← Back to site

Privacy Policy

Last updated: 2026-05-31

This Privacy Policy explains how [COMPANY LEGAL NAME] (“Inkwell”, “we”, “us”), the data controller, collects and processes your personal data in accordance with the EU General Data Protection Regulation (GDPR).

1. Who we are

Controller: [COMPANY LEGAL NAME], [REGISTERED ADDRESS], [COUNTRY]. Contact / data-protection enquiries: privacy@inkwell-letters.com.

2. What data we collect

  • Account & contact: name, email, password (hashed), phone (optional).
  • Postal correspondence: postal address, the letters you and your teacher exchange.
  • Learning profile: target language, level, interests, age range, learning preferences you provide during onboarding.
  • Billing: subscription status and identifiers. Card details are handled solely by Stripe — we never see or store full card numbers.
  • Technical: a strictly-necessary session cookie and standard server logs (IP, timestamps) for security.

3. Why we process it, and our legal bases

  • To provide the service (deliver and exchange letters, assign a teacher) — performance of a contract (Art. 6(1)(b)).
  • Billing & fraud prevention — contract and legal obligation (Art. 6(1)(b),(c)).
  • Security & abuse prevention — legitimate interests (Art. 6(1)(f)).
  • Marketing emails — only with your explicit, opt-in consent (Art. 6(1)(a)); you can withdraw at any time.

4. Who we share it with (processors)

We use carefully selected processors under data-processing agreements:

  • Supabase — database, authentication and file storage.
  • Stripe — payment processing.
  • Vercel — application hosting.

We do not sell your personal data.

5. International transfers

Some processors may store or process data outside the European Economic Area. Where they do, transfers are protected by an adequacy decision or by Standard Contractual Clauses with appropriate supplementary measures, as required by Chapter V GDPR.

6. How long we keep it

We keep your account data for as long as your account is active. After you delete your account we anonymise or erase your personal data without undue delay (and within 30 days), except where we must retain limited records (e.g. invoices) to meet legal/accounting obligations.

7. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, port and object to the processing of your personal data, and to withdraw consent at any time. You can:

  • Access / export your data from your dashboard, or by emailing us.
  • Delete your account and data from your dashboard settings.
  • Contact us at privacy@inkwell-letters.com for any request.

You also have the right to lodge a complaint with your local supervisory authority (data protection authority).

8. Children

Inkwell is intended for users aged 16 and over. Where a younger user participates, we require verifiable consent from a holder of parental responsibility in line with Art. 8 GDPR.

9. Cookies

See our Cookie Policy for details of the cookies we use.

10. Changes

We will post any changes to this policy on this page and update the date above.

Bracketed placeholders such as [COMPANY LEGAL NAME] must be completed with your registered details before this page is relied upon as a legal notice.