Last updated: June 2026
The controller responsible for the processing of personal data on this website is:
We use hosting and infrastructure services to operate our website. These services include in particular server infrastructure, computing capacity, storage space, security measures, technical maintenance and services required for the provision and secure operation of the website.
In the context of hosting, inventory data, contact data, content data, usage data as well as meta and communication data may in particular be processed. Processing is carried out on the basis of our legitimate interest in the secure, stable and efficient provision of our website pursuant to Art. 6(1)(f) GDPR. Insofar as the hosting provider processes personal data on our behalf, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR.
Our hosting provider is:
According to the provider, the server locations are in data centres within the European Union, currently in particular in Germany and France.
The hosted systems may in particular process data required for the operation of readoldletters.com. This includes in particular customer account data, credit and usage data, uploaded images, scans and documents, stored library content, transcriptions, translations, summaries, thumbnails, result data, books, collections and other content created or generated by the user.
When our website is accessed, technical information is processed automatically. This may include in particular the IP address, the date and time of access, the browser used, the operating system, the referrer URL, the pages accessed and technical connection data.
This processing is technically necessary in order to provide the website, to ensure the stability and security of the service and to be able to detect misuse or technical faults.
The legal basis is Art. 6(1)(f) GDPR.
The creation of a customer account is required in order to use the platform.
When registering and managing a customer account, we process in particular the email address, the name insofar as provided, login data, account settings, information about the customer account, credits provided free of charge, purchased credits, consumed credits, subscription status, order and payment status as well as content stored within the customer account.
Processing is carried out in order to create and manage the customer account, to provide the platform functions, to manage credits, to carry out chargeable credit purchases or subscriptions, to provide any voluntary free credits and to perform the usage agreement.
In order to document consent to the General Terms and Conditions and to this privacy policy, we store the time of consent as well as the IP address used at that time. This processing serves to fulfil our accountability and documentation obligations. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 5(2) GDPR as well as our legitimate interest in being able to demonstrate consent given pursuant to Art. 6(1)(f) GDPR.
Otherwise, the legal basis is Art. 6(1)(b) GDPR.
Credits are required in order to perform scans. Users may purchase credits or take out a paid subscription. Insofar as the provider voluntarily makes free credits available, these are also managed via the customer account.
In order to manage these functions, we process in particular information about available, used and purchased credits, monthly allowances, subscription status, tariff information, payment status, invoice data and technical payment references.
Processing is carried out in order to provide and manage the free and chargeable functions of the platform, to perform the contract, for billing and for the prevention of misuse.
The legal basis is Art. 6(1)(b) GDPR. Insofar as data is processed to fulfil tax, commercial or other statutory obligations, the legal basis is Art. 6(1)(c) GDPR.
readoldletters.com enables users to upload, store, organise and have processed by means of an AI-supported system historical or hard-to-read documents, handwritten or printed papers, letters, manuscripts, books, deeds, notes or comparable materials.
The user decides for themselves which images, scans, files or documents they upload. Users should only upload content that they are entitled to use and have processed.
In this context, uploaded images, scans, files, file names, image content, recognised text content, transcriptions, translations, summaries, thumbnails, result data, books, collections and other content generated by the system or created by the user may in particular be processed.
Historical or other uploaded documents may contain personal data. This may include in particular names, addresses, signatures, family details, life dates, places, personal messages or other information about living or deceased persons.
Processing is carried out in order to provide the functions requested by the user, in particular storage, management, transcription, translation, summarisation, AI-supported analysis and other textual processing.
The legal basis is Art. 6(1)(b) GDPR insofar as the processing is necessary for the performance of the usage agreement.
Personal data is stored only for as long as is necessary for the respective purposes or for as long as statutory retention obligations exist.
In order to ensure technical operation, security and the prevention of misuse, IP addresses and technical log data may be stored for a limited period. This data is generally deleted after 7 days at the latest, unless security-related reasons require longer storage.
Customer account data is generally stored for as long as the customer account exists. Data required for the performance of the contract, billing, payment processing or documentation may be stored beyond this, insofar as statutory retention obligations or legitimate interests in retaining evidence exist.
