Privacy Policy

This policy explains how Chase Labs Ltd, trading as The Very Good Letter Company ("we", "us"), handles personal data. The Very Good Letter Company is a trading name of Chase Labs Ltd, registered in England and Wales (company number 15205904). Registered office: Advanced Technology Innovation Centre, 5 Oakwood Drive, Loughborough, LE11 3QF, United Kingdom.

It covers our website (verygoodletter.co), our app (app.verygoodletter.co), our API and our connector for AI assistants, and the letters we make and post. It's written for:

• our customers, and people who use the Services for them;
• visitors to our website, including anyone who asks for a sample;
• recipients: the people our customers send letters to, and the contacts and customers in the apps our customers connect.

If you have a question, or want to use your rights, email hello@verygoodletter.co.

1. Who's responsible for your data

We're the controller of personal data about our customers, their users, our website's visitors, and people who ask us for samples or news. We decide how and why it's used.

Our customers are the controller of their recipients' data. When a customer brings us the people they're writing to (by uploading a spreadsheet, typing them in, connecting a CRM, shop or payment account, through our API, or through an AI assistant), and the words of their letters, we process that data for the customer, on their instructions, as their processor. The customer decides who to write to and why, and is responsible for having a lawful basis. Section 5 explains exactly what comes in and goes out. If you've received a letter from one of our customers, see section 11.

2. What we collect

When you use the app, or make an account

• Your name and email address, and whether you've confirmed it.
• If you use the app without an account, a guest record that keeps your drafts with your browser.
• Your brand: business name, a line under it, colours, typeface, logo, website, and any contact details you choose to print on letters.
• Your letters: their words, looks and settings; files you upload (images and PDFs).
• Your sign-ins: when, your IP address and your browser or device.

In a business account

• The business's owners and admins, and its members, can see each other's names, email addresses and roles, and the business's letters, lists, brand and orders, whoever made them.
• When someone is invited, we keep their email address and role with the invitation, and email them a link to join.
• What anyone makes in a business account belongs to the business, which is the controller of its recipients' data.

When you pay

• Your order, what it cost, and the payment's references. Our payment provider, Stripe, collects your name, email, billing address and card details. We never see or store your full card details.
• For plans and packs: which plan, its dates and your credits.

Your recipients (as processor, for our customers)

• Each recipient's name, company and postal address, and any other fields the customer brings in with them, such as a job title, an order count, tags or notes. From some sources this includes email addresses and phone numbers: see section 5.
• The words of each letter, which may be written for that person.
• Where they came from in a connected app, each person's ID there (never shown), so we can find them if asked to delete them.

When you use the API or connect an assistant

• Your API keys: we keep only a fingerprint (a one-way hash) and the last four characters, with each key's name, permissions and when it was last used.
• Assistants you connect: which assistant, what you allowed, and the tokens that let it act for you.
• What the API or assistant asks for and does, as with any use of the app, and a log of orders placed and customers read through the connector.

When you ask us to read your website

• The address you give us, and the brand details we find there (name, logo, colours and typeface).

On our website

• If you ask for a sample: your name, email, company (if you give one) and postal address, and whether you'd like to hear from us by email or post, with the wording you agreed to and when.
• If you ask to hear when we post outside the UK: your name, email, company and country.
• To fill in your company and address, we may look up your email's domain (not for personal email providers like Gmail) and search addresses as you type.
• To stop spam, Cloudflare Turnstile checks that the sample form is being filled in by a person. It uses your IP address and information about your browser.
• To see how the website is used, we count visits with Vercel Web Analytics: the page, the page you came from, your browser and operating system, the kind of device, and your rough location (country, region and city). It uses no cookies and stores nothing in your browser. Vercel tells visits apart with a code made from the request, which it discards after 24 hours, and we see only totals.

Always

• Technical data our hosts record when you visit: IP address, browser, pages and times.
• Messages you send us, and our replies.

Apart from counting visits to our website as above, we don't use analytics. We don't use advertising or tracking tools, and we don't buy personal data.

3. Why we use it, and our lawful bases

What we do	Lawful basis
Provide the app, your account, the API and the connector; make, write and post your letters; take payment; send sign-in links and order updates	Contract (or steps before one) with you
Process recipients' data and letters for our customers, including fetching it from apps they connect and passing it to assistants they connect	On our customer's instructions, as their processor; the customer is responsible for the lawful basis
Keep the Services secure, prevent fraud and abuse, enforce our terms, and log access to recipient data	Legitimate interests: keeping the Services, our customers and recipients safe
Improve the Services, fix problems, plan new features, and count visits to our website	Legitimate interests: running and improving our business
Send a sample you ask for, and answer your questions	Legitimate interests (or steps before a contract)
Send you ideas, news and offers by email or post, if you ask for them	Consent, which you can withdraw at any time
Tell business customers about similar services we offer	Legitimate interests; you can opt out at any time
Keep records for tax and accounting, and meet our legal obligations	Legal obligation
Establish, exercise or defend legal claims	Legitimate interests

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. We don't use your content, or your recipients' data, to train AI models.

