Skip to content

LetterForge is coming soon for Mac and Windows. Notify me

Privacy Policy

This policy is also available in German: Datenschutzerklärung.

Last updated: 16 October 2026 · Version 3

LetterForge has two parts: the website letter-forge.com with your customer account, and the desktop app for Mac and Windows. The app works on your computer. Your mailbox, your candidates and your notes stay there. Our server only gets what a single AI draft needs, and it does not store that content.

1. Controller

Jannis Bolecke, Berlin Bird Studios, Zehlendorfer Damm 173, 14532 Kleinmachnow, Germany, email: info@berlin-bird.com. More details are in the legal notice.

We have not appointed a data protection officer, as we are not required to. Please send questions about data protection to info@berlin-bird.com.

2. Website letter-forge.com

2.1 Server, server logs and error logs

The website, the customer account and the app's interface run on a server that we rent from GoDaddy and manage ourselves (network operator: Host Europe GmbH, Cologne). The server is in a data centre in the EU. GoDaddy processes the data on the server on our behalf (Art. 28 GDPR).

When you visit the website, the server processes data it technically needs: IP address, date and time, the address requested, the amount of data transferred, the page you came from, and your browser and operating system. Without this data the page cannot be delivered and the server cannot be run securely (Art. 6(1)(f) GDPR). The server writes this data to log files and replaces them with new ones at regular intervals, deleting older files automatically. We only keep the server logs for as long as we need them to run the server and keep it secure.

From the server logs, a program called AWStats creates statistics on our server, for example how often each page was opened and which errors occurred. AWStats sets no cookies and needs no code on the website; it only reads the log files that are written anyway. The data does not leave the server for this. We use the statistics to run the server and to see how the website is used. The legal basis is our legitimate interest in this (Art. 6(1)(f) GDPR). We may later import the log data into our Matomo (see 2.3); Matomo also runs on our server and shortens IP addresses.

The application's error log contains nothing of what you send us. We write a new file every day and delete it after 14 days. We also record program errors as kinds of error, without reference to a person and without an IP address. We delete a kind of error 90 days after it last occurred.

2.2 Cookies and local storage

We only set cookies that are technically needed: a session cookie and a cookie that protects forms against forgery (XSRF-TOKEN), both for the length of the session, and letterforge_locale for the language you chose (2 years). In your browser's local storage we only keep whether you chose the light or dark view and closed the "coming soon" notice. Legal basis: § 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR. On the page where you take out a subscription, Stripe loads its payment form (js.stripe.com) and sets its own cookies to prevent fraud (see 4).

2.3 Audience measurement with Matomo

We measure how the website is used with Matomo, which we run ourselves (analytics.berlin-bird.com) on the same server as the website (see 2.1). Matomo sets no cookies, uses no local storage in your browser and respects your browser's "Do Not Track" setting. It records the page you open, the time, the page you came from, browser, operating system, screen size, language and your IP address. We run Matomo in its enhanced privacy mode: it shortens the IP address before storing it, so it can no longer be linked to you. We delete the individual visits after 6 months. After that only totals remain, for example visits per page and month. Matomo also counts single events: teaser video started and watched to 75 %, pricing page viewed, waiting list sign-up, click on a download. Each comes only with the language, the form's page or the platform, never with your address. That an account was created or an address on the waiting list was confirmed, our server reports to Matomo itself, without your address, IP address or browser details. We do not pass the data on. The legal basis is our legitimate interest in improving the website (Art. 6(1)(f) GDPR). You can object at any time by email to info@berlin-bird.com.

2.4 Contact form

When you write to us through the contact form, we store your first name, last name, email address and message, and we get a notification by email. Against spam, the form contains a field people cannot see, and we limit the number of messages per internet connection. For this we keep your IP address for at most one hour in a temporary cache, and only as a hash formed with a secret key. Legal basis: Art. 6(1)(b) GDPR if your enquiry concerns a contract, otherwise (f) (answering your enquiry, protecting the form). We delete your message 6 months after we have dealt with it.

