to 30 days, unless the law requires longer.
• Heroku (Salesforce, Inc.): hosting of the API and the PostgreSQL database.
• Auth0 (Okta, Inc.): login.
• Stripe: payments and subscriptions.
• New Relic: performance and error monitoring of the API.
• Cloudflare, Inc.: hosting and delivery of the website and web app.
• Google: Google Analytics on the website.
• Streak (Rewardly, Inc., USA): InboxSDK usage events and error reports (section 3.6), as an independent controller.

OpenAI, Heroku, Auth0, New Relic, Cloudflare and Google (for Google Analytics) process data on our behalf as processors (Article 28 GDPR). Stripe acts in part under its own responsibility (section 3.4). Streak acts as an independent controller (section 3.6), and so does Google for sign-in with Google (section 3.3). We do not sell your data and we do not use it for advertising. We do not share it with anyone else unless the law requires it.

5. No training, no automated decisions

We do not use your emails or generated texts to train AI models. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects (Article 22 GDPR). The texts are generated by an AI model and can be wrong, so please check them before you send them.

6. Transfers outside the EU

OpenAI, Salesforce (Heroku), Okta (Auth0), Stripe, New Relic, Cloudflare, Google and Streak are based in the USA or may process data there. The legal basis for each transfer:

• Salesforce (Heroku), Okta (Auth0), Stripe, New Relic, Cloudflare and Google LLC are certified under the EU-US Data Privacy Framework. Transfers to them are based on the adequacy decision of the European Commission of 10 July 2023 (Article 45 GDPR).
• OpenAI is not certified under the Data Privacy Framework. Our contract partner is OpenAI Ireland Ltd. Transfers to OpenAI in the USA are based on the EU Standard Contractual Clauses in OpenAI's data processing addendum (Article 46(2)(c) GDPR).
• Streak does not state that it is certified under the Data Privacy Framework, and we have not agreed Standard Contractual Clauses with Streak. The transfer to Streak is therefore covered neither by an adequacy decision nor by Standard Contractual Clauses. US authorities may be able to access data there without you having the same legal remedies as in the EU.

You can ask us for a copy of the Standard Contractual Clauses.

7. How long we keep data

• Text you send and the results: not stored by us. According to OpenAI, kept by OpenAI for up to 30 days for abuse monitoring.
• Usage records (section 3.2): until you ask us to delete them or your account is deleted. There is no automatic deletion.
• Account data at Auth0: until your account is deleted.
• Payment and billing records: as long as tax and commercial law require (six to ten years).
• Server logs: Heroku keeps the most recent 1,500 log lines, for at most one week. Monitoring data at New Relic: 8 days. IP counters for rate limiting: cleared daily.
• Google Analytics: event data at most 14 months, cookies two years after your last visit.
• Data on your device: until you remove it.
• Emails to us: until the matter is closed, unless the law requires us to keep them.

8. Deleting your account and data

There is no self-service deletion yet. Write to [email protected], ideally from the email address of your account, and ask us to delete your account. We then delete your usage records in our database, your Auth0 user account and your customer record at Stripe. If you have an active subscription, we cancel it. Data that we must keep under tax and commercial law is restricted instead of deleted and removed when the retention period ends. Data stored on your device is removed when you uninstall the extension or clear the site data in your browser.

9. Your rights

You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). To use them, write to [email protected]. To find your records, we may ask you to write from the email address of your account.

Right to object (Article 21 GDPR): where we process your data on the basis of legitimate interests (Article 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We then stop the processing unless we can show compelling legitimate grounds that override your interests, or the processing serves legal claims.

Right to complain: you can complain to a data protection supervisory authority, in particular in the EU member state where you live or work. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

You are not legally required to give us your data. Without the data described in sections 3.1 to 3.4 we cannot provide the writing tools.

10. Chrome Web Store: user data and limited use

The extension handles the text you type or select in Gmail, the email you reply to, and your account details only to provide the features you use. Our use of this data complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. We do not sell this data, we do not use or transfer it for advertising, creditworthiness or lending purposes, and we do not let people read it unless you agree, it is needed for security, or the law requires it.

11. Security

Data is transmitted encrypted over HTTPS, and the connection between our API and the database is encrypted as well. No system is completely secure, so we cannot guarantee absolute security.

12. Children

Letterbot AI is not meant for children under 16. We do not knowingly collect data from them. If you think a child has given us data, contact us and we will delete it.

13. Links to other sites

Our website links to sites of other providers, such as the Chrome Web Store. Their own privacy policies apply there.

14. Changes

We update this policy when our service or the law changes, and we change the date at the top. For significant changes we give notice on the website or by email.

15. Contact

Email: [email protected]. Postal address: see section 1 and our legal notice.