Privacy notice
Last updated: 8 July 2026
Data controller
FirstLetter Ltd. Contact: privacy@firstletter.cc
What we collect
- Buyers: email address, optional phone number, payment details (processed by Stripe)
- Homeowners: email address (only if you create an account after receiving a letter)
- Address information you provide, along with location data derived from geocoding
Lawful basis
We rely on legitimate interests (Article 6(1)(f) GDPR) to deliver a single personal letter on your behalf. We've balanced this against the recipient's right to privacy by never revealing the buyer's identity in the letter and by offering a permanent one-click opt-out.
Retention
Bid records: 24 months. Suppression list: indefinite (this is what makes the opt-out permanent). Payment records: 7 years (tax compliance).
Third-party processors
Stripe (payments), PostGrid (letter fulfilment), Google (Maps and Places API), Supabase (hosting and database).
Your rights
Access, rectification, erasure, restriction, portability, objection. You can lodge a complaint with the Data Protection Commission (Ireland) or the ICO (UK).
Requests
Email privacy@firstletter.cc. We respond within 2 business days.