2.5 Customer account

For a customer account we store your name, email address, password (as a hash only), language, and two-factor sign-in if you switch it on. Before you can use the account, you confirm your address with a link that works for 60 minutes. Only then do we send the welcome email, and only then can you sign in to the app. Registration has the same spam protection as the contact form. While you are signed in in your browser, we store your IP address, your browser's identifier and the time of your last activity with your session. After 120 minutes without activity the session expires and is deleted afterwards. In your account you see your subscription, your invoices and the signed-in computers, and you can delete the account there. Legal basis: Art. 6(1)(b) GDPR.

If you delete your account, we end a running subscription at once. We delete the account, teams, signed-in computers, anomaly records, the quality metric and the sent reports (see 3.2). We keep the records of the AI service's use without reference to you for our cost analysis until their period runs out (see 7). We keep invoices for as long as the law requires (see 4).

2.6 Teams

With the Team plan you can invite up to 10 people. We store the invited address until the invitation is accepted or withdrawn, and after that the team membership. The plan's replies are counted for the whole team together. Legal basis: for you Art. 6(1)(b) GDPR, for the invited person (f) (delivering the invitation).

2.7 Launch notification (waiting list)

Purpose: On letter-forge.com you can leave your email address. We then tell you once when LetterForge comes out and write to you about important news around the launch. You get no other emails at this address. We only pass it on to our hosting provider, who runs the server for us as a processor (see 2.1).

Legal basis: your consent, Art. 6(1)(a) GDPR. You give it by ticking the box in the form and confirming the link in our email.

Double opt-in and proof: After you sign up we send you an email with a confirmation link that works for 7 days. Only once you have confirmed is the address on the list. As proof of your consent we store your email address, the language of the page, when you signed up and when you confirmed, the version of the consent text (it also names the version of this privacy policy), and when we sent you the launch email. If you choose your mail program in the form, which is optional, we store that too, to learn which mail programs LetterForge should support at the launch. We do not store your IP address. To prevent misuse of the form we only use it when the form is sent, to limit the number of sign-ups per connection: as a hash with a secret key, for at most one hour in a temporary cache (Art. 6(1)(f) GDPR, our legitimate interest in protecting the form). We do not measure whether you open our emails or click their links.

Storage period: Sign-ups that are not confirmed are deleted automatically after 30 days. We delete confirmed addresses 3 months after the launch, meaning the day from which LetterForge can be downloaded. If you withdraw your consent before that, we delete the address at once.

Withdrawal: You can withdraw your consent at any time with effect for the future: with the unsubscribe link in every email from us (one click deletes your address), or by email to info@berlin-bird.com.

2.8 Emails from us

We send confirmation, welcome, subscription and invitation emails and the waiting list emails through our own mail server on the server described in 2.1. We do not measure whether you open our emails or click their links.

2.9 Booking links

If you use booking links in the app, we keep your free time slots, your time zone, the name candidates see on the booking page and a title per link (for example the position) on our server. When someone books a slot, we only store its start and end, not the candidate's name or address. The app fetches booked slots. We delete fetched bookings 30 days after the appointment. If you delete the candidate in the app, we delete the link and every booking made through it. Legal basis: Art. 6(1)(b) GDPR.

2.10 Backups

So that nothing is lost after a fault, files and databases on the server are backed up regularly, daily or hourly depending on the area. The backups stay with our hosting provider in the EU (see 2.1). Once their retention period has passed, they are overwritten automatically. Something we delete can therefore remain in a backup for a while, until that backup is overwritten.

3. Desktop app

3.1 What stays on your computer

The app reads the thread with your candidates directly from your mail program on your computer (Apple Mail, classic Outlook, Thunderbird). It never asks for your mail password and does not upload your mailbox. Candidates, vacancies, clients, notes, CVs, drafts, sent emails and call notes are kept in a database on your computer. The credentials for your LetterForge account are stored encrypted in the Keychain (macOS) or in Windows Credential Manager (DPAPI). We do not see this data. You or your agency are responsible for the candidate data on your computer.

