Privacy Policy

Last updated: 29 October 2026

Penbot Ltd ("PenBot", "we", "us") runs penbot.co.uk. We are a company registered in England and Wales (company number 16264110), at 14 Mulberry Avenue, Widnes, WA8 0WN. We are the controller of your personal data under the UK GDPR and the Data Protection Act 2018. We are registered with the Information Commissioner's Office (ICO), registration number ZC285831. Contact: hello@penbot.co.uk.

What we collect

• Order details: your name, email, phone (if given), billing and delivery address, and what you order.
• Message content: the text you ask us to handwrite, and the names and addresses of the people you are writing to (recipient data).
• Payment: payments are processed by our payment providers. We do not see or store full card details.
• Enquiries: what you send us through our contact or quote forms or by email, including any files you upload (for example address lists).
• Account data: if you create an account, your login details and order history.
• Website data: cookies and similar technologies, IP address, device and browser information, and pages visited (see Cookies below).

Why we use it, and our lawful basis

| Purpose | Lawful basis |

|---|---|

| Writing and posting your order, and contacting you about it | Performance of a contract |

| Handling recipient names, addresses and messages you give us | Performance of our contract with you; legitimate interests (delivering the item you asked us to send) |

| Answering enquiries and quotes | Legitimate interests / steps before a contract |

| Keeping accounts and tax records | Legal obligation |

| Sending marketing emails, if you opted in | Consent (you can unsubscribe at any time) |

| Running and improving the website, preventing fraud | Legitimate interests |

| Non-essential cookies (analytics, marketing) | Consent |

Recipient data

If you give us someone else's name, address or a personal message, you confirm you are entitled to share it with us for this purpose. We use recipient data only to produce and post your item and delete it as described below. We never use recipient data for our own marketing.

Your handwriting

• What we keep: the letter shapes you write on screen, on our printed sheet, or that we read from a photo you send, plus the name you give your font.
• How we keep it: locked with encryption that only PenBot can open, so we can build your font pack and write your letters.
• Photos of any handwriting: we read the photo to find the letters, using an AI service (Anthropic), then delete it straight away. We keep only the letter shapes.
• Other people's handwriting: you must be the writer, or have the writer's permission.
• Signatures: never turned into a font. The optional signature add-on is used only with your consent, only for your own letters and cards, and is deleted when you ask.
• Your account: if you sign in, a copy of your handwriting is kept with your account so it follows you to other devices. Only you can see it.

Who we share data with

• Our website and e-commerce platform (Wix.com) and our payment providers
• Royal Mail or other delivery services, to post your item
• Modal (our font-building server) and Anthropic (reading the letters in a handwriting photo you send)
• Email and business software providers that help us run the business
• Professional advisers, and authorities where the law requires it

We do not sell your data. Some providers (for example Wix) may process data outside the UK. Where they do, they use approved safeguards such as UK adequacy regulations or the International Data Transfer Agreement / Addendum.

How long we keep it

• Message content and recipient lists (the letter text, names and addresses): kept for 90 days after your order is written, so we can reprint anything or sort out a problem, then deleted. If you don't complete payment, deleted after 30 days.
• Order and invoice records: 6 years (tax law).
• Your handwriting, if you haven't bought a font pack or letter: 12 months, then deleted.
• Handwriting for a font pack or letter you bought: kept so you can download again, until you ask us to delete it.
• Photos of handwriting: not kept. Deleted as soon as the letters are read.
• Enquiries that don't lead to an order: 12 months.
• Marketing consent: until you unsubscribe.

Your rights

You can ask to access, correct, delete, restrict or move your data. You can object to processing based on legitimate interests and withdraw consent at any time. Email hello@penbot.co.uk and we will reply within one month. If you are unhappy, you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

Cookies

We use essential cookies to make the site and checkout work. With your consent, we also use analytics and marketing cookies. You can change your choice at any time through the cookie banner or settings link on the site.

Changes

We may update this policy and will post the new version here.