Legal
Recall24 Privacy Policy
Last updated: October 2, 2026
Recall24 keeps the text and files of an email only while the recipient can still read them, and deletes the text the moment you recall the email or its 24-hour window ends. This policy explains what we collect, why, how long we keep it and what you can ask of us.
Who we are
Recall24 is a product of RevokeMail. The controller of your personal data is LBV ehf., kennitala 670720-0980, Litlabæjarvör 17, 225 Garðabær, Iceland (“RevokeMail”, “we”).
Privacy questions and requests: privacy@revokemail.com
Help with the product: support@revokemail.com
This policy covers the Recall24 web app (app.revokemail.com), the Recall24 Outlook add-in, the Recall24 Gmail extension for Chrome, and the website revokemail.com.
What data we process
We collect only what Recall24 needs to deliver an email, show it to the recipient, and let the sender take it back. We do not read your mailbox.
Who | Data | Where it comes from |
|---|---|---|
Senders | Name, email address and account ID from Google or Microsoft | You, when you sign in with Google or Microsoft |
Senders | Recipient addresses, subject, message text and attached files of each email sent with Recall24 | You, when you send an email with Recall24 |
Senders | When each email was sent, opened, downloaded, recalled or expired; an optional reason for a recall | Recall24, as the email is used |
Senders | Product usage events (for example “email sent”, “recall clicked”) | Recall24. These events never contain message text, subjects or email addresses |
Recipients | Email address, and when the email and its files were opened or downloaded | The sender, and Recall24 when you open the link |
Website visitors | Pages visited and basic device information | Your browser, when you visit revokemail.com. Visits are counted with Framer Analytics, without cookies |
What the add-in and extension read. The Outlook add-in and the Gmail extension read the email you are writing only when you send it with Recall24. In a sent email, the Outlook add-in reads only that email’s text, to find its Recall24 link and show you its status. Neither reads your inbox, contacts or other emails.
What we do not do. We do not sell personal data, show ads, build advertising profiles, or use the content of emails to train AI models.
Why we use it and our legal basis
We process personal data under the EU General Data Protection Regulation (GDPR), which applies in Iceland through Act No. 90/2018.
Purpose | Legal basis (GDPR) |
|---|---|
Create and run your account; send, show, protect and recall your emails and files | Performance of our contract with you (Art. 6(1)(b)) |
Show the recipient the email the sender chose to send them, and tell the sender whether it was opened | Our and the sender’s legitimate interest in delivering and controlling the email (Art. 6(1)(f)) |
Keep the service secure, prevent abuse and fix errors | Legitimate interest (Art. 6(1)(f)) |
Understand how Recall24 is used, from events without message content or email addresses | Legitimate interest in improving the product (Art. 6(1)(f)) |
Answer your questions and requests | Contract or legitimate interest, depending on the request |
Keep records we must keep by law | Legal obligation (Art. 6(1)(c)) |
Count visits to revokemail.com with Framer Analytics, without cookies | Legitimate interest in understanding how the website is used (Art. 6(1)(f)) |
Businesses. When a company uses Recall24 for its staff, the company decides what its employees send. For that content we act as the company’s processor, under a data processing agreement available from privacy@revokemail.com.
How long we keep it
The text of an email is deleted as soon as it can no longer be read: when you recall it, or when its 24-hour window ends. A cleanup job runs every hour to make sure of this.
Data | Kept until |
|---|---|
Message text | The email is recalled or its 24-hour window ends |
Attached files | No recipient can open them any more (recall or end of window); files uploaded but never sent: 2 hours |
Recipient address, subject and times (shown in your dashboard) | 30 days after the 24-hour window ended |
Product usage events | 24 months |
Your account (name, email, account ID) | Until you ask us to delete it |
Sign-in to the web app | A session cookie that lasts 7 days |
Sign-in for the add-in and extension | A token stored on your device that lasts 30 days, or until you disconnect |
What we cannot take back. Once a recipient has opened an email or downloaded a file, they may have read, copied or saved it. Recalling the email stops further access through Recall24. It cannot remove what the recipient already saved.
Who processes data for us
We use a small number of service providers. Each processes data only on our instructions, under a data processing agreement.
Provider | What it does for Recall24 | Location |
|---|---|---|
Supabase | Database for accounts, emails and files | EU (Stockholm, Sweden) |
Netlify | Hosts the web app and runs its server code | United States |
Resend | Delivers Recall24 notification emails | United States |
Sign-in with Google | Global | |
Microsoft | Sign-in with Microsoft; the Outlook add-in runs in Outlook | Global |
Zoho | Our own mailboxes (hello@, support@, privacy@) | EU |
Framer | Hosts the website revokemail.com and counts visits without cookies (Framer Analytics) | Netherlands (Framer B.V.) |
Transfers outside the EEA. Where a provider processes data outside the European Economic Area, the transfer relies on the EU–U.S. Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.
We share data with authorities only when the law requires it.
Cookies and local storage
The Recall24 web app sets one strictly necessary cookie, which keeps you signed in for up to 7 days. It uses no advertising or tracking cookies. The Gmail extension and the Outlook add-in store a sign-in token on your device so you stay connected.
Google and Microsoft account data
From Google or Microsoft sign-in we receive only your name, email address and account ID. We use them only to sign you in and to show the recipient who sent the email. Recall24’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data for advertising, do not sell it, and do not use it to train AI models.
Security
All connections to Recall24 are encrypted (HTTPS/TLS). Data at rest is encrypted by our database provider. A recipient’s link is a long random code. Files can be downloaded only while the email is live, and only through that link. Access to production data is limited to the people who run Recall24. If a personal data breach puts your rights at risk, we will notify the data protection authority within 72 hours and inform you without undue delay.
Your rights
You can ask us to:
give you a copy of your personal data;
correct it;
delete it;
restrict or object to how we use it;
give you your data in a portable format.
Write to privacy@revokemail.com. We reply within one month. You can also complain to the Icelandic Data Protection Authority, Persónuvernd, or to the authority where you live.
Recipients can ask the same of us. Where we hold an email on behalf of a business, we will pass the request to that business.
Children
Recall24 is not intended for anyone under 16, and we do not knowingly collect their data.
Changes to this policy
When we change this policy we update the date at the top. If a change is significant, we will tell signed-in users before it takes effect.