1. Who is responsible for your data
- Controller: WEBFICY LIMITED.
- Registered office: Workhub, 51 Bracken Road, Sandyford, Dublin, D18 CV48, Ireland.
- Company number: 827149.
- Privacy contact: support@getremma.com.
2. Services and people covered
This policy applies to visitors, registered users, VPN subscribers, mailbox
users, support requesters, and people who link a Telegram account. It covers
getremma.com, app.getremma.com, GetRemma webmail, and the official GetRemma
Android and iOS applications.
Third-party websites and apps have their own policies. When a VPN connection reaches a destination outside GetRemma, that destination remains responsible for its own processing.
3. Data we process
| Category | Examples | Why we use it | Legal basis or planned basis | Retention boundary |
|---|---|---|---|---|
| Account and recovery | Email address, display name, password hash, recovery address, legal acceptance records | Create and secure the account, authenticate you, recover access, and record the terms presented | Contract; security and compliance legitimate interests; legal obligation where applicable | While the account is active; specific security and legal records follow the periods below |
| Mailbox and communications | Messages, attachments, folders, contacts, addressing and delivery metadata, spam-filter signals | Provide email, deliver and filter messages, and troubleshoot delivery | Contract; security and abuse-prevention legitimate interests | Until the user deletes the content or mailbox, subject to backups, queues and legal holds |
| Web and mobile sessions | Session identifiers, access and refresh tokens, login time, IP address, user agent and security events | Maintain sessions, prevent replay and abuse, and investigate failed or suspicious authentication | Contract; security legitimate interests | Web idle timeout is normally 2 hours and authenticated absolute lifetime 12 hours; mobile access tokens 15 minutes, refresh idle window 30 days and session absolute window 90 days. Some historical rows need a separate approved pruning policy |
| Installation and device | Random installation identifier, device label supplied by the app, platform, OS and app/build version, supported VPN engines and capabilities | Register an installation, bind credentials, show registered devices and provide compatible configuration | Contract; security legitimate interests | For the installation/account lifecycle; deletion revokes and removes account-linked installation data. Some historical operational rows do not yet have a general expiry rule |
| VPN control plane | Subscription entitlement, selected country/location, device public key, VPN assignment, configuration revision, connection attempt and revocation status | Issue, rotate and revoke VPN access and prevent stale or replayed configuration | Contract; security legitimate interests | Active data for the service lifecycle; many operational history records do not yet have an approved general expiry |
| Tunnel traffic | Network packets that VPN nodes must forward while you are connected | Provide the VPN tunnel | Contract | Processed in transit. Inspected nodes showed no configured destination access-log path, but not every node has completed the same audit and warning/error journals exist; we therefore do not promise universal zero logging |
| Traffic accounting and local connection totals | Xray byte counters and service aggregates; local per-connection upload/download totals | Operate access, capacity and product counters | Contract; service-operation legitimate interests | Local counters reset with the app/connection state. Backend Xray aggregates currently have no approved general expiry; WireGuard backend accounting is currently disabled |
| Location latency | Short TCP reachability and latency result for a server location | Help display connection quality and choose a location | Contract | Cached in app memory for about 60 seconds; no backend persistence was found in the accepted flow |
| Support | Request text, replies, status, contact details and delivery/audit metadata | Respond to and administer support cases | Contract; legitimate interests in support quality and evidence | Resolved cases 90 days; read notifications 60 days; unread notifications 90 days; terminal delivery intents 30 days; post-closure audit 180 days |
| Optional diagnostics | App/build/platform/engine versions, capability flags, bounded connection stages, failure codes, validated location code and elapsed-time buckets | Diagnose a problem that you choose to report | Consent for the optional attachment; contract/legitimate interests for the support case | Local queue: at most 3 bundles of 64 KB each, with expiry. Server diagnostic payload: 30 days. The accepted schema excludes IP, DNS and browsing destinations |
| Registration and security telemetry | Registration device token, rate-limit window, IP/user-agent context and pseudonymized security signals | Prevent automated registration, credential abuse and attacks | Security legitimate interests | Detailed AUTH-P1 events: 35 days. Registration window: 30 days. Some general monitoring and limit rows need a separate approved expiry |
| Telegram integration | Telegram user/chat identifier, username snapshot, link state and notification jobs | Link the optional integration and deliver requested notifications | Contract or consent, depending on the requested feature | Removed from GetRemma during account deletion; Telegram applies its own retention. A general expiry for every historical job is not yet proven |
| Billing and promotions | Store/provider customer, session, subscription, invoice and webhook references; amount, currency, status and promo redemption | Process or verify purchases, provide access and prevent payment abuse | Contract; legal obligation; fraud-prevention legitimate interests | Kept as needed for the service, disputes, accounting and tax obligations; provider records are subject to the provider's own retention rules |
| Transactional email | Recipient, template/dispatch state and delivery/webhook metadata | Send verification, security and service messages | Contract; security legitimate interests | A complete general expiry has not yet been approved |
| Web consent and preferences | Language, cookie choices and timestamps | Remember settings and prove/apply a current choice | Necessary storage; consent for optional analytics | Language up to 1 year; consent preference 180 days |
| Aggregate website measurement | UTC hour, allowlisted page, two-letter country, coarse source, allowlisted internal transition and counter | Understand overall demand and navigation without creating a visitor profile | Proposed legitimate interests, subject to a documented balancing assessment before activation | 25 months by default; no IP, raw referrer, query, account, browser, device, OS, city, visitor ID or session ID is stored |
| Consented Umami analytics | Page path, title, hostname, referrer origin, browser/language/screen signals, events, country/region/city and Umami session/visit hashes | Measure visits, journeys and page performance when analytics is accepted | Consent | New data must receive an approved retention window before activation. Existing historical Umami data requires a separate retention decision |
4. VPN data and logging boundary
GetRemma VPN nodes must receive and forward packets while the tunnel is active. We do not use VPN traffic to target advertising and we do not sell VPN traffic data. We do not intentionally create a browsing-history product or store the content of traffic carried through the tunnel.
