Privacy Policy

Lettrove is an email design and delivery platform, operated by CareersCV, a sole proprietorship registered in Finland (Business ID 3585151-8), which is the data controller for the data described here. This policy explains what we collect from you and the people in your organization, why we collect it, and how it is protected. It applies to lettrove.com and the Lettrove application.

• Account data — your name, email address and password (stored hashed, never in plain text), or your Google account identity if you sign in with Google.
• Organization data — organization names, member roles and invitations you create.
• Content — the email templates, images and campaigns you build and store with us.
• Integration credentials — API keys and OAuth tokens for services you choose to connect (your email provider, CRM, storage). These are encrypted at rest with AES-256-GCM and are never displayed back or shared.
• Recipient data — email addresses you send test or campaign emails to, and delivery events (sent, bounced) needed to show you what happened.
• Activity records — an audit log of privileged actions (invites, role changes, sends) that organization admins can review.

We use this data only to run the product: authenticate you, render and send your emails, sync with the services you connect, and show your team its own history. We do not sell personal data, and we do not use your content or your recipients’ data for advertising.

When you use AI features, the content you submit (your prompt, the template being edited, files you attach) is processed by our AI subprocessors to generate the result. It is not used to train their models under the agreements we operate on.

We rely on a short list of infrastructure providers, each bound by their own data protection terms:

• Amazon Web Services — asset storage and content delivery
• Resend — email delivery (when you have not connected your own provider)
• Anthropic and OpenAI — AI-assisted content generation
• Our database and hosting providers for the application itself

Your data stays for as long as your account is active. Deleting a connection deletes its stored credentials immediately. Deleting your account removes your personal data from live systems; residual copies in encrypted backups expire on a rolling schedule.

Encryption in transit and at rest, role-based access control enforced deny-by-default, hashed and expiring tokens, and an append-only audit trail. Read the details on our security page.

You can access, correct, export or delete your personal data at any time from your account settings, or by contacting us. If you are in a jurisdiction with specific data protection rights (GDPR, CCPA and similar), we honor requests made under them.

If this policy changes materially, we will notify account owners by email before the change takes effect.