Privacy policy

1. Controller

Viascom GmbH
Weissbadstrasse 8b
9050 Appenzell, Switzerland
UID: CHE-269.801.554
Email: [email protected]

Viascom GmbH operates letr.dev and contracts with every customer. It is the controller for the processing described here, under the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

2. What this site doesn't do

letr.dev sets no cookies, runs no analytics or tracking, and loads no third-party fonts or scripts. One entry can sit in your browser's local storage, and it is not sent to us: scalar-reference-selected-client-v2 holds the code-sample language of the API reference once you pick one. Clearing the site data removes it. You can block local storage for letr.dev in your browser settings; your choice then lasts only for the current page, and the API reference shows a link to the API description instead. All assets are served from our own infrastructure, so there's nothing to consent to and no consent banner.

3. Server logs

When you visit the site, our web server and Cloudflare (see below) process technical access data: IP address, date and time, requested page, referrer and browser type. We use this data to deliver the site, keep it secure and diagnose faults. The legal basis is our legitimate interest in operating the site securely (Art. 6(1)(f) GDPR). Log data isn't merged with other data and is deleted or anonymised within 30 days at the latest.

4. Hosting and service providers

The site, the API and the mail servers are hosted by Hetzner Online GmbH in Germany, and Contabo GmbH stores the encrypted backups of the database in the EU. Data deleted from the database stays in these encrypted backups for up to 52 weeks. The delivery logs of the mail server name the recipients of every email sent through letr.dev, also of the emails letr.dev sends for customers, which the data processing agreement covers; they are deleted after 14 days and stay up to 7 more days in its backups. Cloudflare, Inc. (USA) provides DNS, content delivery and protection against attacks for the site and the API, and processes technical connection data for that purpose. Stripe, a separate controller, and Sold through Link, LLC, the merchant of record, handle payment (see section 5), WorkOS, Inc. (USA) handles sign-in to the dashboard, and Datadog, Inc. (USA) monitors the servers and receives the error log of the web server, with client IP addresses and the requested URLs, in which email addresses can appear, and the operational log of the mail server, with email addresses masked. Google Cloud EMEA Limited (Ireland) hosts our mailboxes through Google Workspace, including the one that receives the support requests from the dashboard, and processes them in Google data centres worldwide.

Hetzner and Contabo process the data in the EU. Transfers to the USA are safeguarded by the EU-US and Swiss-US Data Privacy Frameworks for Cloudflare, Datadog and Google and by standard contractual clauses for WorkOS; transfers by Google to other countries rely on the standard contractual clauses in the Google Cloud Data Processing Addendum. The list of sub-processors names each provider with its purpose, location, the data it processes and the transfer basis.

5. Signup form and payment

If you sign up, we process what you enter in the form: email address, company name or, for a private person, your name, the website or repository, and what you plan to send and to whom. We use them to create your account, review your sign-up after it is live and contact you about it. Payment runs through Stripe Checkout with Stripe Managed Payments. Sold through Link, LLC is the merchant of record, and Stripe is a separate controller of your payment and order data under its own privacy notice. We pass your form details, including the website and what you plan to send, to Stripe as checkout metadata, and Stripe may process them outside Switzerland and the EU as its notice describes. We receive the payment status and what Stripe passes on: contact details, billing address, tax ID, order details and payment information, never the full card number. A deletion request at Link does not reach our records, and one to us does not reach theirs. The legal basis is the performance of the contract and the steps prior to it (Art. 6(1)(b) GDPR). Account data is deleted 30 days after the contract ends. Statutory retention duties apply to billing records: up to 10 years (Art. 958f Swiss Code of Obligations). During checkout, we keep a keyed hash of your network address to limit how many places in the founding offer one network can hold (legitimate interest, Art. 6(1)(f) GDPR); we delete it once the checkout has ended, at the latest after 5 days.

6. Abuse handling

To handle abuse and protect deliverability, we record in an account's history the actions our operators take on it, automatic pauses and notes about abuse reports. On suspicion of abuse an operator may open the content of individual emails of an account; each access requires a reason, is recorded in the account's history and shown to the account on the email. The legal basis is our legitimate interest in preventing abuse of the service (Art. 6(1)(f) GDPR). The history is kept for the duration of the contract and deleted 30 days after the account ends.

For an abuse or account takeover case, an operator may export the metadata of the account's emails of its message history, 30 days or 365 with the history add-on (sender, recipients, subjects, tags, status and delivery events) on the same basis. The file is kept only until the case is closed.

7. Emails sent through letr.dev

Emails that customers send through the letr.dev API, and the delivery events about them, are processed on behalf of the sending customer, who is the controller for that data, except for the abuse handling in section 6. The data processing agreement, which is part of the terms of service, governs that processing.

8. Contact by email

If you email us, we process your email address, your name and the content of your message to handle the enquiry and any follow-up. Support requests sent from the dashboard reach us by email; letr.dev also keeps a copy in its database and deletes that copy after 90 days. The legal basis is taking steps prior to entering into a contract and our legitimate interest in answering you (Art. 6(1)(b) and (f) GDPR). Correspondence is kept as long as the enquiry requires; where it becomes part of a business relationship, statutory retention duties apply: up to 10 years (Art. 958f Swiss Code of Obligations).

9. Contacting businesses from public sources

Viascom GmbH contacts businesses to ask whether letr.dev fits them (founder-led outreach). We take the business name, its role mailbox and, where published, the name and position of a contact person from the business's public website, its imprint and its public DNS records, and we keep them together with our email exchange and notes from calls. The legal basis is our legitimate interest in offering letr.dev to businesses (Art. 6(1)(f) GDPR). The data is kept in Linear, operated by Linear Orbit, Inc. (USA), and in Attio, our CRM, operated by Attio Limited (United Kingdom) on Google Cloud; both transfers rely on the standard contractual clauses in the provider's data processing agreement. We delete the contact details 12 months after the conversation has ended, or at once if you ask, and keep only the business name and domain on a do-not-contact list so that a no is honoured. To object, reply briefly to our email or write to [email protected].

10. Your rights

Regarding your personal data, you have the right to:

• request access to the data we hold about you,
• have inaccurate data corrected,
• have data deleted where no retention duty applies,
• restrict processing,
• object to processing based on legitimate interest,
• receive your data in a common, machine-readable format.

To exercise any of these rights, email [email protected]. We respond within 30 days.

11. Supervisory authorities

Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, 3003 Bern, Switzerland
www.edoeb.admin.ch

If the GDPR applies to you, you may also complain to the data protection authority of your place of residence.

12. Changes

We update this policy when the site or the law changes; the date above reflects the current version.