Privacy Policy

1. Who we are

LastSend is run by Brand Jet Media Private Limited, a company registered in Karnataka, India. Under Indian law we are the "data fiduciary", and under EU and UK law the "data controller", for the personal data described here. This policy covers the website at lastsend.app, the web app at web.lastsend.app and the LastSend iPhone app. Our full company details and our Grievance Officer are in section 16.

LastSend helps people leave private letters for the people they love, so the data we hold is personal. This policy explains what we collect, why, who helps us handle it, and what you can ask us to do.

2. What we collect

3. How we use it

We use your data to:

• run your account and keep it secure;
• remind you to check in, by notification and by email;
• ask your trusted contacts about you if you stop checking in, and tell them what happened;
• deliver your letters to the recipients you chose, and sort things out if an address stops working;
• take payments and manage your plan;
• answer your support requests;
• prevent fraud and abuse;
• count visits to our public pages (see 8.1).

We don't sell your data, use it for advertising, or use your letters to train AI.

Under EU and UK law, our legal bases are:

• contract: running your account, storing and delivering your letters, check-ins, payments;
• legitimate interests: security, preventing abuse, contacting the people you named on your behalf, support;
• consent: recipients and trusted contacts agreeing to take part;
• legal obligation: tax and payment records, and answering lawful requests.

4. How we handle your content

We don't scan your letters or media with moderation tools, and nobody at LastSend reviews them. Photos, videos and voice recordings are prepared automatically (resized and converted) so they play on every device. Your content must still follow the rules in our Terms of Service.

5. How delivery works

Your letters are delivered only after these steps:

1. Your check-in date passes without a check-in.
2. We remind you for about 7 days, by notification and by email where we can reach you.
3. If you still haven't checked in, we email your trusted contacts and ask whether you are all right.

Once we have asked your trusted contacts, this is what happens:

• If 2 trusted contacts tell us you have passed away, we deliver your messages right away. There is no waiting period and we don't ask you first, so choose people you trust.
• If 1 trusted contact tells us you have passed away, we tell you at once and wait 7 days. If you check in during those 7 days, nothing is sent.
• If 1 contact says you have passed away and another says you are fine, the 7-day wait is cancelled. The longer countdown below still runs until you check in.
• If a trusted contact tells us you are fine and nobody has reported a death, the process ends and your check-in schedule starts again.
• If nobody answers, we email you warnings, and deliver 60 days after we first asked your trusted contacts. If you had never checked in, or were already 90 days or more late when we first asked them, we wait 180 days instead.

Nothing starts unless you have 2 confirmed trusted contacts at that time, and if you have fewer than 2 at any point before your messages go out, delivery waits until a second contact confirms. Messages go only to recipients who confirmed their email address. If you check in at any point, we hold everything that has not been sent yet. Messages already sent cannot be recalled.

6. Who sees your data

• Your recipients: the letter written for them, and its attachments, once it is delivered.
• Your trusted contacts: your name, that you have stopped checking in, how the process is going, and after delivery the names of the people who received a letter. Never what your letters say.
• The companies that help us run LastSend: see section 7.
• Others, only when we must: when the law requires it, or to protect someone's safety.

7. Who helps us run LastSend

We only give each company what it needs for its job.

• Supabase

  Our database and sign-in

  Where: Singapore

• Hetzner

  Our server, which runs our websites, sends reminders and emails, and prepares photos, videos and voice recordings, plus its backups

  Where: Germany

• Cloudflare

  Media storage, the service that holds the key for locked letters, backup storage, our domain names, and our support form with its bot check

  Where: Worldwide network

• Amazon Web Services (SES)

  Sends our emails

  Where: Germany

• Google

  Notifications (Firebase), Google sign-in, Google Analytics on public pages, the welcome video (YouTube), and our support mailbox (Google Workspace)

  Where: United States and worldwide

• Apple

  iPhone purchases, Sign in with Apple and Hide My Email, and notifications to iPhones

  Where: United States and worldwide

• Microsoft (Clarity)

  Visit recordings on public marketing pages only

  Where: United States

• Dodo Payments

  Website payments, as merchant of record

  Where: United States and India

• Atlassian (Jira)

  Our support ticket system

  Where: United States and elsewhere

• Anthropic

  Helps draft replies to support requests. A person checks and sends every reply. Anthropic doesn't use this data to train its models.

  Where: United States

8. How we protect your data

Your data is encrypted while stored, by our storage providers, and sent over HTTPS. The subject and text of each letter are also locked with their own key, using a key that LastSend holds: on your device before they are saved, when you write in the iPhone app or on our website, and by LastSend for letters written before November 2026. A few letters wait until their owner updates an old version of the iPhone app. Recipients' names and addresses, and photos, videos, voice recordings and documents, don't have this extra lock.

