DutchLetter
NL Scan a letter

Privacy statement

Last updated: 15 October 2026

Official letters contain personal data. This statement explains what DutchLetter does with that data and for how long it is kept. The controller is [TRADE NAME], KvK [KVK NUMBER], [STREET AND NUMBER] · [POSTCODE] [CITY] · Netherlands, support@dutchletter.nl.

What is processed

  • The letter. The photo or PDF is used to produce the quick scan and the report. Before analysis the citizen service number (BSN) is detected and blacked out on the image and removed from the text. For traffic fines the name and address and vehicle registration are hidden as well. The original image is deleted immediately after this step. Only the redacted text is kept.
  • Special categories of data. Letters may contain data about health or benefits or criminal matters. This data is processed only with the explicit consent given at upload (article 9(2)(a) GDPR) and only to explain the letter.
  • Email address. Only when the user enters it. It is used to send the report link and the invoice and at most one deadline reminder.
  • Payment data. Payments are processed by Mollie B.V. as an independent controller. DutchLetter receives only the payment status and a payment reference.
  • Technical data. The server keeps standard access logs. A cookie-free page view counter records the page path and the referring site and a daily changing hash of the IP address. No advertising pixels and no tracking cookies are used.

Why and on which basis

The processing is necessary to perform the service requested by the user (article 6(1)(b) GDPR). The processing of special categories of data is based on explicit consent. Access logs are kept on the basis of a legitimate interest in security.

Who receives data

  • Anthropic (USA) provides the AI model that reads the redacted text and produces the explanation. A data processing agreement with EU standard contractual clauses applies. Anthropic does not use the data to train models.
  • Mollie B.V. (Netherlands) processes payments.
  • Resend sends emails. A data processing agreement with EU standard contractual clauses applies.
  • The servers are located in the European Union.

How long data is kept

  • Original images: deleted immediately after redaction.
  • Redacted text and reports: deleted 30 days after creation. The user can delete them earlier with the "delete my data" button on the report page.
  • Email address and reminder: deleted together with the report.
  • Invoices and payment references: kept for 7 years as required by Dutch tax law. They do not contain the letter.
  • Backups: kept for 14 days. Full erasure therefore takes at most 44 days.

Rights

Users can ask for access to their data and for correction or deletion. Requests go to support@dutchletter.nl. Complaints can also be filed with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Cookies

The website uses no cookies. The app uses one functional cookie that is needed to show a report to the person who uploaded it. No consent banner is required for this cookie.