Privacy Policy

Effective date: November 7, 2026

1. Introduction

VerifiableLetter Inc. (“VerifiableLetter,” “we,” “us,” or “our”) is committed to protecting personal information and respecting individual privacy rights.

This Privacy Policy explains how we collect, use, disclose, store, retain, and protect personal information when individuals interact with our websites, applications, document creation services, and verification platform.

This Policy applies to:

• verifiableletter.com
• app.verifiableletter.com
• Related websites and services operated by VerifiableLetter
• Individuals who contact or interact with our business

It applies to website visitors, registered users, organizational representatives, document recipients, and individuals whose information is processed through the Services.

2. Our Role in Processing Personal Information

VerifiableLetter processes personal information in different capacities depending on the circumstances.

For account registration, subscriptions, customer support, website operations, security, and business administration, VerifiableLetter generally determines the purposes and means of processing.

When organizations use VerifiableLetter to create, issue, and manage communications containing personal information, those organizations generally determine the content, recipients, confidentiality classifications, and purposes of the communications.

In those circumstances, VerifiableLetter may process information on behalf of the issuing organization.

Individuals seeking changes to the contents of an organization-issued letter may need to contact the issuing organization directly.

3. Personal Information We Collect

3.1 Account Information

When users register or manage accounts, we may collect:

• First and last name.
• Email address.
• Telephone number, where provided.
• Country or general location.
• Account identifiers.
• Organization details.
• Account preferences and settings.

3.2 Organization Information

Organizations may provide:

• Business or organization name.
• Business address.
• Website and domain information.
• Contact details.
• Logos and branding.
• Information required for available organization verification features.
• Authorized user information.

3.3 Social Login Information

VerifiableLetter supports sign-in using:

• Google.
• Microsoft.
• LinkedIn.

When a user signs in using one of these providers, we obtain the following profile information:

• First name.
• Last name.
• Email address.

Additional information required to use our Services is requested directly from the user.

Authentication providers may independently process information according to their own privacy policies.

3.4 Documents and Communications

When organizations create and issue communications through VerifiableLetter, we process information that may include:

• Document content.
• Sender and recipient information.
• Business information.
• Letter IDs.
• QR code references.
• Confidentiality classifications.
• Document issuance records.
• Verification information and history.

Documents may contain personal information about individuals who do not have VerifiableLetter accounts.

The issuing organization is responsible for ensuring that it has an appropriate legal basis to collect, use, and disclose such information.

3.5 Payment and Subscription Information

VerifiableLetter uses Stripe to process subscription payments.

Stripe handles payment card information. VerifiableLetter does not store complete payment card numbers or card security codes in its application database.

We retain payment and subscription metadata, including:

• Payment amounts.
• Transaction identifiers.
• Subscription plans.
• Billing frequency.
• Payment status.
• Payment and renewal dates.

3.6 Technical and Usage Information

When individuals access our Services, we may collect:

• IP addresses.
• Browser and device information.
• Operating system information.
• Pages visited.
• Dates and times of interactions.
• Login and security events.
• Error and diagnostic information.
• General usage information.
• Referring website information.

3.7 Support and Communications

We may collect information when individuals contact us, request assistance, submit forms, report issues, or communicate with our business.

This may include contact information and the contents of the communication.

4. How We Use Personal Information

We process personal information to:

• Register and manage accounts.
• Provide document creation and verification services.
• Maintain organizational profiles and permissions.
• Process subscriptions and payments.
• Authenticate users.
• Provide technical support.
• Maintain security and prevent fraud.
• Record verification activity.
• Detect unauthorized access.
• Diagnose errors and improve functionality.
• Send account and service notifications.
• Send marketing communications where permitted.
• Meet legal and regulatory obligations.
• Establish, exercise, or defend legal rights.

We do not use customer document content for unrelated purposes merely because it is processed through our platform.

5. Legal Bases for Processing

Where applicable law requires a legal basis, we process personal information under one or more appropriate grounds, including:

• Performance of a contract.
• Compliance with legal obligations.
• Legitimate interests, where recognized and not overridden by individual rights.
• Consent, where required.
• Other grounds permitted by applicable law.

The applicable legal basis depends on the purpose, information involved, and jurisdiction.

Where processing relies on consent, individuals may withdraw consent subject to applicable legal limitations.

6. Document Verification and Confidentiality

VerifiableLetter provides a document verification service using unique Letter IDs and QR codes.

The information required before a letter preview becomes accessible depends on the confidentiality classification selected by the issuing organization.

6.1 Public Letters

For letters designated as Public, anyone possessing a valid Letter ID or corresponding QR code may access the letter preview.

No additional recipient-identification information is required.

6.2 Private Letters

For letters designated as Private, the requester must provide the intended recipient’s name and address.

The letter preview becomes accessible only after the required information satisfies the verification checks.

6.3 Confidential Letters

For letters designated as Confidential, the requester must provide:

• The intended recipient’s name.
• The intended recipient’s address.
• Randomly selected words from the letter.

The letter preview becomes accessible only after the required checks have been satisfied.

6.4 Invalid Letter IDs

Submitting an invalid Letter ID does not reveal information about an associated letter.

6.5 Confidentiality Limitations

The verification requirements are designed to reduce unauthorized access to document previews.

However, these checks do not independently establish the identity of the requester or guarantee that only the intended recipient can obtain access.

Organizations are responsible for choosing appropriate confidentiality settings and ensuring that information made accessible through verification is lawfully disclosed.

7. Verification History and Failed Attempts

VerifiableLetter maintains verification history for issued letters to support security, accountability, fraud prevention, and the detection of potentially unauthorized verification attempts.

Verification history may include:

• Date and time of the attempt.
• Requester’s IP address.
• Verification outcome.
• Associated letter record.