4. Who we share it with

We don't sell personal data, share it for advertising, or share one customer's data with another.

We make your letters ourselves. The systems that turn your words into pen strokes, and print, write and pack your letters, are our own, on UK servers. No one outside the company can see your recipients' data.

Our service providers (processors) handle personal data for us, under contract, only to provide their service:

Who	What they do	Personal data	Where
Vercel	Hosts the app and the website, and counts visits to the website (Vercel Web Analytics, without cookies).	Everything sent to them, including your IP address. Counting visits: the page, where you came from, your browser, device and rough location.	UK (London) for the app; worldwide network
Neon	Our database.	Your account, letters, brand and recipient lists.	UK (London)
Cloudflare	Stores files (uploads, logos, letter artwork and print files), and checks the website’s sample form for bots.	Your files and each letter’s artwork; on the sample form, your IP address and browser signals.	Worldwide
Stripe	Takes payments, plans and receipts.	Your name, email, billing address and card.	UK, EU and US
Resend	Sends our emails: sign-in links and order updates, and passes sample requests from the website to us.	Your email address and what the email says.	EU (Ireland)
Ideal Postcodes	Finds UK addresses from a postcode.	The postcode you type.	UK
Google	Supplies typefaces to the app (Google Fonts), and finds addresses on the website’s sample form (Google Places).	Fonts: your IP address and browser. Places: what you type in the address search.	US
Postal operators	Deliver your letters.	Each recipient’s name and address, on the envelope.	UK

Services you choose to connect are run by others, under their own terms and privacy policies. Section 5 explains what we take from them and give them.

What	What for
CRMs and shops: HubSpot, Salesforce, Pipedrive, Zoho, Capsule, Attio, Shopify and Stripe	Read-only: the customers or contacts you choose, to write to.
AI assistants: Claude, ChatGPT, Grok, Gemini and others	Work on your letters for you, through our connector, once you sign in and allow it.
Your website	Read once, when you ask, for your name, logo, colours and typeface.

Others, when needed:

• professional advisers, such as our lawyers, accountants and insurers;
• the police, courts, regulators or others, where the law requires it, or to protect our rights, our customers, recipients or others;
• a buyer of, or successor to, our business, who'd be bound by this policy.

5. Connected apps, AI assistants and the API: what comes in, what goes out

Customers can bring people in from other apps, and let other software work on their letters. This is how that data moves, and how we look after it. For this data we act for the customer, as their processor.

What comes in

From	How it connects	What we read
CRMs: HubSpot, Salesforce, Pipedrive, Zoho, Capsule and Attio	You sign in to the CRM and allow our app, with read-only permissions where the CRM offers them (Salesforce offers only general access; we only read)	The contacts and lists you choose to import: names, companies, job titles and postal addresses, and email addresses, phone numbers and other fields where the CRM has them
Shopify	An app you make in your own shop, allowed only to read customers, whose keys you give us	The customers and segments you choose: names, default addresses, number of orders, amount spent and tags. Not email addresses, phone numbers or marketing preferences
Stripe (your own Stripe account, as a source of customers)	A restricted key you make, allowed only to read customers. We refuse any other kind of key	Your customers' names and shipping (or billing) addresses. Not email addresses or phone numbers
Spreadsheets and exports	You upload or paste them	The columns you include. From a Shopify export, we leave out email addresses, phone numbers and marketing settings
Your code (the API) or an assistant (the connector)	Your API key, or the assistant you signed in and allowed	Whatever your code or assistant sends us for you: letters, words, and the people to write to, including a letter written for each person

How we handle it:

• Only what you choose, only when you ask. We read from a connected app when you import from it, or when an assistant you've connected asks to read your customers. We never write back to, change or delete anything in your apps.
• You confirm you may use it. Before you connect Shopify or Stripe, you confirm you're allowed to use your customers' names and addresses to send them letters, and that you're giving us read-only access; we record that. For any source, it's your responsibility, as our Terms say.
• Credentials are encrypted. The tokens and keys that let us read your apps are stored encrypted (AES-256), never shown again, and deleted when you disconnect. To cut access altogether, also remove our app or your key in the app itself.
• People come in as a recipient list in your account. Only you, and our staff where needed to make and post your letters or support you, can see it; staff access to recipient data is logged.
• Email addresses and phone numbers that come in with a list are kept with it. We don't use them to contact anyone. If we add features that use them, such as an email follow-up, they'll be used only on your instructions, and we'll update this policy first.
• Lists from connected apps are deleted 12 months after they were last used. Lists you upload or type in are kept until you delete them.

