Last updated: 2026-08-28
This privacy policy provides information on the nature, scope and purpose of the processing of personal data in connection with the website coupleletters.com, including all of its pages, and the service offered through it, in which two persons, as a couple, answer one question per day via WhatsApp (hereinafter collectively the “Service”). It further sets out the legal bases of the processing, the recipients of the data, the duration of storage and the rights to which data subjects are entitled.
Questions concerning this policy may be directed to the controller named in Section II using the contact details provided there.
coupleletters, Inh. Andreas Krause, Zechenstr. 5, 51103 Cologne, Germany (hereinafter “coupleletters”, “we” or “us”), processes personal data exclusively in accordance with the applicable data protection provisions, in particular Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).
By its nature, the Service is designed for content of a highly personal character. The answers given within the daily ritual are intended solely for the two persons of the respective couple. They are neither evaluated as to their content nor disclosed to third parties, and they are used neither for advertising purposes nor for the training of artificial intelligence systems.
Under the GDPR, data subjects are entitled to the rights set out in Section V, including, under the conditions stated there, a right to object to specific processing operations. Where such a right to object exists, it is expressly indicated in the relevant section.
The controller within the meaning of Art. 4(7) GDPR is:
coupleletters
Inh. Andreas Krause
Zechenstr. 5
51103 Cologne, Germany
Phone: +49 (0)221 80090637
Email: support@coupleletters.com
Enquiries relating to data protection are to be addressed to the above address, stating “Privacy” as the subject. The appointment of a data protection officer is not required under § 38 BDSG; accordingly, no data protection officer has been appointed.
Each time coupleletters.com is accessed, the web server automatically collects data transmitted by the browser used and stores it in server log files. The following data is recorded:
This processing serves the delivery of the website, the assurance of stable and secure operation, and the detection and prevention of attacks. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the technical functionality and security of the Service. Log files are deleted automatically at regular intervals and are not merged with other data sets. The recipient is the hosting provider named in Section VI. A right to object to this processing exists under Art. 21 GDPR.
No tools for audience measurement or tracking are used. The website embeds neither advertising networks nor social network plugins nor third-party content. Fonts and script libraries are served from our own server, so that accessing a page establishes no connection to third-party servers.
When the contact form is used, the name, email address, selected subject, message text and, where provided, the couple ID are processed. Before submission, a simple slider task must be completed in order to prevent automated input. This mechanism is operated on our own server, sets no cookies and involves no third-party service.
The purpose of the processing is to handle and respond to the enquiry. The legal basis is Art. 6(1)(b) GDPR insofar as the enquiry concerns the conclusion or performance of a contract, and otherwise Art. 6(1)(f) GDPR on the basis of the legitimate interest in proper communication. The enquiry is transmitted as an email; the sender receives a confirmation of receipt with a reference number. Contact enquiries are retained for up to twelve months after final processing and are subsequently deleted, unless statutory retention obligations require otherwise.
For registration, the first name, email address, date of birth, gender and WhatsApp phone number of both persons of the couple are collected. In addition, details of the relationship are collected: relationship status (relationship, engaged, married), type of relationship (open or exclusive), living situation, number of children, how the couple met, and the associated dates. Time zone and language are also stored.
This information is necessary for the provision of the Service: the phone number enables delivery, the time zone enables the timely delivery of the daily question, and the relationship details enable the assignment of suitable question categories. The date of birth additionally serves the age verification described in Section VIII. The legal basis is Art. 6(1)(b) GDPR.
Registration is carried out by one person on behalf of both persons. The second person receives an email immediately after registration and must activate their profile independently. Until such activation, the Service is not commenced; in particular, no WhatsApp messages are sent. The registering person is responsible for ensuring that the second person consents to the registration.
A randomly generated one-time token is used per person for activation; the time of activation is recorded. In this way it is verifiably documented that both persons have consented to the use of the Service. The legal basis is Art. 6(1)(b) GDPR as well as Art. 6(1)(f) GDPR on the basis of the legitimate interest in a registration procedure that is protected against misuse.
Within the private space, a profile with up to 40 fields may be completed, for example concerning preferences, habits and shared memories; a profile picture may also be uploaded. All entries are voluntary and are decided upon field by field. They serve exclusively the personalisation of the daily questions, in that the Service uses the stored entries in place of generic wording.
The daily ritual commences only once both profiles are at least 80 percent complete. The respective other person sees only the progress as a percentage and not the content. Profile pictures are reduced server-side to 512 pixels, stored in JPEG format and delivered exclusively through a script that first verifies the access credentials. The legal basis is Art. 6(1)(b) GDPR.
The delivery of the daily questions and the receipt of the answers take place via the WhatsApp Business Platform (Cloud API) of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). For this purpose, the phone number and the content of the respective message are transmitted to Meta. Messages sent by users, including text and images, are transmitted to us by the same route.
Meta processes the messages for the purpose of transmission and is, in this respect, an independent controller under the terms of the WhatsApp Business Platform. We have no influence over this processing; the privacy terms of WhatsApp apply in addition. A transfer to the United States is possible and is based on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) or on standard contractual clauses (Art. 46(2)(c) GDPR).
The legal basis is Art. 6(1)(b) GDPR, as delivery via WhatsApp constitutes the contractually owed performance. In addition, express consent to the use of this channel is given during registration (Art. 6(1)(a) GDPR). This consent may be withdrawn at any time with effect for the future, in particular by sending the message “STOP” in the chat or by cancelling the subscription.
A technical log is kept for every message sent and received, comprising the message identifier, time, delivery status and direction. It serves the detection of duplicate deliveries, error analysis and cost control. No evaluation of content takes place.
