Your words stay yours.

• Addresses: the recipient’s mailing address, and your address book. Every order adds (or updates) the person you sent to. If you check out as a guest, we keep that address book under your email, private to you, and move it into your account only once you make one and confirm that email (or use your order’s private link). People you add only for reminders don’t need an address.
• Groups: the groups you put people in (family, friend, colleague, client, neighbor or groups you name), which two people you linked as one household, and which address book suggestions you said no to. They’re only used to filter your address book, send to a group, and filter your reminders and calendar feed. Your address book, its groups and its CSV export are yours alone: nothing is shared with another account, and the export only ever contains your own entries.
• Dates: birthdays, anniversaries and the other dates you save (household birthdays, a due date, graduation, a remembrance date and so on), the holidays a person celebrates and their roles (like “teacher”), so we can remind you, show them on your calendar, suggest a card and send auto-letters. We never contact the people in your address book.
• Founding price (no longer offered): for orders that got the first-card founding price before it was retired, we keep the email, account, mailing address and a fingerprint of the card used (from our payment processor, never the card number) for that order. New orders don’t collect this.
• Calendar link: if you add your people’s days to your phone’s calendar, we keep a private, random link for it. It shows names and dates only (never addresses or emails). You can get a new link or turn it off anytime in Settings.
• Letter text: what you tell the writer and the letter itself, so it can be written, and so future letters to the same person don’t repeat themselves.
• Your email and name, for receipts, previews and your account.
• How you found us (for example, a link you clicked or the QR code on a card), so we know what’s working.
• Suggestions we make from your own address book and past letters (like an upcoming birthday), and whether you snoozed or dismissed them.
• Handled credit: your balance, each purchase and use, and gift codes with the name, email and message you entered for the person receiving them.
• Referrals (“Send one back”, “Share Handled”): your invite code with your email and first name (only your first name is ever shown to the people you invite), how many times it was opened, and for each friend’s first order their email, account and a fingerprint of the paying card from Stripe (not the card number), so each friend gets the first-card credit only once.
• Messages you send us, by email to any of our addresses, through the contact form or the “Questions?” link: your email, name, message and any attachments (and, for the link, which step of the site you were on, never card details). They’re kept in our inbox, matched to your account and orders when the email or an order number matches, so we can reply (deleting your account deletes them too). An AI service reads each message to sort it and draft a reply with your order’s status; a person approves every reply unless it’s a simple question we’ve chosen to answer automatically, and refunds are never promised automatically.
• Where your order was placed from: we record the approximate city your order was placed from (city, state, country and a location rounded to about a kilometre, from our hosting provider). We don’t store IP addresses. When our hosting provider can’t tell, we use the ZIP or postal code and city of your billing address from our payment processor instead (its approximate centre, never the street). For the person you send to, we also keep the approximate location of their ZIP or postal code (not the street). We only use these, added up, to see which places our cards go to and come from; they’re removed with your account.

When you import a contacts file (vCard or CSV), it’s read in your browser. Only the people you tick are sent to us and saved in your address book (name, mailing address, birthday, anniversary, relationship and notes). The file itself is never uploaded.

If you connect Google Contacts, we ask Google for read-only access to your contacts’ names, addresses, birthdays, anniversaries, relationships and notes, only to show you a list to add to your address book and, if you turn it on, to keep the birthdays and addresses of people you already added up to date. We keep an encrypted access token, never change anything in your Google account, and never use the data for anything else. You can disconnect anytime in your address book; that deletes the token and tells Google to revoke it. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: it’s never sold, never used for advertising, and never read by people except to fix a problem you ask us about.

If you paste a gift list or add screenshots or a PDF of it, they’re sent to our AI service only to read the names, addresses and gifts into the list you check. The pasted text, screenshots and PDF pages are not stored by us; only the guests you keep after checking are saved, when you start writing.

When you use Import birthdays (a calendar file, spreadsheet or contacts file, such as one made by a free Facebook birthday exporter), the file is read in your browser and never uploaded. We keep only each person’s name and birthday (and birth year if the file has one), in a group of your own. We never connect to or read your Facebook.

They’re used only for you: your phone calendar link, the “birthdays coming up” list in your account and, only if you turn it on for a group, your reminder emails. We never contact these people, never share their names or birthdays with anyone (including our handwriting fulfillment partner, unless you send one of them a card), and never use them for marketing to them or anyone else. Deleting a group, a person or your account deletes them for good, straight away.

