Privacy policy

Last updated: 27 September 2026.

Courtesy translation. The reference version is the French one at lettreexpress.com/confidentialite.

Data controller

Axel Barats (sole trader), publisher of LettreExpress, 9 avenue des Allées, 64700 Hendaye, France — see the legal notice. Contact: contact@lettreexpress.com.

Free letters are generated in your browser

Free letters are generated locally, in your browser. What you type in the forms (names, addresses, contract references…) is not sent to our servers unless you use one of the features described below (AI, custom letter, payment).

Your browser's local storage. When you pay, the form and the letter are kept in your browser's local storage so that nothing is lost while you go through the payment page; they are erased once payment is confirmed. For the custom letter, your description, the recipient, your contact details and the letter are kept there so you can find it again when you come back to the page. This data stays on your device and we have no access to it: you can erase it at any time by clearing the site's data in your browser settings.

“Personalise with AI” feature

If you use AI personalisation, the letter text and the description of your situation are sent to our AI provider, Anthropic, solely to rewrite your letter (legal basis: performance of the service you request). This content is processed in the United States. Under Anthropic's commercial terms, it is not used to train its models and is deleted by Anthropic within 30 days at most, save for the exceptions set out in its terms (for example in case of a breach of its usage policies). We keep none of it. Do not enter sensitive data that the letter does not require.

Custom letter option

For the custom letter, your description and the recipient are sent to Anthropic under the same conditions, for the time of writing; we do not keep them. However, the letter we produce is stored on our servers (Supabase, Paris): this is what lets us reliably deliver it after payment, email it to you and give it back to you if you close the page (legal basis: performance of the contract). It is tied to a random reference, with no account and no identifier, and deleted automatically: 7 days for a preview that was never paid for, 30 days for a paid letter. Your own contact details do not leave your browser.

Registered post: orders placed before 27/09/2026

LettreExpress has no longer offered registered post since 27/09/2026: no data is collected or sent to a postal provider for this service any more. For orders placed before that date, the letter content and addresses were transmitted securely to our server (Supabase, Paris), then either printed by us to be handed to La Poste, or sent to our printing and mailing provider (Merci Facteur, France), solely to perform this service (legal basis: performance of the contract). They are deleted from our systems as soon as the letter is sent; we keep only the order reference and tracking number, for the periods given below.

Payment

Payments are processed by Stripe (Stripe Payments Europe, Ireland): your card details never pass through our servers. For the pro PDF, your letter content stays in your browser; only the reference of the template purchased is attached to the transaction. We keep payment records (amount, date, reference, billing email address) to meet our accounting obligations (legal basis: legal obligation).

Confirmation emails

When you buy, the email address you enter at Stripe is used to send you your order confirmation (your custom letter and its retrieval link; the tracking number for a registered letter ordered before 27/09/2026) and to answer your requests (legal basis: performance of the contract). Those emails are sent from our professional mailbox hosted by Zoho (European Union). We build no mailing list and will never send you marketing.

Audience counter and abuse protection

The site's fonts and scripts are served from our own servers. Apart from the Stripe payment page, the only third-party service your browser contacts directly is our Supabase database (servers in Paris), for the audience counter described below: this request technically transmits your IP address, which is not recorded in the counters.

To limit abuse of the AI features and of order creation (number of requests per hour), your IP address is used in memory by our server. It is never recorded in clear: only a pseudonymised fingerprint (a hash computed with a secret key held by our server) is counted in our Supabase database and deleted after 2 days (legal basis: legitimate interest in protecting the service). Like any host, Vercel also processes your IP address to deliver the site's pages to you.

Processors and transfers outside the European Union

  • Vercel Inc. (USA): hosting.
  • Supabase (servers in Paris, France): audience counters, custom letters, postal orders placed before 27/09/2026.
  • Anthropic (USA): AI writing and personalisation.
  • Stripe (Stripe Payments Europe, Ireland; some processing may be carried out in the USA by Stripe): payment.
  • Zoho (European Union): email.
  • Merci Facteur (France): printing and postal sending of orders placed before 27/09/2026 only; it no longer receives any data for new orders.

Each acts only for the purpose described above. Transfers to the United States (Vercel, Anthropic, Stripe) are governed by the European Commission's standard contractual clauses or an equivalent mechanism, under each provider's data processing agreement.

Retention periods

  • Orders never paid for: deleted within 7 days (21 days for a registered letter ordered before 27/09/2026 whose delayed payment was announced by your bank).
  • Content of a postal order (placed before 27/09/2026) hit by an incident: 60 days at most, while the order is handled; deleted as soon as the letter is sent.
  • Custom letter previews never paid for: 7 days.
  • Paid custom letters: 30 days.
  • Order references and tracking numbers: 3 years (customer service and disputes), then automatic deletion.
  • Pseudonymised IP address fingerprints used to limit abuse: 2 days.
  • Payment records: 10 years (accounting obligation, article L123-22 of the French Commercial Code).
  • Emails exchanged with us: 12 months, then deleted.
  • Your browser's local storage: until you clear the site's data (see above).

Cookies and analytics

LettreExpress uses no tracking or advertising cookies. We measure traffic with an in-house tool: only the event type, page and time are counted, plus the name of the social network when you arrive through the link on our Instagram or TikTok profile. No cookie is set, no identifier is created and your IP address is not recorded in these counters.

Your rights

Under the GDPR and the French Data Protection Act, you have rights of access, rectification, erasure, restriction, objection and data portability, as well as the right to give instructions on what happens to your data after your death. To exercise them, write to contact@lettreexpress.com. Since custom letters and orders are tied to a random reference, please give us the order reference or the email address used at payment so we can find them. You may also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).