Skip to content

Record of Processing Activities

In compliance with GDPR Article 30, this page documents all data processing activities performed by LetEmily, including the purposes, legal basis, data categories, and security measures.

Last Updated: October 14, 2026

Data Controller Information

Organization Name
LetEmily
Contact Email
privacy@letemily.com
Data Protection Officer
privacy@letemily.com
Security Contact
security@letemily.com

Processing Activities

1. User Account Management

Purpose of Processing
To provide user authentication, account management, and access to the LetEmily platform services.
Legal Basis
Contract (GDPR Article 6(1)(b)) - Processing is necessary for the performance of a contract with the user.
Categories of Data Subjects
  • Registered users
  • Team administrators
  • Team members
Categories of Personal Data
  • Identity data: name, email address, password (hashed)
  • Account data: user preferences, settings, language
  • Authentication data: login timestamps, session tokens
  • Profile data: bio, avatar, work location
Recipients
  • Internal: Application servers, database servers
  • External: Cloudflare Turnstile, at sign-up and demo request only: IP address, user agent, TLS fingerprint and site origin, used solely for bot detection
  • External: Backblaze (B2 Cloud Storage), for off-site database backups. A backup is a copy of the database, so it contains the account data listed above; it is encrypted on our server before upload, so Backblaze stores only encrypted data
  • External: Postmark, which delivers account, reminder and report email; those emails carry the content they are about (meeting and commitment titles, names, report summaries)
  • External: browser push services (for example Google, Mozilla, Apple), which deliver browser notifications to users who turn them on; a notification can include a meeting or commitment title or a person's name
International Data Transfers
Data stored in US data centers with appropriate security measures. At sign-up, the bot-check signals listed above are processed by Cloudflare (US) under its Turnstile privacy terms. Email is delivered through Postmark (US).
Retention Period
Active users: Retained while account is active. Soft-deleted users: 60 days. Deleted accounts: account data is erased when the account is deleted. The account's privacy audit log entries (the deletion record, and any earlier export and consent entries: date and time, what was done, and where recorded the IP address and browser user agent of the request; the deletion and export entries also hold an internal account reference number; no name, email address or content) are kept for 365 days from when each was written, as a security and legal accountability record, then permanently deleted. Sign-in attempt and lockout records are kept with the email address anonymised, then deleted after 90 days. Account activity history (which actions were taken in the app, and when): activity logs 180 days; records of administrator access to the account 365 days; then permanently deleted. A demo request is a separate record and is not removed with the account. Database backups: deleted data can remain in off-site backups (encrypted on our server before upload), which rotate out over up to about three years and are not used to restore individual deletions.
Security Measures
  • Bcrypt password hashing (cost factor 12)
  • Encryption in transit with TLS 1.2 or 1.3 (modern TLS)
  • Database encryption at rest
  • Access controls and authentication
  • Regular security audits

2. Team Collaboration & Meeting Management

Purpose of Processing
To enable team collaboration, meeting scheduling, note-taking, and follow-up management.
Legal Basis
Contract (GDPR Article 6(1)(b)) - Processing is necessary to provide the contracted services.
Categories of Data Subjects
  • Team members
  • Collaborators (people a user works with but does not manage)
  • Meeting participants
  • Team administrators
Categories of Personal Data
  • Team data: team name, member roles, permissions
  • Meeting data: titles, dates, agendas, attendees
  • Notes and content: meeting notes, decisions, action items
  • Follow-ups: tasks, assignments, due dates
  • Feedback: survey responses, sentiment analysis
Recipients
  • Internal: Application servers, database
  • External: Backblaze (B2 Cloud Storage), for off-site database backups only. Otherwise shared only within authorized team members
International Data Transfers
Data stored in US data centers with appropriate security measures.
Retention Period
Active teams: Retained while team exists. Meeting data: Retained until account deletion or user-initiated deletion.
Security Measures
  • Role-based access controls (RBAC)
  • Team-level data isolation
  • Audit logging of data access
  • Encrypted data transmission
  • Off-site database backups (Backblaze B2), encrypted on our server before upload