The app only sends error reports if you allow it on this computer (Settings → Security). A report contains only the kind of error, the place in the program, the versions of the app and the operating system, and the time. It never contains candidates, emails, notes, letters, names, addresses or your account. We store it without reference to you and without an IP address, and delete a kind of error once it has not occurred for 90 days. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw in the settings. Under "Copy error report" you will also find a text you can send us yourself if needed.

3.2 What goes to our server

  • Signing in the app: You sign the app in with your customer account in the browser (OAuth 2.0 with PKCE). For each computer we store the name the computer reports (e.g. "Anna's MacBook"), the system (macOS or Windows), when it was last active, and secured identifiers of the access tokens. When you sign a computer out, its access tokens stop working at once; we delete the entry 30 days later.
  • Licence check: About once an hour the app asks which plan applies and sends its version number.
  • Drafts (AI proxy): The app only sends data when a draft is written: because you ask for it, because you open a candidate with a new reply on Solo or Team (Smart Reply then starts by itself), or because you switched on preparing follow-up drafts. Then it sends, encrypted, what this one candidate's draft needs: the candidate's name, your sender name, language, salutation and tone, the vacancy (company, position, location, type, work mode, salary, description, requirements), the client, and up to seven messages from the thread with this candidate. Before sending, the app removes on your computer quoted earlier emails, signatures, phone numbers, postal addresses, bank details, profile links, other people's email addresses and the candidate's name from the email texts and puts placeholders in their place. From notes it removes phone numbers, addresses and email addresses. The AI service gets the name only as a separate field for the greeting. The rules recognise common German and English formats. We cannot guarantee that they find every personal detail in free-form text. If you allowed sharing candidate data in the settings, the request also contains: an extract of the CV without contact details and date of birth, the LinkedIn address, notes you released for letters, availability, salary expectation, the client's feedback and call notes. Our server builds the request to the AI service from this (see 5) and returns the answer. It stores neither your data nor the answer. It only records who used which model when and for what, the number of tokens, cost, duration, result, and whether the request counted as a reply. If a request stands out (for example too many requests in a short time), we store the kind of anomaly, without content. We delete the usage records after 13 months and the anomalies after 90 days.
  • Quality metric: When the app detects that an AI draft was sent, it compares the draft with the sent email on your computer. It sends us only a number from 0 to 100 with the purpose, model and kind of letter, never text, names or addresses. Legal basis: Art. 6(1)(f) GDPR (improving the drafts). You can switch this off under Settings → Candidate Data & AI. We delete the metric after 13 months.
  • Sent report: When the app detects that a letter from LetterForge was sent, or you mark it as sent, it tells us only the time, the kind of letter (for example reply or invitation), whether it started from an AI draft and for what, and whether it was found in the Sent folder or marked by you. It never contains the text, subject, candidate or recipient. This shows us whether and how quickly LetterForge helps in everyday work. Legal basis: Art. 6(1)(f) GDPR. You can switch it off for each computer under Settings → Security. We delete the reports after 13 months, and at once when the account is deleted.
  • "Learn my writing style" (if you switch it on): Once a day up to 50 of your sent emails, each cut to 600 characters, go to the AI service, which turns them into a short style profile. The profile is stored only on your computer.
  • Updates: The app downloads updates and installers through letter-forge.com from our storage at Hetzner Online GmbH (Gunzenhausen) in its Falkenstein data centre in Germany. We and Hetzner process your IP address to deliver the files. We keep no access log for this storage.

The legal basis for your account data is Art. 6(1)(b) GDPR (contract). We process the candidate data in a draft request as your agency's processor under Art. 28 GDPR. We send you a data processing agreement on request to info@berlin-bird.com. Limiting requests and recording anomalies serve security (Art. 6(1)(f) GDPR).