Uploaded images, scans, documents, transcriptions, translations, summaries, thumbnails, books, collections and other stored content generally remain stored in the customer account so that the user can manage them within their library and access them again.
This content is generally stored for as long as the customer account exists or until the user deletes the respective content or requests its deletion, provided that no statutory retention obligations or legitimate interests in retaining evidence conflict with this.
Upon deletion of the customer account, stored scans, uploaded images or documents, translations, transcriptions, summaries, books, collections and the results generated from them are deleted, provided that no statutory retention obligations or legitimate interests in retaining evidence conflict with this.
Payment, invoice and accounting data is stored in accordance with statutory retention obligations. In particular, a statutory retention period of up to 10 years applies to accounting vouchers, invoices and accounting-relevant documents (§ 147 German Fiscal Code (AO), § 257 German Commercial Code (HGB)), and a period of up to 6 years applies to other business documents subject to retention. Once the respective period has expired, the data is deleted.
Immediate deletion from technical backup copies may be technically delayed. Such backup copies are not actively used and are deleted or overwritten after the regular backup retention periods have expired.
We use the payment service provider Stripe for payment processing in connection with credit purchases and subscriptions.
The provider for users in the European Economic Area is:
When purchasing credits or taking out a subscription, we process the data required for the order, performance of the contract and billing. This may include in particular the email address, customer account, selected credit package, selected subscription tariff, price, payment status, invoice and accounting data, consumed and remaining credits, subscription status, Stripe customer numbers, technical payment references and other payment information.
Depending on the payment method chosen, data may be transmitted to Stripe and processed there. This may include in particular name, email address, invoice data, payment amount, payment method, payment status, technical payment identifiers, IP address and information for fraud prevention.
Processing is carried out in order to perform the contract, to process payments, to provide purchased credits, to manage subscriptions, to issue invoices and to fulfil tax and commercial law obligations.
The legal basis is Art. 6(1)(b) GDPR for the performance of the contract and Art. 6(1)(c) GDPR for statutory retention and documentation obligations.
Processing by Stripe is carried out in particular for the purposes of payment processing, fraud prevention and compliance with legal requirements. Further information on data processing by Stripe can be found in Stripe's privacy information.
readoldletters.com offers functions for the AI-supported processing of historical or hard-to-read documents. This may include in particular transcriptions, translations, summaries and other textual processing.
When the user uses such a function, they decide for themselves which images, scans or documents they upload and make available for processing. By actively uploading and using the function, the user initiates the processing of the respective content in order to provide the desired service.
The uploaded images, scans or documents are first transmitted to our servers via an encrypted connection. From there they are forwarded to an external AI service provider in order to carry out the AI-supported processing requested by the user. The forwarding takes place as soon as the user triggers an AI function (e.g. transcription or translation) and is necessary in order to provide this service.
The AI service provider used is:
Processing is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR insofar as Google Ireland Limited acts as a processor.
The uploaded content is processed exclusively for the purpose of providing the function requested by the user. According to the information available to us and the contractual arrangements in place, the data is not used to train AI models.
It cannot be ruled out that, within the scope of the services used, data may also be processed on servers outside the European Union or the European Economic Area, in particular in the USA. In such cases, the transfer is carried out on the basis of statutory requirements, in particular appropriate safeguards such as standard contractual clauses pursuant to Art. 46 GDPR, insofar as no adequacy decision applies.
We have influence over the data processing carried out by the AI service provider used only within the scope of the existing contractual and technical possibilities.
The images, scans and documents transmitted within the platform are transferred to our servers via an encrypted connection and processed in order to carry out the desired functions.
Uploaded images, scans, documents, thumbnails, transcriptions, translations, summaries, books, collections and other generated results are stored on our hosted systems insofar as this is necessary in order to make the content available to the user in the customer account, in the library or within other platform functions.
