ReMail — Privacy Policy

Last updated: 25 September 2026

This Privacy Policy explains how Aeropage Limited ("Aeropage", "we", "us") collects and uses personal information in connection with ReMail (the "Service"). It forms part of, and is incorporated into, our Terms of Service.

Capitalised terms not defined here have the meaning given in the Terms.

1. Two different roles, and why it matters

ReMail is a tool that our users ("Customers") use to send emails to their own contacts. Personal information reaches us in two distinct ways, and our role differs in each:

• Customer account data — we are the controller. Information about the person who signs up for ReMail: their account, projects, templates, and settings. We decide how this is used, and this Policy governs it.
• Recipient data — we are a processor. Information about the people our Customers email ("Recipients"). We process it on the Customer's instructions, under the data processing terms in Section 11.3 of the Terms. The Customer decides who to email and why, is the controller of that data, and is responsible for having permission to email Recipients and for giving them a privacy notice.

If you received an email sent with ReMail, it was sent by the organisation named in it, from their own email account. To unsubscribe, or to exercise your privacy rights, please contact that sender directly. We will help them respond where needed.

2. Information we collect

2.1 Customer account data

• Account details — your email address, and the fact that you signed in with Google, an emailed sign-in link, or an emailed one-time code. We do not use passwords for production accounts. Sign-in is handled by our authentication provider (Supabase), which ReMail shares with our other product, VibeKit.
• Sign-up source — if you arrive through a link carrying a campaign tag (such as ?source= or utm_source), your browser remembers that tag for up to 30 days and we record it on your account when you sign up.
• Projects, templates, and settings — project names and descriptions, templates, brands and themes, sender names and addresses, reply-to and copy addresses, saved Airtable view addresses, batch-log settings, and campaign settings. These can contain personal information you type in.
• Brand assets — logos you upload.
• Credentials you connect — your Airtable personal access token and Resend API key. These are encrypted at rest (AES-256-GCM) before storage and are never shown again or returned to your browser once saved.
• Usage records — the number of emails sent, per account and project, and request records used to operate and protect the Service.
• Messages you send us — if you contact us, the content of your message and our reply.

2.2 Recipient data (processed for our Customers)

When a Customer sends through ReMail, we process, on their behalf:

• Email addresses and merged fields, in transit — recipient, copy, sender, and reply-to addresses, and the record fields merged into each email, pass through our servers on their way to the Customer's Resend account. We do not store the body of any email.
• A pseudonymous send log — for each email, we keep a one-way coded version of the primary recipient's address (a keyed hash), a masked hint of the address (its first character and full domain, for example j***@example.com), the email's subject line, the delivery status, any error, and Resend's message reference. Because subject lines are personalised, they may contain information from the recipient's record. We use this log to prevent duplicate sends and to show the Customer what was sent. Test emails a Customer sends to themselves are logged in the same way.
• Batch records — for each batch, the planned recipients (as the same coded and masked forms), the subject, status, and references to the Customer's Airtable base, table, and records. If the Customer enables batch logging, a matching record is written into the Customer's own Airtable base.
• Images — images from the Customer's Airtable records are fetched from Airtable when a recipient opens an email and may be cached for up to one day.

We do not add open or click tracking to emails. A Customer may enable such tracking in their own Resend account, under their agreement with Resend.

2.3 What we receive from Google

When you sign in with Google, we request only the openid and email scopes. Google therefore discloses to us your email address and whether it has been verified — nothing else. We use it only to sign you in. We do not use Google user data for advertising, we do not sell it, and we do not use it to train machine-learning models. Data obtained through Google APIs is used and transferred in accordance with the Google API Services User Data Policy, including its Limited Use requirements.

2.4 Cookies, storage, and third-party content

We do not use advertising cookies, cross-site tracking, or analytics pixels. The application stores in your browser's local storage your sign-in session, the campaign tag described in Section 2.1, the address you last used for test emails, and interface preferences. Our pages load fonts from Google Fonts, which means your browser sends your IP address to Google when it fetches them.

