Privacy policy

This English version is provided for convenience. In case of any difference, the French version prevails.

This page explains in plain terms what information we collect when you use Letters We Owe, why, how long we keep it, and what your rights are. Our principle is simple: we ask for as little as possible, and we never use what you entrust to us for anything other than helping you write your letter.

Who is responsible for your data

The controller of your data is C2SL, a SAS with share capital of €100, registered with the Grasse Trade and Companies Register (RCS) under number 892 281 510, 6 rue Soutrane, 06560 Valbonne, France, publisher of the service (see the Legal notice).

For any question about your data, write to: [email protected].

What we collect

When you use the service, we collect only:

• Your email address: so that we can send you the link to your letter once it is ready.
• Your first name, optional: you can give it if you wish, simply to make the exchange more human.
• The content of your interview: the answers you write during the conversation that helps your letter take shape.
• Your letter, once written.

We do not ask for a password, a date of birth or a phone number, and we do not create an account. Your letter is reachable through a secret link that only the people you share it with can open.

To protect the service against abuse, your device's network address is used for a few moments to limit the number of submissions per minute. It is not stored in our database.

Sometimes very personal information

A hard letter often touches on what is most intimate: an illness, a bereavement, a separation, a wound. What you write in the interview may therefore reveal information about your health or private life, and sometimes about those of someone close to you. The law treats such information as sensitive data, and so do we:

• we use it only to write your letter, and only with your explicit consent, which we ask for before your interview is sent;
• we advise you to refer to the people you mention only by their first name or by your relationship to them ("my father", "my friend"), never by their full name or contact details;
• the interview is deleted within the short period stated below.

When you write to us

The "Write to us" page lets you send us a message. We then collect what you enter there: the reason for your message, your name, your organisation if you give it, your email address and your message. It creates no account and no letter request.

Your message is filed in ORILA, our messaging tool, published by C2SL. Only members of our team read it, and they reply to the email address you gave.

Before it is sent, an anti-bot check by Cloudflare (Turnstile) verifies that the message comes from a person. It is usually invisible. To do this, Cloudflare examines technical information about your connection and your browser, including your device's network address. Cloudflare uses it on our behalf, and also, under its own rules, to improve its bot detection.

When you pay

If you choose to pay, you do so on a payment page hosted by Stripe, our payment provider. Your bank card details are entered at Stripe and stay there: they never go through our servers, and we never see them.

Once your payment is confirmed, Stripe sends us what is needed to issue your invoice: your name, your email address, your country and, if Stripe collected it, your postal address, together with the amount paid. We pass them on to ORILA, C2SL's invoicing software, which issues the invoice in C2SL's name.

As soon as the invoice is issued, these details are erased from the Letters We Owe database. We only keep a record of the payment there: its reference, its amount, its date and the invoice number. The invoice itself is kept by C2SL, as the law requires (see below).

Who writes your letter

At present, your letter is written by a member of our team, based on your interview, with the help of an artificial intelligence tool. This person reviews and adjusts every letter before handing it to you.

Why we collect it, and on what legal basis

Information	What it is used for	Legal basis
Email address	Sending you the link to your letter	Performance of the service you request
First name (optional)	Personalising the exchange, nothing else	Your consent
Interview content and letter	Bringing out and writing the letter you want to write	Performance of the service, and your explicit consent for the sensitive information they contain
Network address	Limiting abuse (number of submissions per minute)	Our legitimate interest in protecting the service
Message sent through "Write to us" (reason, name, organisation, email address, message)	Reading your message and replying to you	Our legitimate interest in replying to those who write to us
Technical information from the anti-bot check (network address, browser)	Preventing automated submissions	Our legitimate interest in protecting the service
Payment, if you make one (name, email address, country, postal address if collected by Stripe, amount)	Collecting your payment and issuing the invoice	Performance of the service, and the legal obligation to issue and keep the invoice

You can withdraw your consent at any time by writing to us. Withdrawal does not affect what was done beforehand, but we will no longer be able to write or keep your letter based on what you entrusted to us.