WireGuard does not normally create destination or content logs. In the selected VLESS configuration, Xray access-log output was not configured on the nodes we could inspect. Infrastructure and security components may still produce connection, warning or error records, and not every node has completed the same independent inspection. For that reason, this policy deliberately avoids a blanket “no logs” promise.
The VPN protects traffic between your device and the VPN endpoint. Protection between the endpoint and a destination depends on the destination protocol, such as HTTPS. A VPN does not make information you give to a website anonymous.
5. Website analytics and country measurement
GetRemma has two separate measurement layers. The aggregate baseline is currently disabled:
- Aggregate baseline. On a small allowlist of public marketing pages, the server may increment an hourly aggregate for page, two-letter country, coarse source and an allowlisted internal transition. IP address is converted in memory using a local country database and discarded. No visitor or session identifier is created, so this layer cannot count unique people.
- Optional Umami analytics. Self-hosted Umami loads only after a current analytics choice is accepted. It uses no analytics cookie, but generates session/visit hashes from technical signals and records more detailed visit and device information. Query strings are removed and referrer data is reduced before GetRemma sends an event. Withdrawal or expiry blocks new sends.
The aggregate baseline will remain disabled until its legal assessment and local country-data licence and attribution are verified.
6. How we obtain data
We receive data directly from you, automatically from your browser or app when you use a requested feature, from the VPN endpoint needed to operate your connection, and from providers involved in a purchase, message delivery, Telegram link, or support workflow. We do not buy advertising profiles.
7. Recipients and processors
Data is available only to personnel and providers who need it for the purposes above. Depending on the feature, these may include hosting and VPN infrastructure providers, Mailcow and delivery infrastructure, Telegram, Stripe, Apple, Google, and the store or payment provider selected by the user.
We assess providers' roles, locations and appropriate protections before sharing data with them. Apple, Google, Telegram and payment providers may also act independently under their own policies for parts of their services.
We may disclose limited data when required by law, to protect users or the service, or in connection with a corporate transaction subject to appropriate safeguards. We do not sell personal data.
8. International transfers
Service providers and VPN endpoints may be located outside your country and outside the European Economic Area. The applicable transfer protection depends on the provider and destination. Contact us for information about a particular transfer and its safeguards.
9. Retention, backups and deletion
We keep data only for the stated purpose, legal requirements, security and recovery. Where the table above does not state a fixed expiry, we do not promise a shorter period that current retention controls cannot support.
Account deletion signs the user out, revokes web/mobile and VPN credentials, removes Telegram links and pending notifications, deletes the mailbox, and deletes the main account workspace after required checks. A limited encrypted deletion-reconciliation manifest is marked for 210-day retention so an old backup cannot silently restore a deleted account.
Deletion does not automatically cancel an Apple, Google, Stripe or other provider subscription. Users must cancel active subscriptions with the provider where they purchased them. Payment records required for tax, accounting, disputes or fraud prevention, provider records, operational security records and backup copies may remain for their applicable periods. Restored backups must be reconciled against deletion manifests before data is exposed.
10. Security
We use access controls, credential rotation and revocation, encrypted transport, signed mobile configuration envelopes, rate limits, monitoring and deletion reconciliation. No internet service can guarantee absolute security. Please contact support if you believe your account or data is at risk.
11. Your rights and choices
Depending on applicable law, you may ask us to:
- access and receive a copy of your personal data;
- correct inaccurate or incomplete data;
- delete data;
- restrict or object to processing;
- provide portable data where the right applies;
- withdraw consent at any time, without affecting earlier lawful processing;
- explain a decision that materially affects you where applicable.
You can change optional Umami analytics through Cookie settings. When the baseline is enabled, the interface also provides a separate Aggregate site measurement objection control and honours supported Global Privacy Control and Do Not Track signals for future baseline requests. Already aggregated rows contain no visitor ID and cannot be located or separated by person. You can unlink Telegram and manage registered VPN devices in the service. You can use the in-app account deletion path or https://app.getremma.com/account/delete. Identity verification may be required. You may complain to the Irish Data Protection Commission or another competent supervisory authority.
12. Children
GetRemma is not directed to children under 13. You must be at least 13 to use the service, subject to any higher minimum age or parental-consent rule that applies where you live. The Terms of Use explain this rule.
13. Changes to this policy
We will publish the effective date and keep archived versions. Material changes may require notice or a new acknowledgement. Existing legal receipts remain bound to the exact version shown when they were created.
14. Contact
For privacy questions or requests, contact support@getremma.com. The controller name, company number and registered office are listed in section 1.