Last updated 19 July 2026. Nasty Letters Ltd ("we", "us") is the data controller for the personal data described below, in line with UK GDPR and the Data Protection Act 2018.
We use your data to operate your case (drafting and sending challenges on your behalf), to process your payments, to respond to support enquiries, and to meet our own legal and accounting obligations. We do not sell your personal data, and we do not use it for third-party advertising.
When you use the free letter scan, the photo of your letter is sent to Anthropic, an AI provider based in the United States, whose service reads the letter and pulls out the key details: what kind of letter it is, who sent it, how much they want and any deadline. That transfer is covered by Anthropic's UK GDPR data processing terms. The photo is used only for that reading. We do not save it, and under Anthropic's commercial terms it is not used to train AI models.
The scan is an automated first read, not an automated decision about you. A case manager reviews every case before we act, and nothing is charged or filed on the strength of the scan alone.
When you file a case, the details you give us and the documents you upload are also analysed by AI to prepare a briefing for the case manager who reviews your case. The AI reads your case; decisions about it are made by people.
We share the minimum necessary data with: Stripe (payment processing), our email delivery provider (transactional emails such as password resets), Anthropic (the letter scan and case brief analysis described above: AI prepares, a person decides), and, only with your case's context and where relevant to resolving your dispute, the organisation you are disputing with (e.g. a parking operator or local authority), as part of preparing and submitting your challenge.
We use one essential session cookie to keep you signed in securely. It is not used for tracking or advertising, and it expires automatically after a period of inactivity. We do not use third-party advertising or analytics cookies.
We keep case data while your account is active and for a reasonable period afterwards to meet our legal, accounting and dispute-resolution obligations. Payment records are kept for as long as tax and accounting law requires, even if you delete your account. You can request earlier deletion of everything else at any time. See your rights below.
Under UK GDPR, you have the right to:
You can download a copy of your data and delete your account yourself from the Account page when signed in. For anything else, or if you cannot sign in, email enquiries@nastyletters.co.uk.
Documents are stored outside the public web root and served only through an authenticated download endpoint. All traffic is encrypted with TLS/HTTPS, and passwords are never stored in plain text.