An address request link lets a friend add their own name, mailing address and, if they want, birthday, anniversary and how they know you. They confirm they’re sharing it with you. It goes into your address book only; their email is never asked for unless they choose to get Handled reminders themselves, and it’s never shared with you or anyone else.

People who add a line to a group card share their name and message with the organizer and with everyone who has the card’s link (it’s one card). If they ask to hear when it’s mailed, we keep their email for that one message and then delete it.

The QR code on the back of a card lets the person who received it send the sender a short thank-you note. We deliver it to the sender and show it in their account. The recipient only ever sees the sender’s first name, never their email or address.

When a card is mailed we make a keepsake picture of it (the cover and your letter, without the address) for your email and order page. It sits at a private, unguessable link and is deleted along with your account.

The message writer (and its generator pages) keeps a simple count of each use: the occasion, who it’s for and the tone. The details you type about a person are sent to our AI service to write the messages and never stored. When you type no details, the three messages written for that occasion, recipient and tone may be kept for up to 30 days so the same request can be answered again without a new AI call; they contain nothing you typed beyond who the card is for.

If you speak your letter instead of typing, the recording is sent to our AI service to be written out as text, and then thrown away. We never store the audio; only the text you see ends up in your letter.

A voice or video message you add to a card (up to a minute) is kept privately. It isn’t listed or shown anywhere on the site: it can only be played through the code printed on that card, and on your own order page.

Before it’s attached, our AI service listens to it (and, for a video, looks at it) to check it’s kind. A message that isn’t is never kept. The person who scans the code only sees your first name, never your email, last name or address, and we only count plays, not who played them.

You can re-record it from your order page until the card is mailed. We keep it for at least a year after the card is mailed so it can be played again, then delete it. A recording that never goes on a paid card is deleted after 14 days, and deleting your account deletes your messages too. We never share them with anyone, including our printing partner.

If you choose “Have AI create it for me”, the voice description, the look you describe for a video, the theme and the script you approve are kept with the draft to make the message (by our AI services) and for at least as long as the message itself. We never imitate a real person or a famous character, and every script is checked like a letter. Deleting your account deletes them.

Sending a card back. Someone who got your card can ask for your address to send one back. We email you and pass it on only if you tap Share and confirm it, and only to the person who asked. It’s erased with the order.

Only a parent fills in the Santa form; we never collect anything from a child. Your child’s first name, age, town, good deeds, wishes and your note to Santa are used only to write their letter (and Santa’s voice or video message, if you add one). The details you type are deleted 60 days after the letter is mailed, unless you keep your child in your address book so we can remind you next October. A child you don’t keep is removed from your address book at the same time.

The same goes for a Tooth Fairy or Easter Bunny letter from the studio: the character’s message is written from the letter and the recipient’s first name only.

Character voice and video messages (Santa, the Tooth Fairy, the Easter Bunny) show and say only that character: we never use or accept photos of your child. They’re made with our AI services, checked before they’re kept, stored privately like other voice messages (at least a year after mailing) and played only through the code on the letter and on your own order page.

When each one is ready we email you a private link to watch or listen first; the code on the letter plays it once you approve it, or automatically 24 hours before the letter is mailed. So we can check every message ourselves, the owner of Handled also receives a copy of that email with the character’s script (which includes your child’s first name) and the private play link, unless we’ve switched those copies off. Nobody else receives it. The message itself is deleted on the same schedule as other voice messages: at least a year after the card is mailed, after 14 days if it never goes on a paid card, and straight away if you delete your account.

We only send seasonal emails (a few a year, before the big holidays) if you ticked the box at checkout or turned them on in your account settings. It’s never ticked for you. Every one has an unsubscribe link and our mailing address, and unsubscribing doesn’t affect order emails or reminders. We keep your email and when you opted in or out.

You can add people you send cards for (a parent or grandparent) in My account → People I help. Each gets their own address book, dates and reminders inside your account; the reminders come to you. We store their name, how their cards are signed, an optional return address and an optional email. With an email, they get a private link (no password) to read the cards sent in their name and ask us not to send one; we record when they looked and what they chose. Removing them, or deleting your account, deletes their address book and reminders; cards already paid for are still mailed.

