Privacy Policy
Recall24 keeps the text and files of an email so the recipient can read them. For 24 hours you can recall the email; then its text and files are deleted at once. If you don’t recall it, the email is final and stays readable, like any other email. This policy explains what we collect, why, how long we keep it and what you can ask of us.
Who we are
Recall24 is a product of RevokeMail. The controller of your personal data is LBV ehf., company ID (kennitala) 670720-0980, Litlabæjarvör 17, 225 Garðabær, Iceland (“RevokeMail”, “we”).
- Privacy questions and requests: privacy@revokemail.com
- Help with the product: support@revokemail.com
This policy covers the Recall24 web app (app.revokemail.com), the Recall24 Outlook add-in, the Recall24 Gmail extension for Chrome, and the website revokemail.com.
What data we process
We collect only what Recall24 needs to deliver an email, show it to the recipient, and let the sender take it back. We do not read your mailbox.
| Who | Data | Where it comes from |
|---|---|---|
| Senders | Name, email address and account ID from Google or Microsoft; the country you signed in from (two-letter code, no IP address or city) | You, when you sign in with Google or Microsoft |
| Senders | Recipient addresses, subject, message text and attached files of each email protected with Recall24 | You, when you send with Recall24 or when a protect option applies |
| Senders | When each email was sent, opened, downloaded or recalled, recall attempts and their result, and when its recall window ended (together these make up your incident reports); an optional reason for a recall; your Recall24 settings | Recall24, as you use it |
| Senders | Product usage events (for example “email sent”, “recall clicked”), which never contain message text, subjects or email addresses. For new accounts we note only whether the email domain is a personal or a business one, and for business domains a one-way coded value (not the domain itself) so we can count people from the same company | Recall24 |
| Recipients | Email address; when the link was loaded, when the email and its files were opened or downloaded, and visits to the link after a recall (times only: no IP address or device details are stored) | The sender, and Recall24 when you open the link |
| Invited people | Email address and the name of the person who invited you | A Recall24 user who invited you |
| Website visitors | Technical data needed to deliver the pages (such as IP address and browser), processed by our hosting providers | Your browser |
What the add-in and extension read. The Outlook add-in and the Gmail extension read the email you are writing only when you send it with Recall24, or when a protect option you chose applies. In a sent email, the Outlook add-in reads only that email’s text, to find its Recall24 link and show you its status. Neither reads your inbox, contacts or other emails.
What we do not do. We do not sell personal data, show ads, build advertising profiles, or use the content of emails to train AI models.
Why we use it and our legal basis
We process personal data under the EU General Data Protection Regulation (GDPR), which applies in Iceland through Act No. 90/2018.
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and run your account; send, show, protect and recall your emails and files | Performance of our contract with you (Art. 6(1)(b)) |
| Show the recipient the email the sender chose to send them, and tell the sender whether it was opened | Our and the sender’s legitimate interest in delivering and controlling the email (Art. 6(1)(f)) |
| Send one invitation on behalf of a user who invited you | Legitimate interest (Art. 6(1)(f)); you get one email and we don’t contact you again unless you sign up |
| Keep the service secure, prevent abuse and fix errors | Legitimate interest (Art. 6(1)(f)) |
| Understand how Recall24 is used, from events without message content or email addresses, and where our users are (country level) | Legitimate interest in improving the product (Art. 6(1)(f)) |
| Answer your questions and requests | Contract or legitimate interest, depending on the request |
| Keep records we must keep by law | Legal obligation (Art. 6(1)(c)) |
Businesses. When a company uses Recall24 for its staff, the company decides what its employees send. For that content we act as the company’s processor, under a data processing agreement available from privacy@revokemail.com.
How long we keep it
When you recall an email, its text and files are deleted at once. An email you don’t recall within 24 hours is final: the recipient can keep reading it, so we keep it until you delete your account or ask us to delete it. A cleanup job runs every hour to apply these rules.
| Data | Kept until |
|---|---|
| Text and files of a recalled email | Deleted the moment you recall it; files uploaded but never sent: 2 hours |
| Recipient address, subject and times of a recalled email | 30 days after the recall |
| An email you didn’t recall (final) | Until you delete your account or ask us to delete it, since the recipient can still read it |
| Link activity and recall attempts of an email | Deleted together with that email |
| Invitations nobody accepted | 90 days |
| Product usage events | 24 months |
| Your account (name, email, account ID, country, settings) | Until you ask us to delete it |
| Sign-in to the web app | A session cookie that lasts 7 days |
| Sign-in for the add-in and extension | A token stored on your device that lasts 30 days, or until you disconnect |
What we cannot take back. Once a recipient has opened an email or downloaded a file, they may have read, copied or saved it. Recalling the email stops further access through Recall24. It cannot remove what the recipient already saved.
Who processes data for us
We use a small number of service providers. Each processes data only on our instructions, under a data processing agreement.
| Provider | What it does for Recall24 | Location |
|---|---|---|
| Supabase | Database for accounts, emails and files | EU (Stockholm, Sweden) |
| Netlify | Hosts the web app and runs its server code | United States |
| Resend | Delivers Recall24 notification and invitation emails | United States |
| Sign-in with Google | Global | |
| Microsoft | Sign-in with Microsoft; the Outlook add-in runs in Outlook | Global |
| Zoho | Our own mailboxes (hello@, support@, privacy@) | EU |
| Framer | Hosts the website revokemail.com | EU company; pages served worldwide |
Transfers outside the EEA. Where a provider processes data outside the European Economic Area, the transfer relies on the EU–U.S. Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.
We share data with authorities only when the law requires it.
Cookies and local storage
The Recall24 web app sets strictly necessary cookies only: one keeps you signed in for up to 7 days, and one remembers for up to 30 days who invited you, if you arrived through an invitation link. It uses no advertising or tracking cookies. The Gmail extension and the Outlook add-in store a sign-in token on your device so you stay connected.
Google and Microsoft account data
From Google or Microsoft sign-in we receive only your name, email address and account ID. We use them only to sign you in and to show recipients who sent an email. Recall24’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data for advertising, do not sell it, and do not use it to train AI models.
Security
All connections to Recall24 are encrypted (HTTPS/TLS). Data at rest is encrypted by our database provider. A recipient’s link is a long random code. Files can be downloaded only through that link, and not after the email is recalled. Access to production data is limited to the people who run Recall24. If a personal data breach puts your rights at risk, we will notify the data protection authority within 72 hours and inform you without undue delay.
Your rights
You can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, or give it to you in a portable format. Write to privacy@revokemail.com. We reply within one month. You can also complain to the Icelandic Data Protection Authority, Persónuvernd, or to the authority where you live.
Recipients and invited people can ask the same of us. Where we hold an email on behalf of a business, we will pass the request to that business.
Children
Recall24 is not intended for anyone under 16, and we do not knowingly collect their data.
Changes to this policy
When we change this policy we update the date at the top. If a change is significant, we will tell signed-in users before it takes effect.
LBV ehf. · kennitala 670720-0980 · Litlabæjarvör 17, 225 Garðabær, Iceland · hello@revokemail.com