Privacy Policy

This policy explains what we collect, why, who we share it with, and what you can ask us to do about it. It covers recurrr.com and the Recurrr application.

Who we are

Recurrr is operated by Complement Software SRL (VAT RO35962660), Calea Victoriei 142-148, Sector 1, Bucharest, Romania. We are the data controller for the information described here.

For anything privacy-related, email hello@recurrr.com. There's no ticket queue and no form to fill in — it goes to a person.

What we collect

Information you give us

• Your account: name, email address, timezone, password (stored hashed — we can't read it), and optionally what you're using Recurrr for.
• How you found us: when you sign up, the site that linked you here, the page you landed on, any campaign tags in the link, and — unless you declined advertising cookies on the banner — the Google click identifier from an ad. We use it only to see which of our own marketing works. If you declined advertising cookies, the click identifier isn't kept.
• The emails you schedule: subject, body, sender, recipients (to, cc, bcc, reply-to), any attachments, and the recurrence rule you set.
• Sending credentials: if you connect your own mailbox, the credentials or tokens needed to send on your behalf. These are stored encrypted.
• Billing details: handled by our payment provider, not by us. We only receive your billing name, country, and the fact that a payment succeeded.
• Anything you email us about support, feedback or bugs.

Information collected automatically

• Delivery records: when each scheduled email was sent, whether it succeeded, and any error returned by the mail server.
• Server logs: IP address, browser and device type, pages requested, and timestamps. Kept for security and debugging.
• Analytics and ad measurement: aggregate page views and referrers. In the EU, EEA, UK and Switzerland, until you answer the cookie banner, Google's tags run in a consent-denied mode that sets no cookies but does send Google your IP address, the page URL and the fact that consent is denied, so it can estimate how many visitors came from an ad. Elsewhere they run in full without a banner. See the Cookie Policy for exactly what runs and when.

What we do with it

What we don't do

• We don't sell your data, and we don't share it for anyone else's advertising.
• We don't scan your inbox or read your contacts. Recurrr only sends what you explicitly compose in it.
• We don't read your scheduled emails — except if you ask us to look at a specific one to solve a support problem, or where the law requires it.
• We don't train AI models on your emails.
• We don't use dark patterns to make declining cookies harder than accepting them.

Who else touches your data

We use a small number of companies to run Recurrr. They only process data on our instructions, under contract, and only for what's listed here.

We may also disclose data if we're legally required to — a court order, for example. If that happens and we're allowed to tell you, we will.

Where your data lives

Your account and everything you schedule are stored on servers in Frankfurt, Germany. They don't leave the EU while they're sitting in our database.

Sending is the exception worth knowing about: we hand outgoing mail to Amazon SES in the United States for delivery. So at the moment an email actually goes out, its subject, body, attachments and recipient addresses pass through US infrastructure — as, for that matter, does any email once it reaches a recipient on Gmail or Outlook.

Where a provider sits outside the European Economic Area, the transfer relies on the European Commission's Standard Contractual Clauses or an adequacy decision. If that's a dealbreaker for your organisation, tell us — it's useful to know how many people it affects.

How long we keep it

• Account and scheduled emails: for as long as your account exists. Delete a message and it's removed from our active database; backups age out within 30 days.
• Closed accounts: deleted within 30 days of you closing the account, apart from what we must keep for accounting.
• Invoices: retained as long as Romanian tax law requires — currently 10 years.
• Server logs: up to 90 days.
• Support emails: up to 2 years, so we have context if you write again.

Your rights

If you're in the EU or UK, the GDPR gives you the right to:

• Get a copy of the data we hold about you
• Correct anything that's wrong
• Have your data deleted
• Receive it in a portable, machine-readable format
• Object to or restrict certain processing
• Withdraw consent at any time — for cookies, use the cookie settings
• Complain to your national data protection authority. Ours is the Romanian ANSPDCP.

Most of this you can do yourself from your account settings. For anything else, email hello@recurrr.com and we'll respond within 30 days. It's free, and we won't ask you why.

People you send email to

When you schedule an email, you're the one deciding who receives it and what it says — so for those recipients, you're the data controller and we're processing on your behalf. Please only send to people who expect to hear from you. Recurrr is a tool for emails you'd otherwise write by hand, not for bulk marketing to purchased lists.

Security

Traffic is encrypted in transit with TLS. Passwords are hashed, and mailbox credentials are encrypted at rest. Access to production data is limited to the people who need it to operate the service. No system is perfectly secure, but if a breach ever affects your data, we'll tell you and the relevant authority within the timeframes the law sets.

Children

Recurrr isn't intended for anyone under 16. We don't knowingly collect data from children — if you believe we have, email us and we'll delete it.

Changes

If we change this policy we'll update the date at the top of this page. For anything significant we'll email you before it takes effect, and where the change relies on your consent we'll ask again rather than assume.