This permanent storage takes place exclusively on the servers of our hosting service provider server4you GmbH in data centres within the European Union (currently in Germany and France). The external AI service provider processes the transmitted content, in accordance with the contractual arrangements in place with it, exclusively in order to carry out the function requested in each case (see section 6) and does not use it to train its own AI models. Permanent storage of the uploaded content in our library does not take place there; temporary storage by the service provider, for example to ensure operation and for security and misuse checks, may take place for a limited period in accordance with its specifications.
The user can manage stored content within their customer account and, insofar as technically provided for, delete it.
Uploaded images, scans, documents, recognised texts, transcriptions, translations, summaries, thumbnails and other generated results are not used by us to train our own AI models.
Processing is carried out exclusively in order to provide the service requested by the user, to ensure the technical operation of the service, for storage and management in the customer account and, insofar as necessary, for billing, prevention of misuse and compliance with statutory obligations.
Our website may use technically necessary cookies or similar technologies. These serve in particular to provide basic functions of the website, such as login, customer account, session recognition, credit management, subscription management, security and technical stability.
Technically necessary cookies are required for the operation of the website.
Insofar as we use cookies or similar technologies beyond this for analytics, tracking or marketing purposes, this is done only on the basis of prior consent, where such consent is required by law.
We currently do not use any analytics, tracking or marketing services.
Should analytics, tracking or marketing services be used in the future, this privacy policy will be supplemented accordingly. Where necessary, consent will be obtained before they are used.
When using our platform, the user processes the files they have selected and uploaded themselves, in particular images, scans, documents or other digital materials.
Processing takes place only when the user selects or uploads a file via the upload function of the website, or stores or processes it within the platform. No automatic access to the user's local files takes place.
Insofar as personal data is transferred to providers outside the European Union or the European Economic Area, this is done on the basis of statutory requirements.
Such a transfer may in particular take place on the basis of an adequacy decision of the European Commission or appropriate safeguards such as standard contractual clauses.
A residual risk arising from access by state authorities, in particular in the case of processing in the USA, cannot be entirely ruled out.
We use selected service providers for the operation of readoldletters.com.
The hosting and technical provision of the website is carried out via:
The AI-supported processing of uploaded images, scans and documents involves:
For payment processing we use:
These service providers process personal data only insofar as this is necessary for the respective service. No disclosure of personal data beyond this takes place unless there is a statutory obligation to do so, the disclosure is necessary for the performance of the contract, or the user has expressly consented.
We use technical and organisational measures to protect personal data against unauthorised access, loss, alteration or misuse.
Data is transmitted via an SSL or TLS encrypted connection.
You have the right to request confirmation as to whether we process personal data concerning you. If this is the case, you have in particular the right to information about the purposes of processing, the categories of data, the recipients, the storage period and a copy of the data processed.
You have the right to request the immediate rectification of inaccurate personal data and the completion of incomplete personal data.
You have the right to request the erasure of your personal data, provided that the statutory requirements are met. Erasure may in particular be excluded insofar as statutory retention obligations exist or the processing is necessary for the establishment, exercise or defence of legal claims.
You have the right to request the restriction of the processing of your personal data under the statutory conditions.
You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or to request its transmission to another controller, provided that the statutory requirements are met.
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data, provided that the processing is based on Art. 6(1)(e) or Art. 6(1)(f) GDPR.
You have the right to withdraw consent you have given at any time with effect for the future. The lawfulness of the processing carried out up to the withdrawal remains unaffected.
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection law.
The competent authority may in particular be the data protection supervisory authority of the federal state in which the provider has its registered office.
For Rhineland-Palatinate this is:
You have the right to be informed about recipients to whom a rectification, erasure or restriction of processing has been communicated, insofar as this is not impossible or would involve disproportionate effort.
You have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you.
We do not use personal data for automated decision-making within the meaning of Art. 22 GDPR that produces legal effects concerning users or similarly significantly affects them.
The AI-supported processing of documents serves the technical transcription, translation, summarisation and other processing of the content uploaded by the user. It does not serve to make legally significant decisions about the user.
This privacy policy may be amended if legal, technical or organisational changes arise.
The current version is available at any time on our website.