3. AI-Powered Features (Ask Emily, Content Generation)

Purpose of Processing
To provide AI-powered assistance including mentor conversations, meeting content generation, and intelligent suggestions.
Legal Basis
Split basis; consent is not the legal basis for AI processing. (1) The account holder's own data (their account, the notes they write and the requests they make): performance of a contract (GDPR Article 6(1)(b)), limited to the processing genuinely necessary to provide the AI feature the user asks for. (2) Data about other people (team members a manager writes about, meeting attendees, and calendar content imported about others): legitimate interests (GDPR Article 6(1)(f)). The interest is helping the manager prepare for and follow up on conversations with their team, and it applies only where it is not overridden by the interests and rights of the people concerned. Separately, a user can refuse or withdraw AI processing for their account as a privacy control; it is not the legal basis (see Privacy Policy Section 8).
Categories of Data Subjects
  • Users of AI features (the account holder)
  • Team members, collaborators and other people the user records: people named in notes, meeting attendees, and people in imported calendar events
Categories of Personal Data
  • Chat messages: user questions, Ask Emily responses
  • Context data sent to OpenAI, per feature as listed in the Privacy Policy (Section 8, "Which features send your data to OpenAI"): team roster details, note text or excerpts, meeting titles, descriptions, agendas, outcomes, schedule and attendee names (including meetings imported from a connected Google or Microsoft calendar), commitment titles, Introduction Form answers, and photos taken with Snap-to-Notes
  • Usage data: feature usage, AI model interactions
  • Generated content: AI-created meeting prep, summaries, reports and pattern observations
Recipients
  • Internal: Application servers, AI service layer
  • External: OpenAI (Data Processing Agreement in place)
International Data Transfers
Data sent to OpenAI (US) for processing under a Data Processing Agreement. Consistent with our understanding of OpenAI's standard API terms, data submitted through their API is not used to train their models unless an organization opts in to share it; OpenAI's own account-level retention settings are outside what LetEmily's application code can independently verify.
Retention Period
Ask Emily conversations: permanently deleted 60 days after you delete them. AI cache: 30 days. AI usage metering (feature, model and token counts, never message content): 180 days, then permanently deleted; removed or de-identified sooner if you delete your account.
Security Measures
  • Data Processing Agreement with OpenAI
  • Encrypted API communications
  • AI processing switched off for an account whose user has refused or withdrawn it
  • Meeting locations, video-call links, meeting IDs, passcodes and dial-in numbers removed from meeting details in Ask Emily, Meeting Prep, the Morning Report and Insights Over Time
  • Usage metering records feature, model and token counts, never prompt or response content

4. Payment Processing & Subscription Management

Purpose of Processing
To process payments, manage subscriptions, and handle billing for paid plans.
Legal Basis
Contract (GDPR Article 6(1)(b)) & Legal Obligation (GDPR Article 6(1)(c)) - Required for service delivery and tax compliance.
Categories of Data Subjects
  • Paying customers
  • Subscription holders
Categories of Personal Data
  • Payment data: credit card details (tokenized), billing address
  • Transaction data: payment amounts, dates, invoice numbers
  • Subscription data: plan type, billing cycle, status
Recipients
  • Internal: Billing system, application database
  • External: Stripe (payment processor, PCI-DSS compliant)
International Data Transfers
Payment data processed by Stripe (US/EU) with Data Processing Agreement and PCI-DSS Level 1 certification.
Retention Period
Active subscriptions: Retained while subscription active. Cancelled subscriptions: 7 years (legal requirement for tax/accounting).
Security Measures
  • Stripe tokenization (no card details stored)
  • PCI-DSS Level 1 compliance via Stripe
  • Data Processing Agreement with Stripe
  • Encrypted communication with payment gateway
  • Regular security audits

