Privacy policy

Short version: we store what we need to run your account and to receive, keep and send your team’s email. We do not analyse your email, we use no analytics or advertising services, there is no payment and therefore no payment data, and everything is stored on our servers in the EU. Everything else is below.

1. Controller

Ryvelia UG (haftungsbeschränkt) Wasserturmstraße 3 04442 Zwenkau Germany

Represented by the managing director: Kimon Neuhoff Phone: +49 173 1921654 Email: [email protected]

Where this policy says “we”, “us” or “REMAIL”, it means Ryvelia UG (haftungsbeschränkt). REMAIL is the name of the service at remail.to; it includes the website, the application with the shared inbox and the forwarding addresses at in.remail.to.

2. Data protection officer

No data protection officer has been appointed; based on our ongoing review there is currently no obligation to appoint one. Send privacy requests to [email protected].

3. Who is responsible for what

For your account, your organisation, the security of the service and its technical operation, we are the controller within the meaning of the GDPR.

For the email your team receives and sends through REMAIL, including attachments, contacts, comments, labels and saved replies, the organisation using REMAIL is responsible. We process this data exclusively as a processor under Art. 28 GDPR: we receive the email, store it, show it to the members of the organisation and send what the team sends — we do not analyse it. If you use REMAIL for business we sign a data processing agreement with you; write to us for it.

If you wrote to an address that a team forwards to REMAIL, that team is your point of contact for your data. We support it in answering your requests.

4. Legal bases

• Art. 6 (1) (b) GDPR — performance of the contract with you (account, organisation, inbox, collaboration, support).
• Art. 6 (1) (c) GDPR — legal obligations.
• Art. 6 (1) (f) GDPR — legitimate interests, in particular security, abuse prevention and error analysis.
• Art. 6 (1) (a) GDPR — consent, where we explicitly ask you; revocable with effect for the future.
• Art. 28 GDPR — processing on your behalf for your team’s email and content.

5. Visiting this website and server logs

When you visit remail.to, your browser transmits your IP address, date and time, the requested address, the referring link, browser and operating system. We process this data to deliver the pages and secure their operation (Art. 6 (1) (f) GDPR). Server logs are overwritten continuously and usually deleted after 30 days at the latest; longer only if an incident needs investigating.

Website, application, database and stored attachments are hosted on a server of OVH GmbH (OVHcloud), St.-Johanner-Straße 41–43, 66111 Saarbrücken, Germany, in a data centre in France. OVHcloud processes on our behalf under Art. 28 GDPR.

All requests to remail.to pass through Cloudflare (Cloudflare, Inc., San Francisco, USA, represented by Cloudflare Germany GmbH). Cloudflare provides DNS and TLS certificates, forwards the requests to our server and fends off attacks; in doing so Cloudflare processes IP addresses and request data (Art. 6 (1) (f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition.

We serve fonts and all other parts of the pages ourselves. No content is loaded from third-party servers — except external images in received email, and only if you explicitly choose to show them (section 9).

6. Cookies and local storage

We only set strictly necessary cookies (§ 25 (2) TDDDG): a language cookie (“remail_locale”, one year) that remembers the language version you last read, and after sign-in the session cookies of our authentication.

In your browser’s local storage we keep the light/dark mode and individual display settings of the application. None of this is transmitted to us.

There are no analytics, tracking or advertising services, no third-party cookies and no consent banners — because there is nothing to consent to.

7. Account and sign-in

For registration we process your email address, name, a password (hash only), the time of registration, your preferred language and session data (session identifier, IP address, browser, time of last activity). Optionally you upload a profile picture, set up two-factor authentication (secret and recovery codes) or passkeys (public key, device identifier). There is no sign-in via third parties such as Google or GitHub. The legal basis is Art. 6 (1) (b) GDPR; for session protection and abuse prevention Art. 6 (1) (f) GDPR.

8. Organisations, invitations and members

An inbox belongs to an organisation that can have several member accounts. We process the organisation’s name and identifier, its REMAIL address and settings, memberships and roles, and for invitations the invited person’s email address and the inviting account (Art. 6 (1) (b) GDPR). An invitation is deleted once accepted or expired.

Within an organisation, members see each other’s name, email address and profile picture, for example on assignments, comments and in the activity history.

9. Receiving email

Every organisation gets its own address at in.remail.to; email that arrives there or is forwarded there lands in the organisation’s inbox. Incoming email is received on our behalf by Resend (Plus Five Five, Inc., USA); our server fetches the content, headers and attachments from there and stores them. In doing so Resend processes the email including sender, recipients, subject, content and attachments on the basis of standard contractual clauses.

For each email we store the sender, recipients (including copies), subject, text and HTML content, the headers needed to thread it (such as the message ID), the time and attachments of up to 25 MB per file. Attachments are stored as files on our server and delivered to members of the organisation only. From sender addresses we create contacts of the organisation (name and email address).

REMAIL does not load external images in received email by itself. If you choose to show them, your browser loads them from the servers the sender specified; their operators receive your IP address in doing so.

Rules your organisation sets up can automatically label, assign, archive, mark as spam or forward incoming email to an address you specify.

10. Sending email

Replies and new email from your team, autoresponder replies and forwards by rule are sent through Resend (section 9). Resend processes sender, recipients, subject, content, attachments and the delivery status. A message your team schedules for later is stored until the scheduled time and sent then.

We ourselves send you the emails the service needs: confirmation of your address, password reset, notices about the security of your account, invitations to organisations, notifications about conversations (for example when someone mentions you or assigns a conversation to you) and answers to your requests. We do not send advertising.

11. Team collaboration

For every conversation we store what the team does with it: assignments, comments and mentions, labels, status (such as archived or snoozed), drafts, the read status per person and an activity history with name and time. From this we calculate the organisation’s statistics (Art. 6 (1) (b) GDPR). Saved replies, autoresponders and rules are stored as settings of the organisation.

While the application is open, your browser keeps a WebSocket connection to our server. Through it, it learns about changes, and through it presence works: who is currently viewing, replying to or commenting on a conversation. Presence is held in memory only and disappears as soon as you leave the conversation.

12. Contact form and support

If you write to us through the contact form or by email we process your name, email address, phone number and company where given, and your message, in order to answer it (Art. 6 (1) (b) and (f) GDPR). Messages from the form reach us by email via Resend (section 10). We delete requests once they are settled and no retention duty applies.

13. Error reports

If an error occurs in the application while you are signed in, your browser reports it to our server. We log the time, account identifier, requested address, error message, technical stack trace and browser so that we can fix it (Art. 6 (1) (f) GDPR). The reports are kept in the server logs and deleted with them.

14. Retention and deletion

• We keep email, attachments, contacts and comments as long as the organisation exists and does not delete them.
• When an organisation is deleted, we delete all its conversations, messages, attachments, contacts and settings. When you delete your account, we delete the account, sessions and memberships; your replies and comments in your team’s conversations remain, with the name they were written under.
• Individual messages and attachments are deleted promptly at the organisation’s request.
• Server logs and error reports: usually 30 days at most.
• Contact requests: until settled, otherwise according to statutory periods.

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). You may withdraw any consent at any time. You can delete your account yourself; for everything else write to the address above. For email you wrote to a team, please contact that team first (section 3).

You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Saxon Commissioner for Data Protection and Transparency, Devrientstraße 5, 01067 Dresden, Germany (datenschutz.sachsen.de).

16. Changes

We update this policy when the service or the legal situation changes. The current version is always available at this address; the date above shows its state. For material changes we inform signed-in users by email.