Privacy Policy

Effective February 27, 2026

1. Introduction

Lettersheets ("we", "us", or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, store, and disclose information when you use our human resources management platform ("Service").

By using the Service, you consent to the data practices described in this policy. If you do not agree with this policy, please do not use the Service.

2. Information We Collect

We collect the following types of information:

2.1 Information You Provide

• Account Information: Name, email address, username, and password when you register for an account
• Company Information: Company name, industry, country, city, state/province, and postal code
• Employee Data: Information entered into the platform about employees, including names, positions, attendance records, and payroll details
• Payment Information: Billing details and payment method information for paid subscriptions, processed through secure third-party payment processors

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, timestamps, and interaction patterns
• Device Information: Browser type, operating system, device type, and screen resolution
• Log Data: IP addresses, access times, referring URLs, and error logs
• Cookies: Session cookies and authentication tokens necessary for the operation of the Service

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Authenticate your identity and manage your account
• Process transactions and send related billing information
• Respond to your inquiries, comments, or support requests
• Monitor and analyze usage patterns to improve the Service
• Detect, prevent, and address security issues, fraud, or technical problems
• Send service-related notifications, updates, and administrative messages
• Comply with legal obligations and enforce our Terms of Service

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

4. End-to-End Encryption and Post-Quantum Cryptography

Lettersheets employs post-quantum cryptography (PQC) using NIST-standardized algorithms — including ML-KEM (Module-Lattice Key Encapsulation) for key exchange and ML-DSA (Module-Lattice Digital Signature) for authentication — to protect sensitive company and employee data against both current and future quantum computing threats.

Sensitive database columns — such as employee personal information, payroll records, and confidential company data — are encrypted entirely on the client side before transmission. Our servers store only ciphertext for these fields and have no ability to read, decrypt, or access the plaintext contents. Encryption keys are derived from your password using industry-standard key derivation functions (PBKDF2-SHA256) on the client and are never transmitted to or stored on our servers.

This zero-knowledge architecture means that only authenticated users with valid credentials or recovery keys can decrypt and view protected information. Even in the unlikely event of a server breach, encrypted column data remains unreadable. As a consequence of this security model, we cannot assist in recovering data if you lose both your password and recovery key file.

5. Data Storage and Security

We implement appropriate technical and organizational measures to protect your data, including:

• Post-quantum cryptography (ML-KEM, ML-DSA) for key exchange and digital signatures, resistant to both classical and quantum attacks
• Client-side column-level encryption for sensitive fields — our servers store only ciphertext and cannot read the underlying data
• TLS/SSL encryption for all data transmitted between your browser and our servers
• Secure password hashing using bcrypt with appropriate salt rounds
• Zero-knowledge architecture where decryption occurs exclusively on the client
• Regular security audits and vulnerability assessments
• Access controls limiting employee access to personal data on a need-to-know basis
• Secure cloud infrastructure with redundant backups

While we strive to protect your information, no method of electronic transmission or storage is 100% secure.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Upon account termination, we will delete or anonymize your data within 90 days, except where retention is required by law.

Encrypted data that cannot be decrypted without your keys will be permanently deleted in accordance with our retention schedule.

7. Sharing of Information

We may share your information in the following circumstances:

• Service Providers: Third-party vendors who assist us in operating the Service, subject to confidentiality obligations
• Legal Requirements: When required by law, regulation, legal process, or governmental request
• Protection of Rights: To protect the rights, property, or safety of Lettersheets, our users, or the public
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you explicitly authorize us to share your information

We do not share your encrypted data with any third party, as we do not possess the ability to decrypt it.

8. Cookies and Tracking

We use strictly necessary cookies to operate the Service, including session authentication tokens and security cookies. We do not use advertising or third-party tracking cookies.

9. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data
• Portability: Request a copy of your data in a structured, machine-readable format
• Objection: Object to certain processing of your data
• Restriction: Request restriction of processing in certain circumstances

To exercise any of these rights, please contact us at privacy@lettersheets.com.

10. Data Protection for Philippine Users

Lettersheets complies with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173). Philippine users have additional rights including the right to be informed, the right to object, the right to access, the right to rectification, the right to erasure or blocking, and the right to damages.

11. International Data Transfers

Your data may be processed and stored on servers located outside your country of residence. We ensure appropriate safeguards are in place, including encryption in transit and at rest and compliance with applicable data protection laws.

12. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.

13. Third-Party Links

The Service may contain links to third-party websites or services not owned or controlled by Lettersheets. We are not responsible for their privacy practices.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the revised policy on the Service and updating the "Effective Date" above.

15. Contact Us

If you have questions or concerns regarding this Privacy Policy, please contact us at:

Lettersheets — Data Protection
Email: privacy@lettersheets.com
General: legal@lettersheets.com
Website: www.lettersheets.com