Skip to main content
Legal

Privacy Policy

Last updated: March 2026. This policy explains how we collect, use, and protect your personal data in compliance with UK GDPR and the Data Protection Act 2018.

Who we are

Letters from Emma is operated from the United Kingdom. We are the data controller for personal data collected through this website and our subscription service. If you have any questions about this policy, please contact us at [email protected].

What personal data we collect

We collect only the data necessary to operate our service:

  • Email address — when you join the waitlist or subscribe.
  • Name and delivery address — when you subscribe, to send your letters.
  • Payment details — processed securely by Stripe. We never store card numbers.
  • Usage data — anonymised analytics about how you interact with our website (see Analytics below).

How we use your data

We use your personal data to:

  • Manage your waitlist place and notify you when subscriptions open.
  • Dispatch your letters and process payments.
  • Send you service-related emails (dispatch notifications, subscription confirmations).
  • Respond to your enquiries.
  • Improve our website through aggregated, anonymised analytics.

We will not sell, rent, or share your personal data with third parties for their own marketing purposes.

Legal basis for processing

We process your data under the following legal bases:

  • Contract — processing your name and address to fulfil your subscription.
  • Legitimate interests — sending service emails and improving our website.
  • Consent — sending marketing or waitlist emails, and placing analytics cookies. You may withdraw consent at any time.

Email marketing

We use Kit (formerly ConvertKit), based in the United States, to manage our email list. Kit is certified under the EU-US Data Privacy Framework and provides adequate data protection. Every marketing email includes an unsubscribe link. You may also withdraw consent by emailing us directly.

Analytics

We use PostHog (EU Cloud, hosted in Frankfurt) to collect anonymised analytics about website usage. PostHog does not use third-party advertising trackers. Analytics cookies are only placed with your consent via our cookie banner. You may decline analytics cookies without affecting your experience on this site.

Payment processing

Payments are handled by Stripe, which is compliant with PCI DSS. Stripe may process your payment data in the United States or European Union. We do not store payment card details on our own systems.

How long we keep your data

  • Waitlist email addresses: until you unsubscribe or request deletion, or up to 24 months of inactivity.
  • Subscriber data (name, address, order history): for the duration of your subscription plus 6 years, as required for accounting and legal compliance.
  • Analytics data: aggregated and anonymised; no individual retention limit.

Your rights under UK GDPR

You have the following rights regarding your personal data:

Access
Request a copy of the personal data we hold about you.
Rectification
Ask us to correct inaccurate or incomplete data.
Erasure
Request deletion of your data where there is no lawful reason to retain it.
Restriction
Ask us to limit how we use your data in certain circumstances.
Portability
Receive your data in a structured, machine-readable format.
Objection
Object to processing based on legitimate interests or for direct marketing.

To exercise any of these rights, please contact us. We will respond within one calendar month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Cookies

We use a single category of cookies — analytics cookies (PostHog) — which are only set with your consent. No advertising or tracking cookies are used. You may withdraw consent at any time by clearing your browser cookies and declining via the cookie banner on your next visit.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email to active subscribers. The date at the top of this page always reflects the most recent version.