The answers given and the images submitted with them are stored together with the respective question text and made available in the couple's Memory Book. Access to this content is restricted to the two persons of the couple. Images are stored in a directory that is not served directly by the web server; every retrieval takes place through a script that first verifies the couple's access credentials.
The answers are not read, statistically evaluated, disclosed or used for the training of artificial intelligence systems. The legal basis is Art. 6(1)(b) GDPR.
The private space does not use a password. For login, the couple ID and the email address are entered; a one-time link is then sent by email, which is valid for 15 minutes and expires thereafter. The number of requests per hour is limited in order to impede misuse. The legal basis is Art. 6(1)(b) and (f) GDPR.
Emails are sent exclusively insofar as the provision of the Service requires it. This concerns the two activation emails, the request to complete the profile, the login link, a reminder in the event of a missing start confirmation, and a notification when the ritual is paused. No newsletter, promotional emails or tracking pixels are used. The legal basis is Art. 6(1)(b) GDPR.
Payment processing is carried out by Dodo Payments (dodopayments.com). Dodo Payments does not act merely as a technical service provider but as the Merchant of Record: the subscription is legally sold and invoiced by Dodo Payments. Dodo Payments issues the payment receipt, remits the applicable value added tax and handles refunds and chargebacks. The Service itself is provided by us.
For the purpose of payment processing, the first and last name, the email address and the subscription identifier are transmitted to Dodo Payments. Payment details are entered directly with Dodo Payments; card details are neither viewed nor stored by us. We receive only the information as to whether the payment was successful, together with the status of the subscription.
As Dodo Payments, in its capacity as seller, itself determines the purposes and means of this processing, it is an independent controller in this respect and not a processor. The privacy policy of Dodo Payments applies in addition. The corporate group includes companies established in the United States and in India; according to its own statements, Dodo Payments bases transfers to these countries on standard contractual clauses (Art. 46(2)(c) GDPR).
The legal basis for the transfer is Art. 6(1)(b) GDPR. Records of the payouts made by Dodo Payments to us are retained in accordance with the retention periods under German commercial and tax law (§ 147 AO, § 257 HGB), as a rule for up to ten years; the legal basis for this is Art. 6(1)(c) GDPR.
No cookies are used for analytics, marketing or advertising purposes. The publicly accessible pages (home page, contact, imprint, privacy policy, terms of use) set no cookies whatsoever for visitors who are not logged in. A consent banner is therefore not required.
Two cookies are technically necessary and are set exclusively where they are required:
Both cookies are strictly necessary for the provision of the expressly requested Service; consent is not required under § 25(2) no. 2 TDDDG. Should cookies be used for other purposes in the future, consent will be obtained beforehand and this policy adapted accordingly.
In addition to the right to withdraw consent given at any time with effect for the future (Art. 7(3) GDPR), the following rights exist subject to the statutory conditions:
An informal notification to support@coupleletters.com is sufficient for the exercise of these rights. Requests are answered within the statutory period, as a rule within one month.
An account with coupleletters is always held jointly by two persons. Information is therefore provided exclusively in respect of the data of the requesting person; the answers of the respective other person are not covered. If one of the two persons requests the erasure of their data, the joint account, including all answers and images, is deleted, as the shared content cannot meaningfully be separated. The respective other person is informed of the deletion of the account.
Insofar as personal data is processed on the basis of Art. 6(1)(f) GDPR, there is a right under Art. 21(1) GDPR to object to this processing at any time on grounds relating to the particular situation of the data subject. In that case the processing is discontinued unless compelling legitimate grounds for the processing can be demonstrated which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims. This concerns in particular the processing described in Section III.1.
Personal data is neither sold nor rented and is not disclosed to advertising networks, analytics services or data brokers. Disclosure takes place exclusively to the extent described below.
The following service provider processes personal data on our behalf and in accordance with our instructions on the basis of an agreement pursuant to Art. 28 GDPR:
The following companies themselves determine the part of the processing attributable to them. They do not act on our behalf; their respective privacy terms apply in addition to this policy:
Disclosure to authorities or courts takes place where a legal obligation to do so exists or where disclosure is necessary for the establishment, exercise or defence of legal claims. Documents relevant for tax purposes are made available to the tax advisor to the extent provided by law.
Technical and organisational measures appropriate to the risk of the processing are employed to protect personal data (Art. 32 GDPR). These include in particular:
Complete security of data transmission over the internet cannot, however, be guaranteed. Indications of possible security vulnerabilities are received at support@coupleletters.com.
The Service is directed exclusively at persons of full age. Registration requires a minimum age of 18 years; the date of birth is verified during registration, and registrations that do not meet this requirement are rejected.
Personal data of minors is not knowingly collected. Should it nevertheless become known that data of a minor has been transmitted, such data is deleted without delay. Corresponding notifications are received at the address stated in Section II.
Personal data is stored only for as long as is necessary for the respective purpose or as required by statutory retention periods:
Deletion of the account may be requested at any time by informal notification to support@coupleletters.com. The account, the profiles, the answers and the images are deleted; the only exception is documents subject to statutory retention obligations.
This privacy policy is amended as soon as changes to the Service or to the legal situation so require. The version published on this page at the relevant time is authoritative; the date of the last amendment is indicated at the top of the page.
Material changes affecting the rights of data subjects are additionally communicated by email to the address provided at registration.
For questions concerning data protection, the exercise of data subject rights and the deletion of the account, the following contact point is available:
coupleletters
Inh. Andreas Krause
Zechenstr. 5
51103 Cologne, Germany
Email: support@coupleletters.com
Enquiries are handled personally, as a rule within one working day.