What leaves our servers
Last updated: 13 June 2026
We’d rather be plain than reassuring. This page maps exactly what happens to your data — what we store, what is sent on to process a letter, how long things are kept, and how deletion works. We will not claim that “everything stays in the EU”, because one step — reading your letter with an AI model — involves a transfer outside it, under EU-approved safeguards. The honest version is below.
Where your data lives and goes
| Data | Where it is | How long |
|---|---|---|
| Account & profile — email, password (stored only as a hash), your onboarding answers | Our database, hosted in the EU | Until you delete your account |
| Scanned letters — the images/PDFs you upload and the explanation we generate | Our EU storage + database | Until you delete the scan or your account — or sooner if you set auto-delete in Settings |
| Letter content sent for interpretation — the page images of the letter you choose to scan | Sent to Anthropic (our AI provider) to read and explain it. Anthropic processes it in the US on our behalf. | Anthropic deletes inputs and outputs within about 30 days and does not train its models on it (commercial terms + data-processing agreement) |
| Transactional email — verification, password reset, deadline reminders, digests | Sent via our email provider | A log of which emails were sent (not their full content) until account deletion |
| Deadlines, procedure progress, benefit matches | Our EU database | Until you remove them or delete your account |
The exact providers we use are listed on our subprocessors page.
What you black out never reaches us at all
Before a scan starts, you can black out anything in the letter — your address, a case number, your employer, a licence plate, someone else’s details. This happens on your own device, in your browser: the areas you cover are erased from the image itself, and only that blacked-out version is uploaded. The original file never leaves your device.
So the parts you hide are not stored by us, not in our backups, not in your data export, and never sent to Anthropic. There is nothing for us to delete, because we never receive it. Two things worth being straight about: it only removes what you cover — anything you leave uncovered is still sent — and we deliberately do not try to detect sensitive details for you, because finding them would mean reading the letter first, which is exactly what you’d be trying to avoid. The choice is yours alone.
The transfer to the US, honestly
Reading a letter with a capable AI model is the one step where your data leaves the EU. Anthropic, our AI provider, processes the letter in the United States. This is covered by a data-processing agreement that includes the EU’s Standard Contractual Clauses (SCCs) — the safeguard EU law recognises for such transfers. Under those terms Anthropic processes the data only to return the explanation, does not train on it, and deletes it within about 30 days. You decide when to upload a letter, and you can delete any scan at any time.
How deletion works
Deleting a scan removes both its stored files and the explanation from our systems. Deleting your account erases everything — profile, letters, stored files, deadlines, progress, and email logs — including the files in our object storage, not just the database rows. What was already sent to Anthropic falls out of their systems on their retention schedule (about 30 days), as above. You can also download a full copy of your data first, from Settings → Your data.
What we don’t do
- No third-party analytics or advertising trackers.
- No selling or sharing of your data for marketing.
- Self-hosted fonts — no call out to a font CDN when you load a page.
- Only two strictly-necessary cookies — one to keep you signed in, and one that remembers the language you choose — and no advertising, tracking, or analytics cookies.
For the formal detail, see our privacy policy. This is information, not legal advice.