Privacy Policy

ReciteMail is built privacy first. Your email lives on your own computer, encrypted. We designed the product so that we never collect your inbox. This policy explains, in plain language, exactly what happens to your data.

1. Who we are

ReciteMail is operated by Velora Prima Ltd ("ReciteMail", "we", "us"), a company registered in Ireland (company number 797589), with its registered office at Workhub, 51 Bracken Road, Sandyford, Dublin D18 CV48, Ireland. Velora Prima Ltd is the data controller for the account data described below. For any privacy question or to exercise your rights, contact us at info@recitemail.io.

2. The data that stays on your device

ReciteMail is a desktop application for Windows. The following data is stored only on your own computer and is never sent to us:

• The emails you import, paste or capture, along with any drafts ReciteMail writes for you.
• Your identity profile, suppliers, templates, banned words and signature.
• Your app settings and preferences.

This data is held in an encrypted local database on your machine (AES-256 encryption). If you turn on the optional app lock, the database key is additionally protected by your passphrase. ReciteMail does not connect to your email account and does not download your mailbox in bulk. Importing is something you do, on your device, file by file or message by message.

3. What leaves your machine and when

Nothing is sent for processing until you ask for it. When you use a drafting feature (for example, drafting a reply, paraphrasing a passage, translating, transcribing dictation, researching a fact or revising a draft), ReciteMail sends only the specific message and the context you have chosen for that action to our drafting service, which generates the result and returns it to you. Drafting does not happen on your own computer. Your mail is stored and encrypted locally. Writing a draft is a round trip to that service.

• The drafting service is a large third-party provider of language models. We use it on a paid tier, which does not train on content sent through it. It processes your request, returns the draft and is not permitted to use your content for any other purpose.
• We send the minimum needed to complete the action you requested, not your wider mailbox.
• For the research feature, the query derived from your request is also sent to a web search service so the answer can be grounded in current information.
• These requests pass through ReciteMail's secure server (the "proxy") purely so we can authenticate your subscription and meter usage. The proxy forwards your request to the drafting service and returns the result. We do not store the content of your messages or the drafts on our servers.

4. The data on our servers

To run accounts and subscriptions for the built-in plan, we keep a small amount of account data on our servers, hosted in western Europe:

• Your email address and a securely hashed password (we never store your password in readable form).
• Your subscription status and plan.
• Usage counts (for example, how many drafting actions you have used in the current period) so we can apply fair-use limits and billing. These are counts, not content.
• Security and abuse-prevention records, such as timestamps of sign-in attempts.

We do not store your emails, your drafts or the text you send through the drafting service on our servers. We never sell, rent or share your personal data with third parties for advertising or resale.

5. Where your data is processed

Your account data and our analytics are hosted in western Europe. Drafting is different and we want to be plain about it.

The drafting service runs outside the European Economic Area, mainly in the United States. When you ask for a draft, the message and context you chose are sent there and the draft comes back. The exchange ends there. This is a transfer of personal data to a third country under the GDPR. The safeguards the law requires are in place: our provider is certified under the EU-US Data Privacy Framework and its terms include the European Commission's Standard Contractual Clauses.

In practice this means the text you send for a draft leaves Europe for the moment it takes to write that draft. It is not stored there, it is not used for training and it is not used for anything other than answering your request. Everything else, including your mail itself, stays where it was: encrypted on your own computer.

6. Payments

Payments for the built-in plan are processed by Stripe. When you subscribe, your card details are handled directly by Stripe under their own privacy policy. ReciteMail never sees or stores your full card number. We receive only the information needed to manage your subscription, such as whether a payment succeeded and when your plan renews.

7. The website

This marketing website uses privacy-respecting, cookieless analytics that we host ourselves on our own infrastructure in the European Union. It counts page visits, referrers and button clicks in aggregate so we can improve the site. It sets no cookies, does not identify you, does not build a profile of you and shares nothing with third parties.

8. How long we keep data

Local data stays on your device until you delete it or uninstall the app. Account data on our servers is kept while your account is active. If you delete your account, we remove your account record and associated usage rows, except where we are required to keep limited billing records for legal and tax purposes.

9. Your rights

Depending on where you live, you may have the right to access, correct, export or delete the personal data we hold about you and to object to or restrict certain processing. Because your email content lives on your device, you are already in direct control of it. For the account data we hold, you can:

• Request a copy of your account data (data export).
• Request deletion of your account (right to erasure).
• Ask us to correct inaccurate account details.

To make any of these requests, email info@recitemail.io from the address on your account. You also have the right to complain to your local data protection authority. As we are based in Ireland, our lead supervisory authority is the Irish Data Protection Commission (dataprotection.ie).

10. Security

Privacy and security are core design goals of ReciteMail, not afterthoughts. In practice that means:

• Your mail and drafts stay on your device, in a local database encrypted with AES-256. The optional strong app lock seals that database behind your password.
• All connections use TLS (HTTPS). Your data is encrypted in transit.
• The account data we hold is encrypted at rest and hosted in the European Union.
• Passwords are stored only as a salted hash using a modern algorithm (argon2id), never in readable form.
• We follow least-privilege access to our systems. We never use your content for training.

No system is perfectly secure. These are the protections we build in by default. If you ever have a security concern, email info@recitemail.io.

11. Children

ReciteMail is intended for adults and is not directed at children. We do not knowingly collect personal data from anyone under the age required by law in their country.

12. Changes to this policy

If we make a material change, we will update the date at the top of this page and, where appropriate, notify you. Continued use of ReciteMail after a change means you accept the updated policy.

13. Contact

Questions about privacy? Email info@recitemail.io and we will help.