ReMail — Privacy Policy

Last updated: 26 September 2026

Previous versions: 25 September 2026, 29 July 2026

This Privacy Policy explains how Aeropage Limited ("Aeropage", "we", "us") collects and uses personal information in connection with ReMail (the "Service"). It forms part of, and is incorporated into, our Terms of Service.

Capitalised terms not defined here have the meaning given in the Terms.

1. Two different roles, and why it matters

ReMail is a tool that our users ("Customers") use to send emails to their own contacts. Personal information reaches us in two distinct ways, and our role differs in each:

• Customer account data — we are the controller. Information about the person who signs up for ReMail: their account, projects, templates, and settings. We decide how this is used, and this Policy governs it.
• Recipient data — we are a processor. Information about the people our Customers email ("Recipients"). We process it on the Customer's instructions, under the data processing terms in Section 11.3 of the Terms. The Customer decides who to email and why, is the controller of that data, and is responsible for having permission to email Recipients and for giving them a privacy notice.

If you received an email sent with ReMail, it was sent by the organisation named in it, from their own email account. To stop receiving their emails, use the unsubscribe link at the bottom of the email: you can choose to stop all of their emails, the mailing list it came from, or just that email. To exercise your privacy rights, please contact that sender directly. We will help them respond where needed.

2. Information we collect

2.1 Customer account data

• Account details — your email address, and the fact that you signed in with Google, an emailed sign-in link, or an emailed one-time code. If you sign in with Google, also your name and the address of your Google profile picture (see Section 2.3). We do not use passwords for production accounts. Sign-in is handled by our authentication provider (Supabase), which ReMail shares with our other product, VibeKit.
• Sign-up source — if you arrive through a link carrying a campaign tag (such as ?source= or utm_source), your browser remembers that tag for up to 30 days and we record it on your account when you sign up.
• Projects, templates, and settings — project names and descriptions, templates, brands and themes, sender names and addresses, reply-to and copy addresses, saved Airtable view addresses, batch-log settings, and campaign settings. These can contain personal information you type in.
• Brand assets — logos you upload.
• Sender postal address — the postal address you enter for each project, which ReMail adds to the footer of your emails.
• Credentials you connect — your Airtable personal access token and Resend API key. These are encrypted at rest (AES-256-GCM) before storage and are never shown again or returned to your browser once saved.
• Usage records — the number of emails sent, per account and project, and request records used to operate and protect the Service.
• Terms acceptance — when you accept our Terms of Service and Privacy Policy, we record which version you accepted, when, your approximate country, and your browser type, so we can show that you agreed.
• Messages you send us — if you contact us, the content of your message and our reply.

2.2 Recipient data (processed for our Customers)

When a Customer sends through ReMail, we process, on their behalf:

• Email addresses and merged fields, in transit — recipient, copy, sender, and reply-to addresses, and the record fields merged into each email, pass through our servers on their way to the Customer's Resend account. We do not store the body of any email.
• A pseudonymous send log — for each email, we keep a one-way coded version of the primary recipient's address (a keyed hash), a masked hint of the address (its first character and full domain, for example j***@example.com), the email's subject line, the delivery status, any error, and Resend's message reference. Because subject lines are personalised, they may contain information from the recipient's record. We use this log to prevent duplicate sends and to show the Customer what was sent. Test emails a Customer sends to themselves are logged in the same way.
• Unsubscribe choices (the suppression list) — when a Recipient unsubscribes, we record the same keyed hash of their address (never the address itself), which choice they made (all of the Customer's emails, one project, or one email), the project or email it applies to, and when. We use it only to stop the Customer's emails reaching that Recipient, and we show the Customer which planned recipients are suppressed.
• Batch records — for each batch, the planned recipients (as the same coded and masked forms), the subject, status, and references to the Customer's Airtable base, table, and records. If the Customer enables batch logging, a matching record is written into the Customer's own Airtable base.
• Images — images from the Customer's Airtable records are fetched from Airtable when a recipient opens an email and may be cached for up to one day.

We do not add open or click tracking to emails. A Customer may enable such tracking in their own Resend account, under their agreement with Resend.

2.3 What we receive from Google

When you sign in with Google, our authentication provider (Supabase) requests Google's email and profile scopes. Google therefore discloses to us your email address, whether it has been verified, your name, and the address of your Google profile picture — nothing else, and Supabase stores them with your account. We use your email address to sign you in, and your name to address you in product-update and onboarding emails (Section 4). We do not use your profile picture. We do not use Google user data for advertising, we do not sell it, and we do not use it to train machine-learning models. Data obtained through Google APIs is used and transferred in accordance with the Google API Services User Data Policy, including its Limited Use requirements.

2.4 Cookies, storage, and third-party content

We do not use advertising cookies, cross-site tracking, or analytics pixels. The application stores in your browser's local storage your sign-in session, the campaign tag described in Section 2.1, the address you last used for test emails, and interface preferences. The application's own fonts are served from our own servers, not from Google Fonts. Brand fonts that a Customer chooses for its emails are loaded from Google Fonts when they are previewed in the editor, and may be loaded when that Customer's emails or unsubscribe page are displayed; this sends the viewer's IP address to Google. That is the Customer's choice.

