Privacy policy

Last updated: 12 November 2026

Who we are

Dear Sender is run by Waha Labs Ltd, a company registered in England and Wales (number 17558919), at 128 City Road, London, United Kingdom, EC1V 2NX. We decide how your personal data is used, which makes us its controller under UK data protection law. To contact us about privacy, email support@dearsender.com.

What Dear Sender does

You photograph a letter you don’t want, and we contact the company or person who sent it for you. For junk mail, we ask them to stop sending you marketing and to delete the details they use for it. For post sent to someone who doesn’t live with you, we ask them to correct their records.

What we collect

• Your mobile number, to create your account and sign you in with a text message code.
• Your name and postal address, so a sender can find the record they hold about you.
• Your authorisation: when you agreed to let Dear Sender contact senders for you, and the wording you agreed to.
• Photos of post you send us (an envelope, or the cover of a catalogue or leaflet), and what we read from them: who sent the letter, who it was addressed to and at what address, and any reference numbers on it. Your phone reads the printed text on each photo before sending it, and that text comes to us with the photos.
• A forwarding address, only if you add one for someone who has moved away and confirm they asked you to pass it on.
• Emails between us and senders about your letters, including their replies.
• An ID for your phone, only if you turn on notifications, so we can let you know when a letter is sent, answered or done. Notifications don’t name the sender or include anything from the letter.

We don’t collect your location. Photos are converted on your phone before upload, which removes their location data.

Other people’s details

Letters for someone who doesn’t live with you show that person’s name, and you may give us their new address. We use these only to tell the sender to update their records, which also helps that person get their post. We don’t use them for anything else.

How we use your data, and why we’re allowed to

• To provide the service you ask for: running your account, reading your letters and contacting senders for you. The legal basis is our contract with you.
• To tell senders about post for someone who doesn’t live with you. The legal basis is our legitimate interest, and theirs, in stopping misdirected post and keeping records accurate.
• To keep a record of what we sent and when, so we can show a sender what you asked for and follow it up. The legal basis is our legitimate interests.

Who we share it with

• The senders of letters you send us. For junk mail, we share your address and any references on the letter. If the letter was addressed to you by name, we use your name exactly as it was printed. If it was addressed to someone else, or to “The Occupier”, we write on behalf of “the current occupier” and don’t give your name. If it had no name or address on it at all, we still give the sender your address, so they can stop delivering there, but not your name. For wrong-address and moved-out letters, we share your address and the addressee’s details, but not your name. If a sender asks for proof that their letter arrived, we may send them a photo of its envelope, usually cropped to the address.
• Service providers who work for us, only to run Dear Sender and only on our instructions:
  • Supabase: database, file storage and sign-in. Data is stored in London.
  • Twilio: sign-in codes.
  • Resend: sending emails to senders and receiving their replies.
  • OpenRouter and Anthropic: reading photos of your post with AI.
  • Google (Firebase Cloud Messaging), and Apple for iPhones: delivering notifications.
• Some of these providers are based in the United States. Where your data leaves the UK, we rely on the UK–US data bridge for providers certified under it, and otherwise on standard contractual clauses approved for use in the UK (the International Data Transfer Addendum).

We never sell your data or use it for advertising.

Reading your post with AI

An AI model may read your photos to work out who sent the post. A member of our team checks every letter before anything is sent. OpenRouter passes the photos to Anthropic’s Claude AI, and neither company uses them to train AI models. OpenRouter doesn’t keep the photos once it has passed them on, and Anthropic deletes them within 30 days, unless either needs them for longer to deal with misuse of its service or to meet a legal requirement.

How long we keep it

• Photos of your post, and the text read from them, are deleted automatically 90 days after a letter is done or rejected.
• Your account details, letters and the emails about them are kept until you delete your account. We don’t delete accounts that haven’t been used for a while, so your history is there when you come back.
• Your phone’s notification ID is deleted when you sign out, delete your account or remove the app.
• Emails already sent to senders stay with those senders, under their own privacy policies.

Your rights

You can ask to see, correct, delete or move your data. You can also ask us to restrict or stop using it. You can delete your account at any time in the app: Profile, then Delete account. That deletes your account, your letters and their photos straight away.

If you’re unhappy with how we’ve handled your data, please tell us. You can also complain to the Information Commissioner’s Office (ico.org.uk).

Security

Your data is encrypted in transit. Only you and the Dear Sender team can see your letters, and our team must use two-factor authentication to do so.

Children

Dear Sender is for adults aged 18 or over.

Changes

If we change this policy, we’ll tell you in the app. If we change what you’ve authorised Dear Sender to do, we’ll ask you to agree again.