5. Third-Party Integrations (Google, Microsoft, Slack, Zoom)

Purpose of Processing
To enable calendar synchronization, file storage, communication platform integrations, and video conferencing.
Legal Basis
Consent (GDPR Article 6(1)(a)) - Users explicitly authorize integrations via OAuth consent flow.
Categories of Data Subjects
  • Users who connect third-party integrations
Categories of Personal Data
  • OAuth tokens: access tokens, refresh tokens (encrypted)
  • Calendar data: event titles, descriptions, times, and attendee names — read to import your meetings, and written when LetEmily creates or updates a meeting invite or generates a video-conferencing link on your behalf
  • People suggestions: for attendees of small imported meetings (eight people or fewer) who are not yet among the user's people, their name and email address (encrypted at rest), a keyed hash of the address, and how many meetings they were in — kept only to suggest adding someone the user meets with regularly, never to create a person automatically; deleted 60 days after they were last seen in a meeting, and reduced to the hash alone if the user dismisses the suggestion
  • File exports: for Google Drive and Microsoft OneDrive, at your request LetEmily can export a copy of a note, meeting summary, or commitment as a new file into a folder it creates in your connected account. This is a one-way export of your own LetEmily content; LetEmily’s features do not read or sync files already in your Drive or OneDrive. For OneDrive, you can also browse and download the files in LetEmily’s own folder from within LetEmily; Google Drive exports do not currently support browsing back from LetEmily. Google’s drive.file permission only reaches files LetEmily created; for OneDrive, LetEmily asks Microsoft only for Files.ReadWrite.AppFolder, which reaches LetEmily’s own app folder (shown in your OneDrive as Apps/LetEmily) and not the rest of your OneDrive. A Microsoft account connected before this change keeps the broader Files.ReadWrite permission it granted then, which covers the whole OneDrive, until it is reconnected
  • Integration logs: operational metadata only (provider, action, status, error codes and timing), never the content of your meetings, notes, messages or files
Recipients
  • Internal: Integration service, encrypted database
  • External: Google Workspace, Microsoft 365, Slack, Zoom (as authorized by user)
International Data Transfers
Data exchanged with Google (US), Microsoft (US), Slack (US), Zoom (US) via their respective OAuth APIs with user consent.
Retention Period
Active integrations: Retained while connection active. Disconnecting Google: LetEmily attempts to revoke authorization with Google; regardless of whether that attempt succeeds, the stored access and refresh tokens are deleted from our database immediately. Disconnecting Microsoft 365 or Slack: the connection is deactivated so it can no longer be used to access your account. Integration logs: 90 days, then permanently deleted.
Security Measures
  • OAuth 2.0 authorization flow
  • Token encryption with libsodium (XSalsa20-Poly1305)
  • Google Drive access limited to files LetEmily itself creates (drive.file), not your full Drive. Microsoft OneDrive access limited to LetEmily's own app folder (Files.ReadWrite.AppFolder), not your full OneDrive; a Microsoft account connected before this change keeps its earlier Files.ReadWrite permission until reconnected
  • Google: tokens deleted immediately upon disconnection
  • Integration audit logging

6. Marketing Communications & Email Campaigns

Purpose of Processing
To send product updates, feature announcements, and promotional content to users who have consented.
Legal Basis
Consent (GDPR Article 6(1)(a)) - Users opt in through the marketing checkbox at sign-up, the consent settings, or the early access signup.
Categories of Data Subjects
  • Users who have consented to marketing emails
  • Early access signup users
Categories of Personal Data
  • Contact data: email address, name
  • Preference data: communication preferences, opt-in status
  • Engagement data: email opens, clicks (anonymized after 90 days)
Recipients
  • Internal: Marketing system, email service
  • External: Email service provider (if applicable)
International Data Transfers
Data stored in US data centers. Email service provider may process data in US.
Retention Period
Active consent: Retained while consent valid. Withdrawn consent: Email deleted immediately, logs anonymized after 90 days.
Security Measures
  • Consent tracking with timestamps
  • Easy unsubscribe in all emails
  • IP address anonymization after 90 days
  • Encrypted data storage
  • Regular consent audit

7. Security Monitoring & Fraud Prevention

Purpose of Processing
To detect and prevent unauthorized access, abuse, DDoS attacks, and fraudulent activities.
Legal Basis
Legitimate Interest (GDPR Article 6(1)(f)) - Necessary to protect the security of our systems and users' data.
Categories of Data Subjects
  • All users and visitors
  • Potential attackers or abusers
Categories of Personal Data
  • Security logs: login attempts, failed authentication, IP addresses
  • Rate limiting data: request counts, IP addresses
  • Security incidents: breach reports, investigation notes
  • Audit logs: data access, admin actions, system events
Recipients
  • Internal: Security team, system administrators
  • External: None (unless required by law enforcement)
International Data Transfers
Data stored in US data centers with strict access controls.
Retention Period
Login attempts: 90 days. Rate limits: 90 days. Security event records: 180 days from when each was written, then permanently deleted. When an account is deleted, its security event records are kept for the rest of that period reduced to the event type, risk level, date and time, a shortened IP address (last IPv4 octet, or everything after the /48 IPv6 prefix, removed) and the browser family; the account link, description, request details, full IP address and full user agent are removed. Audit logs: 365 days.
Security Measures
  • Real-time monitoring and alerting
  • Automated threat detection
  • Security event records minimised at account deletion and deleted after 180 days
  • Access restricted to security personnel
  • Encrypted logs and secure storage