2.5 Children

The Service is for business and professional use and is not directed to children. We do not knowingly collect personal information from children under 13.

3. How we use information

We use personal information to:

• operate, maintain, and secure the Service, and deliver Customers' emails through their Resend accounts;
• prevent duplicate sends and show Customers their sending history;
• send transactional messages, such as sign-in links and codes, and account messages;
• send you product updates and onboarding emails about our products (see Section 4);
• understand how the Service is used, including which campaigns bring new users, enforce allowances, and plan capacity;
• detect, investigate, and prevent abuse, spam, fraud, and security incidents;
• comply with legal obligations, and diagnose and fix faults.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We never add Recipients to our own mailing lists or use Recipient data for our own purposes.

4. Product-update and onboarding emails

Because ReMail shares its sign-in with our other products, when you create an account we add your email address to our product-update list, hosted by Resend, and may send you onboarding emails. You can opt out at any time by emailing privacy@aeropage.io, or by using an unsubscribe link where one is included. Opting out does not stop transactional messages about your account.

5. Legal bases (where the UK/EU GDPR applies)

For Customer account data we rely on: performance of a contract (providing the Service you signed up for); legitimate interests (securing the Service, preventing abuse, measuring usage and campaign performance, improving reliability, and telling existing users about our products — which you can object to at any time); and legal obligation where applicable. Where we act as a processor for Recipient data, the Customer is responsible for establishing the legal basis for that processing and for any consent required to email Recipients.

6. Service providers and international transfers

We use the following providers to run the Service. They process personal information only to provide their services to us, under contractual confidentiality and security obligations:

Customers' emails are delivered by Resend under the Customer's own Resend account, not ours. Resend's storage and handling of those emails is governed by the Customer's agreement with Resend.

Aeropage Limited is established in the United States, and these providers may process data in the United States and other countries. Where personal information is transferred out of the UK or EEA, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK Addendum where applicable.

7. Security

We apply technical and organisational measures appropriate to the risk, including: encryption in transit (TLS); encryption at rest for stored credentials; storing recipient addresses in the send log only in coded and masked form; per-account access controls on stored records; rate limiting; and restricted administrative access. We do not log email addresses, email content, or record data in our server logs.

No system is perfectly secure, and the Service may contain defects. Some content is intentionally reachable without signing in so that it can appear in emails: uploaded logos are stored at public addresses, and images from Airtable records are served through links that anyone holding them can open. As set out in Sections 10 and 17 of the Terms, Customers control their configuration and connected accounts. If a personal-data breach affects you, we will notify you and, where required, the relevant authorities, without undue delay.

8. Retention

Deletion. Deleting a project in the application moves it to the trash; it does not yet permanently delete it. To permanently delete a project, your stored credentials, your logos, your send history, or your whole account, email privacy@aeropage.io from your account email address and we will complete the deletion within 30 days, except for limited records we must keep for legal, accounting, or security reasons. Deleting data in ReMail does not delete emails held in your Resend account or records in your Airtable base; manage those directly with those providers.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information; to object to or restrict certain processing, including direct marketing; to withdraw consent where processing is based on consent; and to complain to your data-protection authority (in the UK, the Information Commissioner's Office). Residents of California and other US states with comprehensive privacy laws have comparable rights, including the right not to be discriminated against for exercising them — noting that we do not sell personal information or share it for cross-context behavioural advertising.

To exercise any of these rights over data we hold as a controller, contact privacy@aeropage.io. We will respond within the period required by applicable law. If you are a Recipient, please contact the sender of the email — they control your data, and we will support them in responding.

10. Changes to this Policy

We may update this Policy from time to time. If we make a material change, we will update the "Last updated" date above and, where appropriate, notify you through the Service or by email. We will update the provider list in Section 6 before adding a new provider that processes Recipient data.

11. Contact

Aeropage Limited
1111B S Governors Ave STE 7987, Dover, DE 19904, United States
Privacy: privacy@aeropage.io
Legal: legal@aeropage.io