A photo you upload for the AI to draw from is kept privately, never shown on the site and never sent to our printing partner. It’s deleted once your letter is mailed, or after 30 days if you don’t place an order. A photo you choose as the card cover is printed on your card, so it’s kept with that order’s card art. If a painting doesn’t work out and you tap Use the photo as-is, a copy of that photo becomes your card’s art (the letterhead or cover) in the same way.

When you put your own photo or design on the front of a card, we keep the file you uploaded (the original) privately: it’s never shown on the site and never sent to our printing partner, which only receives the finished card front. The original is deleted 30 days after the card is mailed (or after 30 days if you don’t order), unless you save it to My designs. You can remove a saved design at any time, and deleting your account deletes them all. If our automatic check isn’t sure about a picture, we keep a small private thumbnail so we can take a look, and delete it once we’ve decided (or after 30 days at most).

While you make a card, what you’ve typed and chosen is saved in your browser so going back or closing the tab doesn’t lose it. If you’re signed in, or once you’ve typed your email, a copy is also kept on our servers so you can pick it up on another device (My drafts); drafts saved in this browser before you signed in join your account when you do and so we can email you a link to finish it: at most two reminders, an hour and a day later, with a one-tap way to stop them. A draft is deleted 30 days after you last changed it; once you pay, its contents are cleared. Deleting your account deletes your drafts.

To improve the site we count how many people reach each step (started, message ready, paid) and how long the steps take. Those counts use a random id for one visit and never your name, email, address or message.

Businesses and nonprofits can send cards from their own tools. API keys are stored only as a fingerprint (a hash) and shown once; a Follow Up Boss API key you paste, webhook links and their signing secrets are stored encrypted and used only to receive your events. The last request each webhook received is kept so you can map its fields, and the activity log records who changed what (never a card’s words). Recipients and donors you send us (names, mailing addresses, gift amounts, dates and designations) are used only to write, address and mail your cards and to avoid thanking the same gift twice; we never sell them, share them for marketing or contact them ourselves. Our writer never adds tax-receipt wording; only text your organization typed is printed.

Vacation rental hosts can add guests in three ways: a guest invite link the host shares (the guest types their own name and mailing address, ticks a consent box, and may leave a note that only the host sees), an upload of the host’s checkouts (only the name, address, property and dates columns are sent to us; every other column is dropped on the host’s computer), or a read-only connection to their property management system (Lodgix). The Lodgix key is stored encrypted and never shown again. From Lodgix we read: guest name, home mailing address, property, check-in and check-out dates. We never change anything in Lodgix: the key is read-only and we only ever ask to read; never read payments, owners, pricing or inquiries; never keep guest emails, phone numbers or birthdays; never contact your guests, except by mailing the card. Every request we make to Lodgix is logged (what was asked for, when, the answer’s status and how many records, never a guest’s details) and shown to the host. From each stay we keep only what the card needs: the guest’s name, their home mailing address, the property and the stay dates (no emails, phone numbers or payment details). They are visible only to that host, used only to write and mail the host’s thank-you card, never sold or used to contact the guest, and each stay is deleted about 13 months after checkout. When the host asks for a preview of recent checkouts, we keep that list (names, city and state, property, dates and the card’s words; no street addresses) encrypted for at most 24 hours, shown only to that host, and nobody on it is mailed unless the host sends that one guest a card. “Disconnect & delete my Lodgix data” wipes the key and the preview and deletes every guest from Lodgix whose card hasn’t been mailed; deleting the account deletes everything.

Every business also has a customer address book: the name and mailing address of each person it sends a card to (added automatically once a card is paid for), plus anything the business adds itself (email, birthday, tags, notes, how the person came to them and how many cards they were sent). It is private to that business and used only for its own cards. A business can delete anyone at any time: their details are erased, and we keep only a one-way fingerprint of the name and address so that no automatic card is ever sent to them again. Everything is deleted when the business deletes its account.

For a business’s guests and customers (from Lodgix, guest invite links, uploads or its address book):

• You (the business): Everything: names, addresses, notes and every card.
• Handwrytten, our writing and mailing partner: The name and address only for cards being mailed, plus the card’s words and design.
• Handled’s owners and Tenfold HQ: Counts only, never names or addresses. Support can open a single record only with a logged reason you can see.
• Our hosting provider (Netlify): Stores the data encrypted, like any website host.

