Who processes your data?
This policy covers the Remail website and the application that lets you view, organize and process your emails. The data controller is the entity that operates Remail.
- Operator
- Y SaS
- Legal form
- French single-shareholder simplified joint-stock company (SASU)
- Share capital
- 100 €
- Registered office
- 122 rue Amelot, 75011 Paris, France
- Company registration
- 104 458 583 RCS Paris
- Privacy contact
- rafik@notefield.work
The data involved.
The data we process depends on the accounts you connect, the permissions you grant and the features you use.
- Your account: name, email address, profile picture when provided, preferences and identifiers needed to sign in.
- Your emails: senders, recipients, subject lines, message content, conversations, dates, categories, statuses and attachments needed for the features you use.
- Your actions in Remail: categories you create, drafts, searches, summaries, suggested replies and processing preferences.
- Integrations: calendar or contact information, only when an enabled feature and the permissions you grant allow access.
- Service operation: authorization tokens, session data, technical logs, browser information and diagnostic data.
- Billing, if you subscribe: plan, subscription status, payment references and billing information. Card details entered during checkout are processed by the payment provider.
Connecting to Google or Microsoft uses their authorization process. You do not share your Gmail or Outlook password with Remail. Access tokens then enable the operations you have authorized.
The contact form asks for your first name, last name, email address and message. You may also provide an optional phone number with its country calling code. These details are used to answer your request; they do not sign you up for a newsletter.
In the current version of the website, the form prepares an email in your email app. Your entries stay on the page until that action and are not saved after a reload. We only receive the message when you send it from your email app. The direct email link works in the same way.
Demo bookings take place on an external booking page, opened only when you click the link. The information you enter is used to arrange the appointment; that service also applies its own privacy policy.
Why we use it.
- Provide the features you request
- Connection, synchronization, display, search, categorization, summaries and writing assistance. The legal basis is performance of the contract for processing necessary to provide the service you choose.
- Manage your subscription
- Managing access rights, payments, invoices and related requests, based on the contract and applicable legal obligations.
- Protect and maintain the service
- Preventing abuse, resolving errors and providing support, based on our legitimate interest while respecting your rights and minimizing the data used.
- Measure usage or send optional communications
- Where your consent is required, processing must depend on your choice. Refusing consent must not prevent you from using features that do not depend on it.
Technical authorization given to Google or Microsoft does not, on its own, amount to general consent to every use of your data.
Contact requests are used to reply to you and arrange the discussion you requested. Depending on the request, processing is based on steps taken at your request before entering into a contract, performance of a contract, or our legitimate interest in answering questions. Requesting a demo does not automatically subscribe you to a newsletter.
The role of AI.
Remail uses AI to analyze and categorize conversations, summarize useful details and suggest drafts. Depending on the action, the context may include messages, attachment excerpts, your instructions and relevant items retrieved from your account.
AI features use a specialized processing provider. Information needed for a request is sent to that provider, and useful results may then be stored in Remail so they can be displayed or retrieved.
Your email content is not intended to train a general-purpose model. The current provider states that prompts and responses for the relevant models are not used to train foundation models. Security and abuse prevention processing may nevertheless apply, depending on the service and its configuration.
Suggestions can be inaccurate. You can review and edit your drafts before sending them. Categorization and assistance features are not intended to make decisions that produce legal effects concerning you.
Data obtained through Google APIs is subject to the Google API Services User Data Policy (new tab), including the Limited Use requirements governing its use and transfer.
Who receives your data.
People authorized to operate the service or respond to a support request may access the data they need for that purpose. Providers are involved according to their role and the features enabled.
- Hosting and storage: operation of the website and app, storage of data needed for the service and related technical services.
- AI processing: processing messages, excerpts and instructions needed for the AI features you use.
- Email and integrations: connection and communication with the accounts and services you link to Remail, according to the permissions granted. These providers also apply their own policies.
- Payments and billing: subscription management, payment references and billing information when a paid checkout is used.
- Usage analytics: page visits, actions, general device information and masked replays; after consent on the public website and by default in the application.
- Diagnostics and support: logs and technical information needed to resolve errors and handle support requests.
- Demo bookings: information you enter on the external booking page to arrange the requested appointment.
Data may also be disclosed when a legal obligation or a legally valid request requires it. Access to your inbox does not authorize its sale or its use for targeted advertising.
To finalize: the contractual list of active providers, their roles, the data they receive and their retention periods. A tool’s presence in the code does not establish its production configuration.
Where does your data go?
The location of storage and the location where a request is processed may differ. A resource hosted in Europe does not guarantee that every operation takes place solely within the European Economic Area.
When processing involves a transfer outside the EEA, it must rely on a mechanism permitted by the GDPR, such as an applicable adequacy decision or standard contractual clauses with the necessary safeguards.
To confirm before publication: the countries or processing regions, the mechanisms that actually apply to each provider and how to obtain a copy. This draft does not promise exclusively European hosting or processing.
How long data is kept.
Data must be kept for as long as necessary for its purpose. Information related to a dispute or legal obligation may need to be retained separately, with restricted access.
- Account, synchronized emails and AI results
- While you use the service, then according to the account closure and deletion process. The deletion timeframe is still to be confirmed.
- Connection tokens
- For the duration of the authorized connection. Revoking access with the provider may prevent future access without automatically deleting copies already synchronized.
- Logs and diagnostics
- Exact periods are to be determined based on their purpose, content and the tools used.
- Backups
- Deletion follows rotation cycles; applicable timeframes are still to be confirmed for the environment used.
- Billing and legal obligations
- Retention follows applicable accounting, tax and evidentiary obligations.
Disconnecting an account, revoking authorization, cancelling a subscription and requesting data deletion are different actions. Data held by Gmail or Outlook remains subject to your provider’s rules.
Correspondence related to a contact or demo request is kept while the request and its follow-up are handled. Any subsequent archiving period still needs to be set and documented.
Security.
Protection relies in particular on authentication, permission management, restricted technical access and secure communications. Measures must be appropriate to the sensitivity of messages and attachments.
No service can guarantee the complete absence of risk. In the event of a data breach, obligations to assess it, notify the authority and, where required, inform the people affected apply.
This policy does not claim certification or end-to-end encryption. Content needed for an AI feature is accessible to the system processing it.
Your rights, your choices.
Under the conditions set out in the GDPR, you have rights of access, rectification, erasure, restriction, objection and data portability. Where processing is based on consent, you may withdraw it for future processing.
You can also revoke Remail’s permissions in your Google or Microsoft account security settings. This does not necessarily delete data already stored by Remail; a deletion request may be needed.
Requests are handled within GDPR timeframes, generally one month, with a possible extension in legally permitted cases and after you have been informed. Proportionate identity verification may be requested where there is reasonable doubt.
Contact details are provided in the “Who processes your data?” section. You may also lodge a complaint with the CNIL (new tab) or the relevant supervisory authority.
Updates.
This policy may evolve with features, providers or regulations. The applicable version must be dated and significant changes brought to your attention. A new processing activity that requires consent cannot be authorized simply by changing this text.
The rules for using Remail are set out in the terms of use.