ENCHANTED LETTERS CO.

Privacy Policy

Last updated: August 2, 2026

A Note Before You Read

At Enchanted Letters Co., we believe that trust is the foundation of everything. You are sharing your name, your address, and pieces of your inner world with us, and we do not take that lightly. This Privacy Policy explains exactly what information we collect, why we collect it, how we use it, and how we keep it safe.

We have written this in plain language because we believe you deserve to understand it fully. If you have any questions at all, please reach out to us at enchantedlettersco@gmail.com. We are always happy to talk.

1. Who We Are

Enchanted Letters Co. is a pen pal membership society operated by Sarah Hennessey, based in Victoria, British Columbia, Canada.

Contact details:
Sarah Hennessey
Enchanted Letters Co.
Victoria, BC, Canada
enchantedlettersco@gmail.com
www.enchantedlettersco.com

For the purposes of UK and EU data protection law, Enchanted Letters Co. acts as the Data Controller in respect of your personal data.

2. What Information We Collect

We collect the following categories of personal information:

2.1 Information you provide directly

  • Your full name and preferred name

  • Your email address

  • Your postal address (collected solely for the purpose of dispatching gifts, stationery kits, and milestone gifts — it is never shared with other members)

  • Your age and date of birth

  • Your country and city of residence

  • Your social media profile link (for identity verification purposes only)

  • Your application responses, including your reasons for joining and your correspondence preferences

  • Your welcome questionnaire responses, including your interests, aesthetic preferences, and letter-writing style

  • Any optional information you choose to share, such as your neurodivergent identity or 2SLGBTQ+ identity, etc.

2.2 Information collected automatically

When you visit our website, we may collect certain technical information automatically, including:

  • Your IP address

  • Browser type and version

  • Pages visited and time spent on the site

  • Referring website or source

This information is collected through cookies and similar technologies. Please see Section 8 for more information on cookies.

2.3 Information collected through third-party tools

We use a small number of third-party tools to operate the Society — including our payment processor, contract signing platform (Dropbox Sign), and Facebook for our digital membership hub. These tools may collect additional information in accordance with their own privacy policies. We will always let you know which tools we use and link to their policies where relevant.

3. Why We Collect Your Information & How We Use It

We collect and use your personal information for the following purposes:

3.1 To process your membership application
We use your name, email address, age, location, social media profile, and application responses to assess your application and determine whether membership in the Society is a good fit for you and for us.

3.2 To fulfill your membership
We use your name, email address, questionnaire responses, and aesthetic preferences to match you with a pen pal, send you your welcome pack, and deliver the ongoing benefits of your chosen membership tier.

3.3 To dispatch physical gifts and stationery
We use your postal address solely to send your enrolment gift, quarterly stationery kits (Enchanted Realm members), and milestone and referral gifts (Enchanted Realm members). Your address is never shared with your pen pal or any other member.

3.4 To communicate with you
We use your email address to send you membership correspondence, including your acceptance email, match introduction, seasonal prompts, Substack newsletter, and any important updates about the Society.

3.5 To keep the Society safe
We use the information provided in your application and questionnaire to uphold the safety and integrity of the Society and its members.

3.6 To comply with legal obligations
We may process your information where necessary to comply with applicable laws and regulations.

4. The Legal Basis for Processing Your Data

(This section applies specifically to members in the United Kingdom and European Union.)

We process your personal data on the following legal bases under UK GDPR and EU GDPR:

  • Contractual necessity — processing your name, email, postal address, and membership information is necessary to fulfil our membership agreement with you.

  • Legitimate interests — processing your questionnaire responses and correspondence preferences is in our legitimate interest of providing you with an accurate and meaningful pen pal match.

  • Consent — where you have voluntarily provided special category data, such as information about your neurodivergent identity or 2SLGBTQ+ identity, we process this on the basis of your explicit consent. You may withdraw this consent at any time by contacting us at enchantedlettersco@gmail.com, without affecting the validity of your membership.

  • Legal obligation — we may process your data where required to comply with a legal obligation.

5. How We Store & Protect Your Information

We take the security of your personal information seriously. Your data is stored securely using Google Workspace tools and is accessible only to Sarah Hennessey as the sole operator of the Society.

We do not store your payment card details. All payment processing is handled securely by Stripe, which operates in accordance with PCI DSS security standards.

Physical documents containing personal information — such as signed contracts — are stored securely and in accordance with applicable data protection law.

In the unlikely event of a data breach that affects your personal information, we will notify you as required by applicable law and take all necessary steps to contain and address the breach promptly.

6. How Long We Keep Your Information

We retain your personal information for as long as your membership is active and for a period of 12 months following the end of your membership (in case you would like to return in that timeframe), after which your data will be securely deleted or anonymized.

The following exceptions apply:

  • Financial records — records of payments made are retained for 7 years in accordance with Canadian tax law and applicable accounting regulations.

