Privacy Policy

The controller is STRICS IT GmbH, Florian-Gmainer-Straße 4, 4240 Freistadt, Austria. For any privacy question or request, write to hello@strics.at.

This policy covers Reletter at reletter.strics.at. It adds to the general STRICS privacy policy at strics.at/privacy.

To sign up, you give your email address and a password. Firebase Authentication, a Google service, stores your email address, a hashed form of your password and sign-in data; we cannot read your password. We also store the time you accepted the terms and this policy, your credit balance and, if you signed up with an invite link, who invited you.

To stop mass sign-ups, our server stores a SHA-256 hash of the IP address used to sign up, with timestamps, for about one hour.

Legal basis: providing your account and Reletter under our contract with you (Art. 6(1)(b) GDPR). The acceptance record and the sign-up limit are based on our legitimate interest in being able to prove the contract and in preventing abuse (Art. 6(1)(f) GDPR).

When you work on a font or a stone, we store what you upload and make: photos of lettering or of a stone, the areas you mark, the text you type, generated glyph sheets and images, fonts and other files, and the project settings. They are stored in Google Firebase (Cloud Firestore and Cloud Storage) in the EU.

Photos of memorials can show names and dates of people. Please upload only what your project needs.

Legal basis: our contract with you (Art. 6(1)(b) GDPR).

When you start an AI step, our server (Google Cloud Functions in the EU) sends the images and text the step needs to OpenAI (GPT Image models), which generates and edits images such as glyph sheets and new lettering, or to Anthropic (Claude), which checks generated glyph sheets, suggests font names and describes lettering. This can include your uploaded photos, the text you typed and images generated earlier in the project. The API keys stay on our server; your browser does not contact these providers directly.

The providers process this content to produce the result and, under their business terms, may keep it for a limited time, for example to detect abuse. We do not use your content to train AI models.

For every AI step we log the time, your account ID and email address, the step, the AI model, the cost, whether it succeeded and any error message. We use these logs for billing, to answer questions about charges, to detect abuse and to improve quality. Our admins can see them.

Legal basis: the AI processing is part of our contract with you (Art. 6(1)(b) GDPR). The logs are based on our legitimate interests in correct billing, preventing abuse and keeping Reletter working well (Art. 6(1)(f) GDPR).

We keep a history of your credits: every AI step with the credits charged, the model used and its cost, and every purchase, reward and refund.

Payments are handled through Stripe Managed Payments by Sold through Link, LLC (“Link”), a Stripe company, which is the merchant of record. When you buy credits, we send Stripe your email address and your Reletter account ID to create a customer record. You enter your payment details on Stripe's checkout page; we never see your full card details. Link and Stripe process your payment, billing and tax details as independent controllers under the Link privacy policy (link.com/privacy), including automated checks to prevent fraud. They share order data with us, for example your name, email address, billing country or address, the payment method used, the amount and the VAT.

After the payment, Stripe tells our server the result. We store the purchase with the amount, the VAT, the Stripe checkout session, payment and invoice IDs, the time you asked for the credits to be added right away, and any refunds.

Legal basis: our contract with you (Art. 6(1)(b) GDPR) and our legal duty to keep accounting records (Art. 6(1)(c) GDPR together with § 132 of the Austrian Federal Fiscal Code, BAO).

If you sign up with someone's invite link, we store who invited you and when. The person who invited you sees a shortened version of your email address (for example ma•••@example.com), the date you joined and the credits they earned from your purchases. They do not see your projects.

Legal basis: for the inviter, our contract (Art. 6(1)(b) GDPR). Showing the shortened email address and join date to the inviter is based on our and the inviter's legitimate interest in correct and transparent rewards (Art. 6(1)(f) GDPR).

When you send a report with Help & feedback, we store your message, your email address, the page, the language, the app version and any screenshots you add. If “technical details” is switched on (the default), the report also contains the last 150 entries of the browser log (errors, requests to our server with status and timing, and page changes), browser and screen information, and the state of font jobs. Sign-in tokens and inline images are removed. Reports are stored in Google Firebase and read by our admins.

Legal basis: our legitimate interest in answering you and fixing errors (Art. 6(1)(f) GDPR). You can switch off the technical details before you send a report.

Reletter keeps a copy of your saved fonts, stones and drafts in your browser's IndexedDB so that it works quickly. Your settings, your language and, for up to 60 days, an invite code from an invite link are kept in localStorage. Firebase Authentication keeps your sign-in session in localStorage.

This storage is needed to provide the service you asked for (§ 165(3) of the Austrian Telecommunications Act 2021), so no consent is required. Reletter uses no cookies or other tools for tracking or advertising, and no analytics.

You can delete this data in your browser settings. You then need to sign in again, and drafts kept only in the browser are lost.

The Reletter website is hosted by Vercel. When you open it, Vercel receives technical data such as your IP address, the time, the requested page and browser information, which is needed to deliver the site and keep it secure. Requests to our server go to Google Cloud Functions in the EU, which also process your IP address and technical request data. Firebase Authentication keeps logged IP addresses for a few weeks.

Legal basis: our legitimate interest in delivering Reletter reliably and securely (Art. 6(1)(f) GDPR).

We use these providers: Google (Firebase Authentication, Cloud Firestore, Cloud Storage and Cloud Functions) for accounts, storage and our server; Vercel for hosting the website; OpenAI and Anthropic for AI steps. They act as our processors under data processing terms. Link and Stripe handle payments as independent controllers.

Within STRICS, only people who need it for operation, support or billing have access. We do not sell your data and do not share it for advertising.

Some data is processed in the United States: Firebase Authentication runs only in US data centres, OpenAI and Anthropic process AI requests there, and Vercel and Stripe may process data there.

Google LLC, Vercel Inc. and Stripe, LLC are certified under the EU-U.S. Data Privacy Framework (checked on October 31, 2026), so transfers to them rely on the EU Commission's adequacy decision (Art. 45 GDPR). OpenAI and Anthropic are not on the Data Privacy Framework list; transfers to them rely on the EU standard contractual clauses in their data processing terms (Art. 46(2)(c) GDPR). You can ask us for a copy of these safeguards.

Your account, projects, files, credit history and referral data: as long as your account exists. When you ask us to delete your account, we delete your sign-in, fonts, stones, files and credit history. Firebase removes deleted sign-in data from its backups within 180 days.

Purchase records: seven years from the end of the calendar year of the purchase (§ 132 BAO), also after your account is deleted.

AI step logs and bug reports: they are not deleted automatically with your account. We keep them only as long as we need them for the purposes above and delete them on request, unless we need them to establish, exercise or defend legal claims.

Sign-up IP hash: about one hour. Browser storage: until you delete it; the invite code for up to 60 days. Link and Stripe keep payment data under their own policies.

You need to give an email address and a password to have an account, and the photos and text that an AI step needs to use it. To buy credits, you give your payment details to Stripe. Everything else is optional.

We make no decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR).

You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interests (Art. 15 to 21 GDPR). Write to hello@strics.at. We may ask you to confirm the request from the email address of your account.

You can complain to the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at, dsb.gv.at) or to the supervisory authority where you live or work.

We update this policy when Reletter or our providers change. The current version is always at strics.at/reletter/privacy.