Privacy notice

1. Who is responsible

Loriam Holding Ltd, Ammochostou 19, Apostoloi Petros kai Pavlos, 3075 Limassol, Cyprus, is the controller of your personal data for CancelSent. Contact: [email protected]. This notice follows the EU General Data Protection Regulation (GDPR) and US state privacy laws.

2. What we collect

For your letter: your name, mailing address, email address, and the membership details you enter (member number, home club, membership type, the email and phone on the gym account), the gym's address, the date you want the cancellation to take effect, and any note you add.

Your signature (as drawn or typed) and the signing record: time, IP address, browser and device, and a fingerprint of the letter.

Payment: the amount, currency, and Stripe references. Card details stay with Stripe.

Mailing: the USPS tracking number and tracking events, and the return receipt that USPS sends.

Messages you send us.

Technical: IP address, browser type and security logs. Our pages use no third-party tracking scripts.

Where you came from, if you open our site through an ad or a tagged link (see Advertising below).

3. Why we use it, and on what basis

To prepare, print, mail and track your letter, and to give you the proof pack (contract).

To keep a record of your electronic signature and of the mailing, so you (and we) can prove what was sent and when (contract and legitimate interest).

To keep invoices and payment records as tax law requires (legal obligation).

To answer your messages and handle refunds (contract).

To see which pages and links bring customers, in our own statistics without names (legitimate interest).

Advertising measurement, only with your consent (see below).

4. Advertising

If you come to our site through one of our ads (for example on Facebook or Instagram), we keep the campaign name, the ad name and the ad click id in our own cookie for 30 days. We ask you once whether we may tell Meta when you reach the signing step, start checkout and pay, so our ads reach people like you.

Only if you say yes, our server sends those events to Meta Platforms Ireland Ltd through its Conversions API, with your email address and a random visitor number in scrambled (hashed) form, plus your IP address, browser type and the ad click id. We never send your letter, your gym details or your signature. We run no Meta pixel or other tracking script on our pages.

Under some US state laws this may count as "sharing" personal information for targeted advertising. We do it only with your opt-in, and you can withdraw it at any time by writing to us or by clearing our cookies. We do not sell personal information.

5. Who receives it

Our print-and-mail partner (Lob.com, USA), which prints your letter and hands it to USPS; and the United States Postal Service, which delivers it and records the delivery.

Stripe (payments), Resend (email), Hetzner (hosting, Germany), Cloudflare (network security).

Meta, only with your consent (see Advertising).

Our internal business system (a customer-management tool run for us) receives your name, email, order details and support messages, so we can answer you and handle refunds.

We use Anthropic's AI service only to compare gyms' public policy pages with our guides; none of your data is sent to it.

Some providers are outside the EU. Where data leaves the EU, we rely on the European Commission's standard contractual clauses or an adequacy decision.

6. Cookies

We use only our own cookies: a session cookie if you sign in to see your orders, a visitor number for our own statistics, the ad-link cookie described above (30 days), and your answer about ad measurement. No third-party cookies.

7. How long we keep it

Your order, letter, signing record and proof: 3 years after the order, so you can use the proof if a dispute comes up later. Payment records: as long as tax law requires (up to 7 years).

Letters signed but never paid for: deleted after 30 days. Ad events: 180 days; the IP address and browser type saved for ad measurement: 90 days. Sign-in codes: 7 days.

Messages you send us (and files you attach): 24 months after the last message in the conversation, or 30 days if they are about a letter that was never paid for.

8. Your rights

You can ask to access, download, correct or delete your data, to restrict or object to its use, and to withdraw consent at any time. Write to [email protected] from the email address you used. We may keep what the law requires (for example payment records). You can also complain to the Cyprus Commissioner for Personal Data Protection, your local data protection authority, or your state attorney general.