  • Signed contracts — retained for 6 years following the end of membership in accordance with standard contractual limitation periods.

  • Special category data — information about neurodivergent identity or 2SLGBTQ+ identity is deleted promptly upon the end of membership, or earlier upon request.

You may request earlier deletion of your data at any time. See Section 7 for details.

7. Your Rights

Depending on where you are located, you may have some or all of the following rights in relation to your personal data:

7.1 The right to access
You may request a copy of the personal data we hold about you at any time. We will provide this within 30 days of your request.

7.2 The right to rectification
If any of the information we hold about you is inaccurate or incomplete, you may ask us to correct it.

7.3 The right to erasure
You may ask us to delete your personal data. We will honour this request where we are not legally required to retain the information.

7.4 The right to restrict processing
You may ask us to limit how we use your personal data in certain circumstances — for example, while a concern or dispute is being resolved.

7.5 The right to data portability
You may request that we provide your personal data to you in a structured, commonly used, and machine-readable format.

7.6 The right to object
You may object to our processing of your personal data where it is based on legitimate interests. We will consider your objection and respond within 30 days.

7.7 Rights related to automated decision-making
Enchanted Letters Co. does not use automated decision-making or profiling. All membership decisions are made personally by Sarah Hennessey.

7.8 The right to withdraw consent
Where processing is based on your consent — such as the processing of special category data — you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us in writing at enchantedlettersco@gmail.com. We will respond to all requests within 30 days.

8. Cookies

Our website uses cookies — small text files placed on your device — to help the site function properly and to understand how visitors use it.

The cookies we use may include:

  • Essential cookies — necessary for the website to function. These cannot be disabled.

  • Analytics cookies — help us understand how visitors interact with the site so we can improve it. (e.g. Google Analytics)

  • Third-party cookies — placed by tools such as our email marketing platform or payment processor.

You can control and manage cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of the website.

If you are visiting from the UK or EU, you will be asked to give your consent to non-essential cookies when you first visit the site, in accordance with UK GDPR and the Privacy and Electronic Communications Regulations (PECR).

9. Third Parties

We use a small number of trusted third-party tools and services to operate Enchanted Letters Co. These include:

  • Payment processing — Stripe

  • Contract signing — Dropbox Sign

  • Email marketing — Squarespace/FloDesk

  • Website hosting — Squarespace

  • File storage — Google Drive

  • Form collection — Google Forms

Each of these third parties processes your data in accordance with their own privacy policies. We encourage you to review those policies. We choose our third-party providers carefully and strategically to best meet our needs.

We do not sell your personal data to any third party. We do not share your personal data with advertisers, data brokers, or any commercial third party for marketing purposes.

10. International Data Transfers

Enchanted Letters Co. is based in Victoria, British Columbia, Canada. Canada is recognized by the European Commission as providing an adequate level of data protection for the purposes of EU GDPR.

Some of our third-party tools may process data in countries outside Canada, the UK, or the EU. Where this is the case, we ensure that appropriate safeguards are in place — such as Standard Contractual Clauses — to protect your data in accordance with applicable law.

11. Children's Privacy

Enchanted Letters Co. is intended for adults aged 18 and over. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that we have inadvertently collected information from a person under 18, we will delete it promptly. If you believe a person under 18 has provided us with their personal information, please contact us at enchantedlettersco@gmail.com.

We may include a children’s membership in the future with strict parental controls.

12. Links to Other Websites

Our website and Substack may contain links to third-party websites — such as stationery shops, book recommendations, or other resources we love. We are not responsible for the privacy practices of those websites and encourage you to read their privacy policies before providing any personal information.

13. Your Right to Complain

UK Members
If you are located in the United Kingdom and believe we have not handled your personal data in accordance with UK GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk
Telephone: 0303 123 1113
Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

EU Members
If you are located in the European Union, you have the right to lodge a complaint with the data protection supervisory authority in your country of residence.

Canadian Members
If you are located in Canada and have a concern about how your personal data has been handled, you may contact the Office of the Privacy Commissioner of Canada:

Website: priv.gc.ca
Telephone: 1-800-282-1376

We would always appreciate the opportunity to address your concern directly before you contact a supervisory authority, so please do reach out to us first at [email address].

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the way we operate or in applicable law. When we do, we will update the "last updated" date at the top of this page and notify active members by email if the changes are material.

We encourage you to review this policy periodically. Continued use of the Society's services following notification of any changes constitutes your acceptance of the updated policy.

15. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please don't hesitate to get in touch.

Sarah Hennessey
Founder, Enchanted Letters Co.
Victoria, BC, Canada
enchantedlettersco@gmail.com
www.enchantedlettersco.com

We will always do our best to respond within 5 business days.

Write slowly. Connect deeply. Live enchanted. ✦

© 2026 Enchanted Letters Co. All rights reserved.