4. Payments with Stripe

We handle subscriptions and invoices through Stripe; our contract partner is Stripe Payments Europe, Ltd., Dublin, Ireland. Stripe receives your name, email address, language and the payment details you enter directly at Stripe. We only store your Stripe customer number, the card type, the last four digits and the status of your subscription. Stripe may transfer data to the USA. For this Stripe is certified under the EU-US Data Privacy Framework and also uses the European Commission's standard contractual clauses. Legal basis: Art. 6(1)(b) GDPR (contract), (c) (statutory retention of invoices, 10 years under § 147 AO and § 257 HGB) and (f) (fraud prevention).

5. AI service

The drafts are written by a language model from OpenAI through its programming interface (API). Our contract partner is OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland. OpenAI processes the requests on our behalf; we have concluded a data processing agreement (Data Processing Addendum) with OpenAI for this. OpenAI Ireland may pass the requests to affiliates and sub-processors outside the EU, above all to OpenAI OpCo, LLC in the USA. This is based on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

Section 3.2 lists what OpenAI receives. OpenAI does not use requests made through the API to train its models. For the interface we use, OpenAI keeps no conversation history for later use. To detect abuse, however, OpenAI keeps requests and answers for up to 30 days, longer only if the law requires it or it is needed to prevent harm. After that they are deleted.

We ourselves do not rate, rank or filter candidates, and we do not train AI models with your data.

6. Recipients and transfers outside the EU

Only these service providers receive data, each on our behalf or for the purpose named:

  • GoDaddy (Host Europe GmbH) as hosting provider: server, sending emails, Matomo and backups, data centre in the EU (see 2.1 and 2.10)
  • Hetzner Online GmbH: storage for installers and updates in Germany (see 3.2)
  • OpenAI Ireland Ltd.: AI service (see 5)
  • Stripe Payments Europe, Ltd.: payments (see 4)

Data can only reach countries outside the EU in these ways:

  • OpenAI: to affiliates in the USA, based on standard contractual clauses (see 5)
  • Stripe: to Stripe in the USA, based on the EU-US Data Privacy Framework and standard contractual clauses (see 4)
  • GoDaddy: The data stays in the data centre in the EU. Where companies of the GoDaddy group in the USA access it for operations and support, they are certified under the EU-US Data Privacy Framework; the standard contractual clauses in GoDaddy's data processing agreement apply as well.

7. Retention at a glance

Data Period
Customer account until you delete it
Browser session (IP address, browser identifier) until it expires (120 minutes without activity)
Confirmation links 60 minutes (account), 7 days (waiting list)
Waiting list, not confirmed 30 days
Waiting list, confirmed 3 months after the launch
Contact messages 6 months after we dealt with them
AI usage records 13 months; without reference to you after an account deletion
AI service anomalies 90 days; at once when the account is deleted
Quality metric 13 months; at once when the account is deleted
Sent reports of the app 13 months; at once when the account is deleted
Signed-out computers 30 days after signing out
Booked slots 30 days after the appointment
Server logs as long as needed to run the server and keep it secure; the server deletes old log files automatically
Application error log 14 days
Kinds of error and app error reports 90 days after they last occurred
Matomo, individual visits 6 months
Backups until they are overwritten automatically once their retention period has passed
At OpenAI (abuse detection) up to 30 days
Invoices 10 years
IP hash for spam protection at most 1 hour

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on our legitimate interests (Art. 21). You can withdraw a consent at any time with effect for the future (Art. 7(3)). You can also lodge a complaint with a data protection supervisory authority, for example the one responsible for us, the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg.

You manage and delete the data on your computer (candidates, emails, notes) yourself in the app. You can export and delete individual candidates there.

9. Changes

We update this policy when LetterForge or the law changes. The current version is always on this page, with its date and version number at the top.