What goes out

• To make and post your letters: each recipient's name, address and letter go to our own production systems, on UK servers, only for orders you place; and their name and address go to the postal operator, on the envelope.
• To AI assistants you connect (such as Claude, ChatGPT, Grok or Gemini): what the assistant asks for while working for you. That can include your brand, your letters and their words, your recipient lists, prices and orders, and customers from apps you've connected (up to 2,000 at a time). You choose which assistant, and what it may do, when you allow it; placing orders is a separate permission. We log each time an assistant reads customers from a connected app or places an order. You can disconnect an assistant at any time from your account, and it stops at once.
  • Once data reaches an assistant, it's handled by the assistant's provider under your agreement with them, which may mean it's kept in your conversation history and, depending on your settings and plan, used under their terms. We're not responsible for that, so only connect assistants you trust with this data, and check your settings with them.
  • Our "Open in" links to assistants carry only the request shown on the page, not your data.
• Through the API: data you ask for goes to your own code and systems, with your key. What happens to it there is your responsibility.
• To look up addresses: a postcode (in the app) or what you type (on our website's sample form) goes to our address providers, to find the full address.
• Never: to other customers, to data brokers, or for advertising.

If you're one of our customer's contacts or customers and want to know what they've shared with us, or to have it deleted, see section 11.

6. Transfers outside the UK

Some of our providers, and some apps and assistants customers connect, are based or process data outside the UK, including in the EU and the US. Where our providers do, we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework where a provider is certified), or on the ICO's International Data Transfer Agreement or Addendum to the EU's standard contractual clauses, with any extra measures needed. Transfers to apps and assistants a customer connects are made on the customer's instructions, under their agreements with those providers. Ask us if you'd like to know more.

7. How long we keep it

What	How long we keep it
Your account: name, email and brand	While your account is open. Deleted within 90 days of your asking us to close it, apart from orders (below).
Drafts made without an account	Until 12 months after they were last used.
Sign-in links	30 minutes.
Signed-in sessions, with the IP address and device	90 days after their last use.
Recipient lists from spreadsheets, or typed in	Until you delete them, or close your account.
Recipient lists from connected apps	12 months after they were last used, then deleted automatically.
Access to connected apps (tokens and keys, encrypted)	Until you disconnect, or the app withdraws it.
API keys (we keep only a fingerprint) and assistant connections	Until you revoke or disconnect them, or close your account.
Orders: who each letter went to, what it said, and its artwork	Up to 6 years after the order, for tax, accounting and any dispute.
Payment records (Stripe keeps card details; we never see them)	6 years, for tax and accounting.
Rendered pen strokes, kept to make previews quicker	Up to 12 months after they were last used.
Security and access logs	24 months, then deleted automatically.
Sample requests and questions from the website	Up to 24 months. Marketing consent lasts until you withdraw it.

When something reaches the end of its period, we delete it or make it anonymous. We may keep data for longer where the law requires it, or where it's needed for a legal claim.

8. How we keep it safe

All data travels encrypted (HTTPS). Access to the apps you connect is stored encrypted. API keys are kept only as fingerprints. Staff access to recipient data is limited and logged. Our providers are chosen for their security. No system is perfectly secure, so if you think something's wrong, tell us straight away. If a breach affects your data and puts you at risk, we'll tell you, and the regulator where the law requires.

9. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have it corrected if it's wrong, or deleted;
• restrict or object to how we use it, including objecting to direct marketing at any time;
• have it transferred to you or someone else (portability);
• withdraw consent where we rely on it, without affecting what we did before.

Some rights have limits, for example where we must keep data by law. To use them, email hello@verygoodletter.co. We may ask you to prove who you are. We'll reply within one month, or tell you if we need longer.

You can close your account at any time by emailing us. You can delete your letters, lists, recipients and files yourself in the app, revoke API keys, and disconnect assistants and apps from your account.

If you're unhappy with how we've handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or 0303 123 1113.

10. Children

The Services are for adults (18 or over). We don't knowingly collect data from children.

11. If you've received a letter, or a customer has your details

You received a letter, or are in one of our customer's lists, because that customer chose to write to you and gave us your details, from their own records or an app they use. The customer is the controller of your data and decided to write to you; we made and posted the letter for them. We use your details only to make and send their letters, and keep them as section 7 says.

If you don't want to hear from them again, or want to know how they got your details, please contact the sender: their name is on the letter. If you can't reach them, email us at hello@verygoodletter.co with the sender's name, and we'll pass your request on and help them deal with it, including deleting your details from their lists with us.

12. Cookies

We use only the cookies and browser storage needed to run the Services, and to remember choices you make. See our Cookie Policy.

13. Changes to this policy

We'll update this policy as the Services change. The version and date at the top tell you which you're reading, and once it has changed, the end of this page says what changed. If a change materially affects how we use your data, we'll tell customers by email or in the app before it takes effect.

What's changed

Version	Date	What changed
1.0	16 October 2026	First published.
1.1	16 October 2026	Our website now counts visits with Vercel Web Analytics, without cookies.