Both successful and unsuccessful verification attempts may be recorded.

When a verification attempt fails because the requester provides an incorrect recipient name, address, or requested word from a Confidential letter, the failed attempt is recorded.

The incorrect recipient name, address, or confidential-letter words entered during an unsuccessful attempt are not stored as part of the verification history.

Verification history may be accessible to authorized users of the issuing organization’s account, subject to applicable permissions.

We use this information for security monitoring, fraud prevention, investigation of suspicious activity, and service administration.

8. Documents Submitted for Verification

Documents submitted to VerifiableLetter solely for a verification process are deleted after that verification process is completed.

This provision is distinct from documents created and issued by organizations through their VerifiableLetter accounts.

Issued documents remain subject to the account and document retention provisions described below.

9. Document Retention and Account Deletion

Previously issued documents remain verifiable while the issuing account remains active.

When a paid subscription is cancelled, the account reverts to the Free plan. Previously issued documents remain verifiable as long as the account remains active.

When an account is deleted, its associated documents are permanently deleted from the active platform and are no longer available through the verification service.

Certain transaction, billing, security, or administrative records may be retained separately where required by applicable law.

Residual copies may remain temporarily in backups until their scheduled expiration, where applicable.

Verification-history records are retained according to the applicable account lifecycle and security retention practices.

Users should retain independent copies of documents needed for business, legal, or regulatory purposes.

10. Google Analytics

VerifiableLetter uses Google Analytics to understand website usage and improve our online services.

Depending on configuration and applicable consent choices, Google Analytics may collect or process:

• Pages viewed.
• Website interactions and events.
• Session and engagement information.
• Browser and device characteristics.
• Approximate geographic information.
• Online identifiers associated with analytics technologies.

We use analytics information to evaluate website performance, understand visitor engagement, and improve the user experience.

Where applicable law requires consent, non-essential analytics technologies will be activated only after the necessary consent has been obtained.

Additional information about analytics technologies and user choices is available in our Cookie Policy.

11. Cookies and Similar Technologies

Our websites and applications may use cookies and similar technologies for:

• Authentication.
• Security.
• Session management.
• User preferences.
• Website analytics.
• Other disclosed purposes.

Details about these technologies and available choices are provided in our Cookie Policy.

12. Sharing Personal Information

We may disclose personal information to the following categories of recipients where necessary and legally permitted.

12.1 Service Providers

Providers supporting hosting, infrastructure, security, payments, authentication, analytics, email delivery, and other operational functions.

12.2 Issuing Organizations

Information associated with an organization’s account, issued documents, and verification history may be accessible to its authorized users according to their permissions.

12.3 Document Recipients and Verification Users

Information may be disclosed through the verification service when the applicable confidentiality requirements have been satisfied.

12.4 Legal Authorities

Information may be disclosed where required by law, valid legal process, or other lawful obligations.

12.5 Business Transactions

Information may be transferred in connection with a merger, acquisition, restructuring, or sale of relevant business assets, subject to applicable law and safeguards.

We do not authorize service providers to use personal information for unrelated purposes merely because they process it on our behalf.

13. International Data Processing

VerifiableLetter is based in Canada and provides Services to users worldwide.

Personal information may be stored, accessed, or processed in Canada or other countries where our authorized service providers operate.

Where required by applicable law, we implement appropriate contractual, technical, or organizational safeguards for international transfers.

Information processed in another jurisdiction may be subject to lawful access requests under that jurisdiction’s laws.

Individuals may contact us for information about applicable transfer arrangements.

14. Data Security

We use reasonable technical and organizational measures intended to protect personal information against unauthorized access, alteration, disclosure, loss, and misuse.

These measures may include:

• Authentication and access controls.
• Encrypted communications.
• Account permissions.
• Security monitoring.
• Verification access controls.
• Other safeguards appropriate to the information and associated risks.

No internet-based system can guarantee absolute security.

Users are responsible for protecting their account credentials and assigning appropriate access permissions.

Suspected security incidents should be reported promptly.

15. Marketing Communications

We may send information about VerifiableLetter products, features, services, and updates where permitted by applicable law.

Recipients may unsubscribe from promotional emails using the unsubscribe mechanism provided or by contacting us.

Unsubscribing from marketing communications does not prevent necessary transactional, security, or account-related communications.

Acceptance of the Terms of Service does not constitute blanket consent to receive marketing messages.

16. Your Privacy Rights

Depending on your jurisdiction and applicable law, you may have the right to:

• Request access to personal information.
• Request correction of inaccurate information.
• Request deletion in qualifying circumstances.
• Withdraw consent where processing depends on consent.
• Object to or restrict certain processing.
• Request data portability where applicable.
• Submit a complaint to an appropriate privacy regulator.

We may need to verify your identity before fulfilling certain requests.

Requests may be subject to legal exceptions, retention requirements, or other applicable limitations.

Where VerifiableLetter processes document information on behalf of an issuing organization, we may refer the request to that organization or assist it in responding.

To exercise your rights, contact [email protected].

17. Children’s Privacy

VerifiableLetter is intended primarily for businesses, organizations, and individuals authorized to use professional communication services.

The Services are not designed for independent use by children.

Where we learn that personal information has been collected from a child without authorization required by applicable law, we will take appropriate action.

18. Third-Party Websites and Services

Our Services may link to or integrate with third-party websites and applications.

These third parties may operate under their own privacy policies.

This Policy does not govern personal information independently collected by unrelated third-party services.

19. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our Services, technology, operations, or legal requirements.

The current version and effective date will be published on this page.

Where required by law, we will provide additional notice or obtain consent before implementing material changes.

20. Contact and Privacy Requests