2.5 Children

The Service is for business and professional use and is not directed to children. We do not knowingly collect personal information from children under 13.

3. How we use information

We use personal information to:

• operate, maintain, and secure the Service, and deliver Customers' emails through their Resend accounts;
• prevent duplicate sends and show Customers their sending history;
• honour Recipients' unsubscribe choices on the Customer's behalf;
• send transactional messages, such as sign-in links and codes, and account messages;
• send you product updates and onboarding emails about our products (see Section 4);
• understand how the Service is used, including which campaigns bring new users, enforce allowances, and plan capacity;
• detect, investigate, and prevent abuse, spam, fraud, and security incidents;
• comply with legal obligations, and diagnose and fix faults.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We never add Recipients to our own mailing lists or use Recipient data for our own purposes.

4. Product-update and onboarding emails

Because ReMail shares its sign-in with our other products, when you create an account we add your email address, and your name if we have it (for example, from Google sign-in), to our product-update list, hosted by Resend, and may send you onboarding emails. You can say no when you sign up with an emailed link (by ticking "opt out"), and you can switch product-update emails off or on at any time under My account in the application, by emailing privacy@aeropage.io, or by using an unsubscribe link where one is included. If you opt out, we keep your address on the list marked as unsubscribed, so that you are not added again, and we send you no onboarding emails. Opting out does not stop transactional messages about your account.

5. Legal bases (where the UK/EU GDPR applies)

For Customer account data we rely on: performance of a contract (providing the Service you signed up for); legitimate interests (securing the Service, preventing abuse, measuring usage and campaign performance, improving reliability, and telling existing users about our products — which you can object to at any time); and legal obligation where applicable. Where we act as a processor for Recipient data, the Customer is responsible for establishing the legal basis for that processing and for any consent required to email Recipients.

6. Service providers and international transfers

We use the following providers to run the Service. They process personal information only to provide their services to us, under contractual confidentiality and security obligations:

Customers' emails are delivered by Resend under the Customer's own Resend account, not ours. Resend's storage and handling of those emails is governed by the Customer's agreement with Resend.

Aeropage Limited is established in the United States, and these providers may process data in the United States and other countries. Where personal information is transferred out of the UK or EEA, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK Addendum where applicable.

7. Security

We apply technical and organisational measures appropriate to the risk, including: encryption in transit (TLS); encryption at rest for stored credentials; storing recipient addresses in the send log only in coded and masked form, and in the suppression list only in coded form; per-account access controls on stored records; rate limiting; and restricted administrative access. We do not log email addresses, email content, or record data in our server logs.

No system is perfectly secure, and the Service may contain defects. Some content is intentionally reachable without signing in so that it can appear in emails: uploaded logos are stored at public addresses, and images from Airtable records are served through links that anyone holding them can open. As set out in Sections 10 and 17 of the Terms, Customers control their configuration and connected accounts. If a personal-data breach affects you, we will notify you and, where required, the relevant authorities, without undue delay.

8. Retention

Deletion. You can delete data yourself in the application:

• Saved keys, logos, and brands — delete each one; it is removed from our storage straight away.
• Projects — deleting a project moves it to the trash; deleting it from the trash permanently erases the project, its templates, and its settings. Its send history and any unsubscribes that apply to it are kept for the life of your account, so that duplicate protection and unsubscribes keep working.
• Your account (under My account) — permanently erases your projects, templates, brands, logos, saved keys, send history, suppression list, and your sign-in. Your sign-in is shared with other Aextra products, such as VibeKit, so this also deletes your account and data in those products.

Deleting data in ReMail does not delete emails held in your Resend account or records in your Airtable base; manage those directly with those providers. We keep limited records where required for legal, accounting, or security reasons, such as terms acceptance records. You can also ask us to delete your data by emailing privacy@aeropage.io from your account email address, and we'll complete it within 30 days.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information; to object to or restrict certain processing, including direct marketing; to withdraw consent where processing is based on consent; and to complain to your data-protection authority (in the UK, the Information Commissioner's Office). Residents of California and other US states with comprehensive privacy laws have comparable rights, including the right not to be discriminated against for exercising them — noting that we do not sell personal information or share it for cross-context behavioural advertising.

To exercise any of these rights over data we hold as a controller, contact privacy@aeropage.io. We will respond within the period required by applicable law. If you are a Recipient, you can unsubscribe using the link in any email sent with ReMail; for anything else, please contact the sender of the email — they control your data, and we will support them in responding.

10. Changes to this Policy

We may update this Policy from time to time. If we make a material change, we will update the "Last updated" date above and, where appropriate, notify you through the Service or by email. We will update the provider list in Section 6 before adding a new provider that processes Recipient data.

11. Contact

Aeropage Limited
1111B S Governors Ave STE 7987, Dover, DE 19904, United States
Privacy: privacy@aeropage.io
Legal: legal@aeropage.io