Pennaway
Write my letter

Privacy Policy

Last updated: 27 October 2026

This policy explains which personal data Pennaway processes, why, for how long and what rights you have. We collect as little as possible.

1.Who is responsible

  1. 1.1The controller under the General Data Protection Regulation (GDPR) is the provider named in the legal notice (Impressum): Emil Nurullaiev, Glattbacher Str. 34, 63741 Aschaffenburg, Deutschland.
  2. 1.2You can reach us at hello@pennaway.com. We have not appointed a data protection officer, as we are not legally required to.

2.Account and sign-in

  1. 2.1When you create an account, we process your email address and, if you use one, your password (stored only in encrypted form). If you sign in with Google, we receive your name and email address from Google.
  2. 2.2In your profile you can also add a name and a nickname. We use the name to sign your letters (letter header and PDF); the nickname is shown only on letters you share with a link.
  3. 2.3You can also upload a profile photo or pick a color for the circle with your initial. Before uploading, your browser reduces the photo to a small square image; we store only this image, in our database provider's storage in the EU. Like your nickname, the photo (or the color of your initial) is part of your public profile: it is shown wherever Pennaway shows you as the author — currently on letters you share with a link. You can remove it at any time.
  4. 2.4If you change your email address, we send a confirmation code to both the old and the new address and, after the change, a notice to the old address. If you signed in with Google, you can also set a password; we then note in your account that it has one.
  5. 2.5We keep notifications in your account (for example, when Pennaway credits letters to you). They are deleted together with your account.
  6. 2.6We use this data to provide your account and to send you emails required for it, such as sign-in codes and codes for changing your password or email address.
  7. 2.7Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

3.Writing letters

  1. 3.1To write a letter, we process what you enter: the university, program and country, your notes on experience, motivation and goals, your answers to follow-up questions, your About Me profile and — if you upload one — the content of your CV.
  2. 3.2This content is sent to our AI provider Anthropic, which generates and proofreads the letter. A CV file is only read to fill in the form; the file itself is not stored.
  3. 3.3Letter checker: if you paste a letter into the free checker, the text, the country and — if you enter them — the university and program are sent to Anthropic for the review. We do not save the letter or the review. To apply the daily limit, we keep only a one-way fingerprint of your IP address (or of your account ID if you are logged in) for up to 2 days.
  4. 3.4If you have an account, your letters are saved together with the notes they were based on, so you can open, edit and adapt them later.
  5. 3.5Please do not enter sensitive data that is not needed for your letter, for example about health or religion. If you choose to include such information in your letter, we process it only to write the letter (Art. 9(2)(a) GDPR).
  6. 3.6Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

4.Letters without an account

  1. 4.1If you write a letter without an account, we keep it for up to 24 hours so that you can save it by signing in. After that it is deleted automatically.
  2. 4.2To prevent abuse of the free letter, we store a one-way fingerprint (hash) of your IP address — not the address itself — for up to 2 days.
  3. 4.3Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

5.Limits and abuse prevention

  1. 5.1We record the time of each generation and CV upload to enforce daily limits and to protect the service against automated abuse.
  2. 5.2As soon as you use your free letter, we store a one-way fingerprint of your email address (not the address itself) and keep it even if you change the address or delete your account, so that the free letter cannot be claimed again with the same address.
  3. 5.3Legal basis: our legitimate interest in a secure, fairly usable service (Art. 6(1)(f) GDPR).

6.Payments

  1. 6.1Payments are processed by Stripe. Stripe receives your payment details directly; we only receive the confirmation that you paid, the package and the amount.
  2. 6.2We keep your credit balance and purchase history to provide the credits and for tax purposes.
  3. 6.3Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and legal obligations under tax law (Art. 6(1)(c) GDPR).

7.Withdrawals

  1. 7.1If you withdraw from a purchase using the form on our website, we store your name, email address, the purchase you name, the page language and the time of receipt, and we send you a confirmation of receipt by email.
  2. 7.2Legal basis: our legal obligations regarding withdrawal (Art. 6(1)(c) GDPR). We keep these records for 3 years as proof of receipt.

8.Reviews

  1. 8.1If you rate a letter, we store your rating, the reasons and comment you choose, and the country and language of the letter, to improve the service (Art. 6(1)(f) GDPR).
  2. 8.2Only if you tick the consent box do we show your review on pennaway.com, with your first name, the country you are applying to and, if you add it, your program (Art. 6(1)(a) GDPR).
  3. 8.3You can withdraw this consent at any time — untick the box under the letter or write to us — and we remove the review from the site. Withdrawal does not affect the lawfulness of the display until then.

9.Emails from Pennaway

  1. 9.1Only if you tick the box when you sign up, or turn on “Emails from Pennaway” in your profile, do we send you reminders about your letters and tips for your next application — at most 2 emails a month. Emails needed for your account, purchases and support requests are sent regardless.
  2. 9.2As proof of your consent, we store your email address at that moment, the exact wording you agreed to, its language, where you gave it (sign-up or profile) and the time.
  3. 9.3Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future — in your profile or via the unsubscribe link in every such email.