8. GDPR Compliance & User Rights Management

Purpose of Processing
To fulfill GDPR obligations including consent management, data export, account deletion, and audit logging.
Legal Basis
Legal Obligation (GDPR Article 6(1)(c)) - Required by GDPR Articles 15-22 and Article 30.
Categories of Data Subjects
  • All users exercising GDPR rights
  • Users viewing privacy information
Categories of Personal Data
  • Consent records: consent type, granted/withdrawn dates, IP address
  • Audit logs: data access, exports, deletions, admin actions
  • Account deletion record: date and time, internal account reference number, and the IP address and browser user agent of the deletion request; kept 365 days as a security and legal accountability record of the deletion, together with the account's earlier export and consent entries
  • Cookie consent: preferences, timestamps, session IDs
  • Data requests: export requests, deletion requests
Recipients
  • Internal: Compliance system, audit database
  • External: Supervisory authorities (if breach notification required)
International Data Transfers
Data stored in US data centers. Breach notifications to EU supervisory authorities as required by Article 33.
Retention Period
Consent records: 13 months after expiration. Audit logs: 365 days. Cookie consent: 13 months. Breach records: 5 years (legal requirement).
Security Measures
  • Audit log entries cannot be edited through the application
  • Access controls on compliance data
  • 72-hour breach notification tracking
  • Regular compliance audits

9. Website and App Usage Analytics and Signup Attribution (Google Analytics 4 and LetEmily)

Purpose of Processing
To understand which pages and features are used, so the service can be improved, and to measure in aggregate how people discover LetEmily and which acquisition channels lead to account creation and initial product use (acquisition and activation measurement).
Legal Basis
Consent (GDPR Article 6(1)(a)) - The analytics tag is not loaded, and no signup attribution is recorded, until the visitor accepts analytics cookies in the cookie banner. Accepting the Terms or the Privacy Policy is not analytics consent.
Categories of Data Subjects
  • Visitors and users who accept analytics cookies
Categories of Personal Data
  • Page views: page address and title with record identifiers and sign-in tokens removed, referrer, and campaign (utm) parameters
  • Named feature events with an allowlisted set of parameters, including an aggregate sign-up event (sign-up method and a broad acquisition channel only)
  • Aggregate signup and activation counts by channel, computed inside LetEmily from the attribution record and the existing first-person-added activation event
  • Browser and device information and the _ga / _ga_<ID> cookie identifiers set by Google
  • First-party signup attribution record (stored by LetEmily, linked to the account): normalized source, medium and campaign, landing pathname, referring hostname, timestamps, and the version and date of the analytics consent
Recipients
  • Internal: authorized LetEmily administrators (the signup attribution record)
  • External: Google LLC (Google Analytics 4), which receives only consented aggregate GA4 events and never the LetEmily attribution record
International Data Transfers
Processed by Google (US). Advertising features, Google signals and ad personalisation are switched off. Google receives no name, email address, company, LetEmily account ID, customer content, or hashed version of those values. The signup attribution record stays in LetEmily's own database.
Retention Period
The _ga and _ga_<ID> cookies last 13 months in the browser and are deleted when analytics consent is refused or withdrawn. Event data is kept for the retention period set in the Google Analytics property. The signup attribution record is kept 13 months from signup, and deleted earlier when the account is deleted or analytics consent is withdrawn while signed in.
Security Measures
  • Tag loaded only after consent; stopped immediately when consent is withdrawn
  • Page addresses and titles cleaned before they are sent
  • Advertising signals denied in every consent state
  • Signup attribution values allowlisted and normalized on the server; no full URL, query string or advertising click identifier is stored
  • Signup attribution readable only through the administrator-only API; deleted nightly after 13 months

International Data Transfers

LetEmily operates from the United States. Personal data from EU residents is transferred to and processed in the US. We implement appropriate safeguards in compliance with GDPR Chapter V:

  • Standard Contractual Clauses (SCCs) with third-party processors
  • Data Processing Agreements with all sub-processors
  • Technical and organizational security measures
  • Regular security audits and assessments
  • User rights enforcement mechanisms

Contact & Data Protection

For questions about this record of processing activities or to exercise your GDPR rights: