What leaves our servers
Last updated: 13 June 2026
We’d rather be plain than reassuring. This page maps exactly what happens to your data — what we store, what is sent on to process a letter, how long things are kept, and how deletion works. We will not claim that “everything stays in the EU”, because one step — reading your letter with an AI model — involves a transfer outside it, under EU-approved safeguards. The honest version is below.
Where your data lives and goes
| Data | Where it is | How long |
|---|---|---|
| Account & profile — email, password (stored only as a hash), your onboarding answers | Our database, hosted in the EU | Until you delete your account |
| Scanned letters — the images/PDFs you upload and the explanation we generate | Our EU storage + database | Until you delete the scan or your account — or sooner if you set auto-delete in Settings |
| Letter content sent for interpretation — the page images of the letter you choose to scan | Sent to Anthropic (our AI provider) to read and explain it. Anthropic processes it in the US on our behalf. | Anthropic deletes inputs and outputs within about 30 days and does not train its models on it (commercial terms + data-processing agreement) |
| Transactional email — verification, password reset, deadline reminders, digests | Sent via our email provider | A log of which emails were sent (not their full content) until account deletion |
| Deadlines, procedure progress, benefit matches | Our EU database | Until you remove them or delete your account |
The exact providers we use are listed on our subprocessors page.
The transfer to the US, honestly
Reading a letter with a capable AI model is the one step where your data leaves the EU. Anthropic, our AI provider, processes the letter in the United States. This is covered by a data-processing agreement that includes the EU’s Standard Contractual Clauses, and Anthropic is self-certified under the EU–US Data Privacy Framework — the two safeguards EU law recognises for such transfers. Under those terms Anthropic processes the data only to return the explanation, does not train on it, and deletes it within about 30 days. You decide when to upload a letter, and you can delete any scan at any time.
How deletion works
Deleting a scan removes both its stored files and the explanation from our systems. Deleting your account erases everything — profile, letters, stored files, deadlines, progress, and email logs — including the files in our object storage, not just the database rows. What was already sent to Anthropic falls out of their systems on their retention schedule (about 30 days), as above. You can also download a full copy of your data first, from Settings → Your data.
What we don’t do
- No third-party analytics or advertising trackers.
- No selling or sharing of your data for marketing.
- Self-hosted fonts — no call out to a font CDN when you load a page.
- One strictly-necessary session cookie to keep you signed in — nothing else.
For the formal detail, see our privacy policy. This is information, not legal advice.