This is not end-to-end encryption. Because LastSend has to deliver your letters after you die, we hold the keys and can open letters. The service opens a letter only to show it to you, to deliver it, to add the lock to an older letter, or when the law requires it, and our team doesn't read letters. When a letter is delivered, the email to your recipient contains the whole letter. A copy is therefore kept by their email provider, and it passes through our email provider (Amazon) on the way.

Anyone who has a memorial link can open that page without signing in, so recipients should treat the link like a key.

If a security problem puts your data at risk, we'll tell you by email without delay, and tell the authorities where the law requires.

9. How long we keep data

• Your account and letters: until you delete them, including if you stop checking in, because that is when LastSend is meant to work.
• Delivered letters and memorial pages: no time limit, for as long as LastSend runs. Nothing is deleted automatically after a death. Our Terms say who can ask us to remove what.
• People you named: until you remove them or delete your account. If a letter was delivered, the recipient's details stay with it.
• After a death: the account's email address stays on a list so nobody can open a new account with it.
• Support conversations: in our support system, while we need them to help you.
• Payment records: kept by Dodo Payments and Apple under their own policies.
• Processing logs on our server: deleted automatically within 2 days.
• Backups: deleted within 40 days.

When you delete your account in Settings, we delete your profile, letters, media, recipients and trusted contacts from our database and storage straight away. Copies stay for a short time in places we can't edit one record at a time: processing logs are deleted automatically within 2 days, and backups within 40 days. We keep a few records longer where the law or a dispute needs them: support conversations, which stay in our support system while we need them to help you, and payment records, which Dodo Payments and Apple keep under their own policies.

Deleting your account also cancels a subscription bought on our website. It does not cancel an iPhone subscription: cancel that in your iPhone's Settings first.

10. Your rights

You can ask us to:

• give you a copy of your personal data, including your letters, in a common format;
• correct anything that's wrong (you can change most of it yourself in the app);
• delete your account and data (you can do this yourself in Settings);
• stop or limit some uses of your data, or object to them (EU and UK);
• withdraw your consent. For the service itself, you do this by deleting your account. Recipients and trusted contacts can withdraw by asking us through the support page.

In India, you can also name someone to use these rights for you if you die or can no longer act. Tell us their name and email address through the support page.

Ask through our support page or email our Grievance Officer: Show email address. We may need to check it's really you. We reply within 30 days. If you're unhappy with our answer, you can complain to your local data protection authority (in the UK, the ICO) or, in India, once that process is in force, the Data Protection Board of India.

11. If someone named you in LastSend

If a LastSend user named you as a recipient or a trusted contact, we hold your name and email address because they gave them to us. For a trusted contact, we may also hold a phone number if they added one. We contact trusted contacts by email only, and we don't call or text that number. We use your details only to ask you to confirm, and then only for what you agreed to:

• as a recipient, to deliver the letter written for you;
• as a trusted contact, to ask about the user if they stop checking in, and to tell you what happened.

If you don't confirm, the only emails we send you are requests to confirm. If you'd rather not be involved, contact us through the support page and we'll stop contacting you. We delete your details when the user removes you or deletes their account. If a letter was delivered to you, your details stay with it.

12. Children

You must be 18 or over to have a LastSend account, and we don't knowingly collect personal data from children for an account. If you think a child has given us personal data, please tell us through the support page.

Recipients can be children. We ask account holders to give us a parent's or guardian's address for anyone under 18, and we don't knowingly ask a child under 13 to confirm an address.

13. Data sent to other countries

We are based in India, and the companies in section 7 store and process data in Singapore, Germany, the United States and elsewhere. Each company handles the data under its own data protection terms. If you want to know what protects your data with a particular company, ask us through the support page.

14. If you live in the US

We collect the kinds of data listed in section 2, for the purposes in section 3. We don't sell personal information, and we don't share it for advertising. Whichever state you live in, you can ask us for a copy of your data or to delete it, and we'll do it.

15. Changes to this policy

If we change something important, such as what we collect, who helps us handle it or how long we keep it, we'll email you before it takes effect. Small changes, like clearer wording, take effect when posted. Each version has a date, and we keep every earlier version: ask us through the support page if you'd like a copy.

16. Who we are and how to reach us

LastSend is run by Brand Jet Media Private Limited, a company registered in Karnataka, India (CIN U58201KA2026PTC225824). Registered office: Gadag, Karnataka, India.