Data Retention & Custody
Your data, on your terms - for as long as you want it kept.
WordsLater holds some of the most personal data a service can hold: messages meant for years from now, sometimes meant for after you're gone. This page explains exactly where that data lives, how long we keep it, and how easily you can take it back.
Where Your Data Lives
| Region | Used For | Provider Type |
|---|---|---|
| United States (primary) | All account and message storage by default. | SOC 2 Type II / ISO 27001 certified cloud provider. |
| United States (secondary) | Geographically redundant encrypted backups. | Separate availability region of the same provider. |
| Print partner (US) | Physical letter printing and mailing on the scheduled date. | Vetted print fulfillment partner under written DPA. |
| Delivery providers (global) | Email (SMTP), SMS (carrier), voice/video CDN. | Tier-1 providers under written DPAs. |
EU residency for accounts and storage is available for enterprise plans on request.
How Long We Keep Things
Most users keep their messages for years. Here's how long different categories of data are retained by default.
| Data Category | Default Retention | Notes |
|---|---|---|
| Scheduled (undelivered) messages | Until delivered or canceled | Held in encrypted storage for as long as the schedule requires - up to 75 years for digital, 30 years for printed. |
| Delivered messages | Indefinitely while account is active | Kept in your sent archive so you (or your loved ones) can revisit what was sent. You can delete any item at any time. |
| Vault items | Until you delete them | Zero-knowledge encrypted. We cannot read, scan, or share them under any circumstances. |
| Account profile & settings | While account is active | Used to operate your account and contact you about deliveries and check-ins. |
| Billing & tax records | 7 years | Required for tax and accounting compliance, even after account deletion. |
| Server access logs | 30 days (rolling) | Used for debugging, abuse prevention, and incident investigation. |
| Security audit logs | 1 year minimum | Append-only logs of sensitive actions (logins, key access, releases). |
| Encrypted backups | 90 days (rolling) | Backups are cycled out after 90 days; deletion requests propagate to backups within this window. |
| Marketing emails opt-in | Until you unsubscribe | Transactional emails (delivery notices, security alerts) continue regardless of marketing opt-in. |
Long-Term Delivery Reserve
A reserve built to outlast the company itself
A scheduled message is a promise. Some of those promises don't come due for 20, 40, even 75 years. To make sure those promises are kept even in worst-case scenarios, a portion of every Legacy and Lifetime Legacy purchase is placed into our delivery reserve.
What the reserve covers:
- Continued storage, monitoring, and delivery infrastructure for all scheduled messages.
- Print-and-mail funding for all scheduled physical letters at their original prices.
- A documented continuity plan that transfers operational responsibility to a successor custodian if WordsLater ever stops operating.
- Annual disclosure of the reserve's funding status to Lifetime Legacy customers.
Your Rights
Regardless of where you live, every WordsLater user has the following rights over their data.
Right to access
See every piece of personal data we hold on you from your settings page, at any time.
Right to portability
Export all of your messages, attachments, and account data in standard formats whenever you like.
Right to correction
Update or correct any personal information directly from your account, or by contacting us.
Right to erasure
Permanently delete your account and all associated data. Backups are purged within 90 days.
Right to object
Opt out of marketing communications and certain data processing activities at any time.
Right to lodge a complaint
If you're not satisfied with our response, you have the right to contact your local data protection authority.
How Deletion Works
When you delete your account, here is exactly what happens.
Request
You initiate account deletion from your settings. We email a confirmation link to your registered address.
30-day cooling-off period
Your account is suspended but recoverable. This protects you from accidental or malicious deletion. All scheduled messages are paused.
Hard delete
After 30 days, encrypted message content, attachments, and personal data are securely removed from primary storage.
Backup purge
Encrypted backups containing your data are cycled out within 90 days. No copy remains after that window.
Records retained for compliance only
The only data we keep is the minimum required for legal and tax compliance (billing records for 7 years, anonymized usage statistics). None of this includes message content.
One-way operation
After the 30-day cooling-off period, deletion is irreversible. If you have scheduled posthumous or long-dated messages you don't want lost, please cancel your account from your settings rather than asking a family member to do it on your behalf - or better, transfer ownership using our account-transfer process.
Third Parties & Subprocessors
We use a small number of vetted subprocessors to operate WordsLater. Each is bound by a written Data Processing Agreement (DPA) and only receives the minimum data required to do its job.
| Subprocessor Role | What They Do | What They Receive |
|---|---|---|
| Cloud hosting | Application servers, databases, encrypted storage | Encrypted data only |
| Payment processor | Credit card processing (PCI-DSS compliant) | Payment details; never message content |
| Email delivery | Scheduled email transmission | Recipient email, subject, message body at delivery time |
| SMS delivery | Scheduled text message transmission | Recipient number and message body at delivery time |
| Print fulfillment | Printing and mailing physical letters | Letter content and address at print time |
| Email marketing | Newsletters (opt-in only) | Email address and first name |
| Customer support | Ticket system for help requests | Information you share in support tickets |
A full, current list of named subprocessors is available on request to admin@dataprocessingllc.com.
Have a data question?
We respond to every data request within five business days.
Read the privacy policy Contact us