How long we keep your data

• Your interview answers are deleted no later than thirty days after your request is received. If your letter has not been written within that period, the entire request is deleted.
• Your letter, together with your email address and first name, is kept for two years after it is delivered, so that you can reread it through your link and find it again, and is then deleted. You can download it before then, and ask us to delete it at any time.
• Messages sent through "Write to us", and our replies, are kept for 3 years after our last exchange, and then deleted. You can ask us to delete them sooner.
• If you pay, your name, email address, country and postal address are erased from the Letters We Owe database as soon as the invoice is issued. The invoice, with the information it contains (name, email address, country, postal address if collected, amount, date), is kept by C2SL for ten years, as the law requires for accounting records (article L. 123-22 of the French Commercial Code).

We keep nothing "just in case". When data no longer has a reason to exist, we delete it.

What we never do

• We do not sell your data.
• We never use it to train an artificial intelligence, and we only use tools whose contract forbids their provider from doing so.
• We do not share it with anyone other than the providers strictly necessary to run the service and to process payments (listed below).
• We do not use your letter or your interview for advertising or commercial purposes, and we do not send you any newsletter.

The technical providers who help us

To run the service, we rely on a few specialist providers. They only have access to what they need, and solely to make the service possible, on our instructions.

Currently:

• Cloudflare (United States): hosts the site and carries the traffic. Also provides the anti-bot check on the "Write to us" page, and hosts ORILA, where the messages you send us there are filed.
• Neon (Databricks group, United States): hosts the database. The data is stored within the European Union (Frankfurt region, Germany). Messages sent through "Write to us" are stored in ORILA's database, also at Neon, on servers located in Europe.
• Anthropic (United States): provides the artificial intelligence tool that helps write your letter. We use it under a business contract that forbids it from training its models on what we send it.
• Google (United States): provides the site's fonts. When you open a page, your browser downloads them from Google's servers, which see your device's network address. None of your interview content is sent to Google.
• Amazon Web Services (United States, Paris region): delivers our replies to messages sent through "Write to us". It receives your email address and the content of our reply.
• Stripe (United States): collects payments, on its own payment page. Your bank card details are entered at Stripe and are never passed on to us. Stripe processes your payment data on our behalf, and also, on its own behalf, to prevent fraud and meet its legal obligations as a payment provider, under its own privacy policy.

The invoice is issued by ORILA, C2SL's invoicing software: it is not an outside provider, it is C2SL's own tool.

Planned soon (this page will be updated as soon as they go live):

• Brevo (France): to send emails, for example the link to your letter. Data hosted in Europe.

Data transferred outside the European Union

Cloudflare, Neon, Anthropic, Google, Amazon Web Services and Stripe are American companies. When your data is sent to them, the transfer is covered by one of the safeguards provided for by the General Data Protection Regulation (GDPR): the European Commission's adequacy decision for companies certified under the EU-US Data Privacy Framework (which is the case for Cloudflare, Databricks for Neon, Google and Stripe), or the standard contractual clauses adopted by the European Commission (which is the case for Anthropic and Amazon Web Services). You can ask us for a copy of these safeguards by writing to us.

Cookies

We place no advertising or audience measurement cookies. For the duration of your visit, and in your browser, the site only keeps what is strictly necessary for it to work (for example the letter excerpt you have just opened). On the "Write to us" page, Cloudflare's anti-bot check may also place a technical cookie, used only to tell a person from a bot. That is why we do not show you a consent banner.

Your rights

You have the following rights over your data at any time:

• Access: find out what information we hold about you.
• Rectification: correct inaccurate information.
• Erasure: have your data deleted. On simple request, without having to give a reason.
• Portability: receive your data in a reusable format.
• Objection: object to processing.
• Restriction: ask us to freeze processing while a complaint is examined.
• Withdrawal of consent, at any time.
• Instructions after your death: tell us what you would like us to do with your data after you die.

To exercise any of these rights, simply write to: [email protected]. We reply in writing, as soon as possible and within one month at the latest. To help us find your request, please write from the email address you gave us, or include the link to your letter.

Complaints

If you believe your rights are not being respected, you can refer the matter to the French data protection authority:

CNIL (the French data protection authority), Commission nationale de l'informatique et des libertés
https://www.cnil.fr

Changes to this page

This policy may change, in particular when the "planned" providers above go live. The last updated date at the top of the page tells you which version is in force. The terms of the service are set out in our Terms and conditions.