10.Sharing a letter

  1. 10.1You can create a read-only link to one of your letters. Anyone who has the link can read that letter — with your nickname from your profile (or your name, if you have no nickname) and your profile photo or the color of your initial — until you turn the link off or it expires after 30 days. Search engines are asked not to index these pages.
  2. 10.2For each link we store the letter it belongs to, its expiry date and how many times it was opened. We do not store any data about the people who open it.
  3. 10.3Legal basis: performance of the contract (Art. 6(1)(b) GDPR) — you ask us to show the letter to the people you send the link to.

11.Support requests

  1. 11.1If you write to us via the Support form in your account, we store your account, your email address, the topic, your message and — if you choose one — which letter or purchase it is about, together with the page language and the time.
  2. 11.2Your request and our replies are kept as a conversation in your account under Support, where you can also reply. We let you know about our replies in your account and by email, and you receive a confirmation with a copy of your message. Each request and reply also reaches our mailbox by email. To prevent abuse, we limit the number of requests and replies per day.
  3. 11.3Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering your request (Art. 6(1)(f) GDPR).

12.Usage statistics

  1. 12.1To see where the site is unclear, we record which steps are reached — opening the generator, creating an account, receiving a letter, viewing prices, paying, downloading or copying a letter — together with the site language, the website or campaign you came from and, if you are signed in, your account.
  2. 12.2The random visit number used for this exists only while the page is open. When you delete your account, these records are separated from it and kept only as anonymous figures.
  3. 12.3We also use Vercel Web Analytics, which counts page views without cookies and without identifying you. We only see aggregated figures such as page views, country and device type.
  4. 12.4Legal basis: our legitimate interest in understanding and improving the service (Art. 6(1)(f) GDPR).

13.Cookies and browser storage

  1. 13.1We do not use advertising or tracking cookies, so we do not show a cookie banner.
  2. 13.2Your browser stores only the following on your device: your sign-in session, so that you stay signed in; a letter you wrote without an account or before paying (up to 24 hours or until you save it), so that it is not lost when you sign in or pay; which items you ticked in a document checklist (until you clear them), so that your progress is kept; the section of the site you are on (until you close the tab), so that reloading does not send you back to the start.
  3. 13.3If you arrive via a link with a campaign label (for example from our TikTok profile), we keep this label — such as “tiktok” — only while the page is open and send it along with a sign-up or letter in the same visit, so that we know which channel works (legitimate interest, Art. 6(1)(f) GDPR). It is not stored on your device and contains no information about you.
  4. 13.4Legal basis: § 25(2) of the German TDDDG (storage strictly necessary for the service you requested). You can delete this data at any time in your browser settings.

14.Service providers

  1. 14.1Supabase — accounts, database and storage of profile photos; servers in the EU (Ireland).
  2. 14.2Vercel — hosting of the website and anonymous visit statistics.
  3. 14.3Anthropic — the AI model that writes and proofreads your letter. Under Anthropic's commercial terms, your content is not used to train its models.
  4. 14.4Stripe — payment processing.
  5. 14.5Resend — sending emails such as sign-in codes, confirmations of support requests and, if you agreed, reminders about your letters.
  6. 14.6Zoho — our mailbox, if you write to us by email; servers in the EU.
  7. 14.7Google — only if you sign in with Google.
  8. 14.8All providers process data on our behalf under data processing agreements or, where they act on their own responsibility (Stripe for payments, Google for sign-in), under their own privacy policies.
  9. 14.9Some providers are based in the USA. Transfers rely on the EU–U.S. Data Privacy Framework or on the EU standard contractual clauses.

15.How long we keep data

  1. 15.1Account data, letters and your profile: as long as your account exists. You can delete your account at any time in the account panel; this deletes your profile, profile photo, letters, balance, support requests and generation history.
  2. 15.2Letters without an account: up to 24 hours. Unpaid letters held for you: up to 7 days. IP fingerprints: up to 2 days.
  3. 15.3Payment records: as long as tax and commercial law requires (in Germany currently up to 10 years).
  4. 15.4Email fingerprint once the free letter has been used: kept — also after an email change or account deletion — so that the free letter cannot be claimed again.
  5. 15.5Withdrawals submitted via the form: 3 years.
  6. 15.6Consent to emails: the record of your consent — and of its withdrawal, if you turn the emails off — is kept as proof as long as your account exists.
  7. 15.7Support requests and replies: as long as your account exists, unless you ask us to delete them earlier.
  8. 15.8Emails you send us: as long as needed to answer them and for related follow-up questions.

16.Your rights

  1. 16.1You have the right to access, rectification, erasure, restriction of processing and data portability (Art. 15–20 GDPR).
  2. 16.2With an account, you can download a copy of your data yourself at any time: Profile → Your data → Download my data (a JSON file).
  3. 16.3Right to object: where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation (Art. 21 GDPR).
  4. 16.4Where processing is based on your consent, you can withdraw it at any time with effect for the future.
  5. 16.5You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.
  6. 16.6To exercise your rights, write to hello@pennaway.com.

17.Other information

  1. 17.1We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). The AI only writes a draft for you.
  2. 17.2You are not obliged to provide data. Without an email address, however, we cannot create an account, and without your notes we cannot write a letter.
  3. 17.3We may update this policy when our service changes. The current version is always available on this page.

Questions? Reach us at hello@pennaway.com