A letter is the most personal post a person gets.

An official letter carries a name, an address, an amount owed and often a citizen service number. Plainletter is built so that almost none of it has anywhere to go. This page says what happens to it, in the order the law asks for.

Who is responsible

The data controller for this desk is Taranity, reachable at hello@taranity.com. The controller decides what this desk does with a letter and answers for it.

Every desk answers for its own copy. A library or advice service that runs Plainletter itself is the controller of that installation, and its own name belongs here rather than anybody else’s.

This desk publishes no data protection officer, so questions go to the controller. Most public bodies running their own copy have to appoint one and publish how to reach them, and that address appears here when they do.

What is processed, why, and on what basis

The letter itselfThe photograph or file, and everything printed on it, for as long as one reading takes. The basis is your own request: you asked this desk to read this letter.

A case you agreed to keepOnly if you say yes out loud. The basis is your consent, and you can take it back at any moment by asking for the case to be erased.

Counts about the serviceHow many facts were checked, whether a person was needed, which sender the letter came from. No sentence of any letter. The basis is the legitimate interest in knowing whether the service works.

Keeping the desk standingA network address and a random marker in a cookie, so one caller cannot use up the service. The basis is the legitimate interest in security, and that cookie is strictly necessary for it, so it is set without asking.

Handing over the letter is voluntary and nothing obliges you to. Without it there is nothing to read, which is the only consequence.

Where it goes

The letter goes to an Amazon Bedrock model hosted in the European Union, reached from the Frankfurt region, and to Amazon Bedrock AgentCore, which runs this service and holds a consented case. Both are processors: they act on the controller’s instructions and on nobody else’s. Nothing is sent outside the EU in normal operation, and nothing is sold, shared or published.

Amazon states that Bedrock does not store model inputs or outputs, and that model providers have no access to them at all. Amazon does screen uploaded images for child sexual abuse material and may keep a flagged image to decide what it is. The full position, with the wording and the date it was read, is in docs/privacy-accountability.md in the source code.

What is never stored

The image of the letter. It is not written to disk, not kept in a bucket, not logged.
The text of the letter. The reading is derived from it and the text itself is dropped.
The citizen service number and any bank account number. Both are masked before anything is shown on screen, printed on the card or written to a reminder, so they cannot reach a log by accident.

How long anything is kept

The reading stays in the tab in front of the volunteer for fifteen minutes and then clears itself. The clock is visible in the console while a letter is open, and Brief wissen ends it sooner.

A case you agreed to keep lives for thirty days and then deletes itself. What is in it is the derived facts and nothing else: the sender, the letter type, the amounts, the deadline, the steps. Not the image, not the text, and never the masked identifiers. It is filed under a case number printed on your desk card, and it lives in the same EU region as the reading.

Your rights

See what is keptBring the case number on your card. The desk shows every reading filed under it, which is the whole record.

Have it erasedAsk, with the case number, and the desk deletes it there and then rather than in thirty days. No letter is read and nothing else is needed.

Correct itA record comes from one reading. A wrong reading is read again and the old case erased.

Take it with youThe reading leaves with you as a printed card and a calendar reminder, and a case can be handed over as a file.

Restrict or objectNothing is kept unless you said yes, and erasing the case takes that yes back.

ComplainTo the controller first, and to the Autoriteit Persoonsgegevens at autoriteitpersoonsgegevens.nl at any time, whatever the desk says.

No decision is made about you

Plainletter explains a letter and lays out the options. It decides nothing about you, profiles nobody, and never scores or ranks a person. Where the reading did not fully check out, or the sender’s procedure has not been confirmed against an official page, it says so and points to a person.

The demo letters are invented

Every sample letter in this project is written from scratch. The names, addresses, number plates, reference numbers and citizen service numbers in them belong to nobody, and no real letter has ever been committed to this repository.

This is not legal advice

Plainletter explains letters. It says plainly when a letter needs a professional, and points to Het Juridisch Loket, the sociaal raadslieden or municipal debt support rather than trying to handle it.

Back to the letter