Privacy policy

Last updated October 21, 2026

This informs you under Art. 13 GDPR what personal data we process when you use Explain, for what purpose and on what legal basis, who receives it, and what rights you have.

The German version of this page is the legally authoritative one.

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

Eunice Ogunrinde, Deutschland

Email for data protection requests: eunicemodupe62@gmail.com

No data protection officer has been appointed, as the conditions of Art. 37 GDPR together with § 38 BDSG are not met. Please direct all data protection matters to the address above.

2. Data we process

  • Letters you upload: the photo or PDF, and the text read from it.
  • The analysis: summary, sender, letter type, deadline, amount, reference number, action steps and risk flags.
  • Your email address, if you create an account to save letters.
  • Your follow-up questions about a saved letter, and the answers.
  • Server log files your browser transmits automatically (see section 3).

3. Server log files

When you open this site, our hosting provider automatically collects data your browser transmits: IP address, date and time of the request, the address requested, the referrer, and browser and operating system details.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in technically faultless operation, system security and defending against attacks.

This data is not merged with other sources and is not analysed to identify individuals.

4. Special categories of data

Official letters can contain special category data under Art. 9(1) GDPR, for example about health, social benefits or your personal circumstances. You alone determine what that is, by choosing which letter to upload.

We process such data solely on the basis of your explicit consent under Art. 9(2)(a) GDPR, given when you upload a letter. You may withdraw it at any time with effect for the future by deleting the letter or your account.

Please do not upload letters whose contents you do not wish transmitted to the processors in section 6.

5. Purposes and legal bases

  • Reading and explaining a letter: Art. 6(1)(b) GDPR, and additionally Art. 9(2)(a) for special category data.
  • Account and sign-in via an emailed link: Art. 6(1)(b) GDPR.
  • Storing your letters: Art. 6(1)(b) GDPR.
  • Deadline reminders: Art. 6(1)(b) GDPR.
  • Operating, securing and stabilising the site: Art. 6(1)(f) GDPR.

6. Recipients and processors

We use the following processors, acting on our instructions under Art. 28 GDPR:

  • Anthropic PBC, USA: receives the uploaded letter as image or PDF, the text read from it, and your follow-up questions, to produce the explanation and reply drafts.
  • Voyage AI, USA: receives a short search query derived from your letter, and your follow-up questions, to find relevant passages in official sources. The letter itself is not transmitted to this service.
  • Supabase, Inc., USA: database and authentication. The database runs in the Frankfurt am Main region within the European Union.
  • Vercel Inc., USA: hosting, delivery and server log files.
  • Resend (Plus Five Five, Inc.), USA: sending sign-in and reminder emails.

7. Transfers to third countries

Some processors in section 6 are established in the United States, so personal data is transferred to a third country.

Transfers rely on appropriate safeguards under Art. 46(2)(c) GDPR, in particular the European Commission's Standard Contractual Clauses, unless the recipient can rely on the Commission's adequacy decision on the EU-US Data Privacy Framework.

Despite those safeguards, access by authorities in third countries cannot be ruled out.

8. Retention

  • Saved letters, deadlines and questions are kept until you delete them or delete your account.
  • Deleting a letter also deletes its deadlines, reminders and questions.
  • Deleting your account deletes the account and all associated data. We keep no copy.
  • If you use Explain without an account, neither the letter nor its analysis is stored permanently.
  • Server log files are deleted automatically by our hosting provider after a short period, unless needed to investigate a specific security incident.

9. Cookies

We use only strictly necessary cookies, which keep you signed in. Without them you could not sign in or open your archive.

These require no consent under § 25(2)(2) TDDDG, as they are strictly necessary for a service you expressly requested, so no consent banner is needed.

We use no analytics, measurement or advertising cookies. There is no tracking.

10. Encryption

This site uses TLS encryption for security and to protect the transmission of confidential content. You can recognise an encrypted connection by the address bar beginning with https://

11. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21).

Where we rely on consent, you may withdraw it at any time with effect for the future, without affecting the lawfulness of processing before withdrawal.

You can exercise erasure directly in the app: you may delete individual letters and your entire account yourself, at any time.

12. Right to complain to a supervisory authority

Without prejudice to other remedies, Art. 77 GDPR gives you the right to complain to a data protection supervisory authority, in particular in the member state of your residence, place of work, or the place of the alleged infringement.

A list of the German supervisory authorities is available at https://www.bfdi.bund.de/DE/Service/Anschriften/anschriften_node.html

13. Whether you must provide data

You are under no statutory or contractual obligation to provide personal data. Without the letter we cannot explain it, and without your email address we cannot create an account or send reminders.

14. Automated decision-making

The analysis of your letter is automated, but it is not an automated decision within the meaning of Art. 22(1) GDPR: the result is an explanation for your information. It produces no legal effect concerning you and does not similarly significantly affect you.

15. Minors

This service is not directed at children. People under 16 should not submit personal data without the consent of a parent or guardian.

16. Changes to this policy

We update this policy when changes to our processing make it necessary. The version published on this page applies. The date of the last update is shown above.