Our server logs and error reports leave out names, addresses, emails and phone numbers. When support opens a record, the business sees the date and the reason in its dashboard’s Privacy tab. We never sell, share or market to your guests. Disconnect & delete anytime.

Now and then we mail a handwritten card to businesses (for example real estate offices) to introduce Handled. We use only a business contact’s name, company and mailing address from a list we prepared, check that the address is complete, and never email or text them. Each card has its own code on the back: when it’s scanned we count the scan and, if they later sign up or order, that it came from the card, never who scanned it. To stop these cards, write to us and we’ll remove you from every list.

A few days after a card should have arrived we email you once to ask how it arrived (1 to 5, and a comment if you like); you can turn these off from the email. The person who got the card can answer the same question on the page behind the code on its back. We keep the number, what happened and the comment with that order, only our team reads the comments, and they’re cleared if you delete your account. A scan of that code also tells us the card arrived.

If you also share it as a public review on our site, we store the stars, what you wrote and the name you chose to show, linked to that order. We never edit reviews; we only publish ones we approve, exactly as written, with that name and the occasion, never your email or address. The Google review link goes to Google, which has its own privacy policy.

Payments are handled by Stripe. We never see or store your full card number. If you save a card for auto-letters, Stripe keeps it and we only see the brand, last four digits and expiry. To know what each order really cost us, we keep Stripe’s fee for your payment and the bill our fulfillment partner emails us for your card (which can name the order and its recipient). Those bills are kept for 180 days; after that only the amounts stay.

Only the services needed to make and mail your letter, and only what each one needs:

• Our handwriting fulfillment partner, which writes and mails the card (the letter, the design and the addresses).
• The AI services that draft letters, design covers, write out voice notes, check voice and video messages, make Santa’s voice and video messages and suggest occasions (what you tell the writer, the Santa form, your letter, a voice note while it’s transcribed, a voice or video message while it’s checked, and the relationships and notes in your address book, without addresses).
• Our address lookup service, which suggests and checks mailing addresses as you type them. What you type in the street field is sent through our server (never straight from your browser), and its suggestions are kept for up to 30 days so the same few letters don’t have to be looked up again. It also turns the recipient’s ZIP or postal code (only that), and, when we have no other location for an order, the billing ZIP or city, into an approximate location.
• Stripe for payments, our email provider for receipts, previews and receiving the emails you send us, and our hosting provider.

We never sell your data. The only thing advertising platforms ever learn is described under “Ads and measurement” below, and only if you say yes.

Go to My account → Settings and press Delete my account. That cancels every auto-letter, removes your saved card, address book, saved dates, messages, suggestions, address links, group cards, voice and video messages, notes from your people, your reviews, your invite link, your Google Contacts connection your text-message settings and queued texts, the people you help (with their address books and reminders), and any business automation (API keys, webhooks, CRM and rental system connections, templates, waiting cards, rental guests, donors and their gifts), and erases the personal details from your past orders. Unused credit can’t be used once the account is gone, so spend it or ask us about it first. Letters you’ve already paid for that haven’t been mailed yet are still sent, and their details are erased once they’re mailed. We keep only what the law requires for our records (like the amount and date of a payment).

No account? Email hello@sohandled.com and we’ll delete what we have about your orders.

We use a sign-in cookie if you have an account, a first-party cookie that remembers how you found us (the first and most recent link or ad you came from, 90 days, never shared), one that remembers your cookie choice, one that counts free message-writer uses, one that remembers whether you chose the larger-text view (a year), one that remembers who you’re sending cards for when you help someone (12 hours), one that remembers a friend’s invite for 30 days, one that remembers a campaign or friends & family code you used (30 days, so its free card or offer applies at checkout), one that remembers which card’s code you scanned (30 days, so a card you send back is counted for the person who sent you one; it holds only a card number, never who you are), and a random one (90 days) that keeps the homepage wording the same for you while we test which wording helps people most (never prices). While a page is open it tells us, about once a minute, that someone is on the site, using a random id for the visit and nothing else, so we can see how many people are here right now; those records are deleted after a day. Advertising cookies from Meta, Google and Pinterest are only set if you press Accept (see Ads and measurement).

Email hello@sohandled.com.