Privacy policy

This is an English translation for your convenience. The German version is legally binding.

This policy explains which personal data we process when you visit routira.com, request an invite, write to us or use Routira (app.routira.com and the apps for Mac, iPad and iPhone). It covers why we process it, on which legal basis, who else receives it, how long we keep it and which rights you have under the General Data Protection Regulation (GDPR).

In short#

• Your mail is stored in the EU. The database is in Frankfurt, and original messages and attachments are kept in EU storage, encrypted by Routira before they're stored.
• The AI features run on OpenAI in the USA. Storage of requests at OpenAI is switched off, and neither OpenAI nor we use your mail to train AI.
• Sign-in codes and mail to routira.com and in.routira.com addresses (our own, and forwarding shared mailboxes) pass through our email provider Letterpier in Germany, with a default retention of 30 days.
• We don't sell your data, we don't show ads, and routira.com uses no cookies, analytics or trackers.
• You can ask us at any time what we store about you, and have it deleted.

1. Who is responsible#

The controller under Art. 4 (7) GDPR is:

Michael Ketzer
Rotkehlchenweg 51
40789 Monheim am Rhein
Germany
Phone: +49 1523 7777631
Email: privacy@routira.com

Michael Ketzer runs Routira as a sole trader ("we", "us"). More in our imprint.

We have not designated a data protection officer. For all questions about data protection, write to privacy@routira.com.

If you use Routira for a company or another organization, for example in a team workspace, that organization is responsible for the mail processed there, and we process it on its behalf (section 5).

2. Visiting routira.com#

Hosting and server logs#

Our website is hosted by Vercel Inc. (USA). When you open a page, your browser automatically sends data that Vercel processes on our behalf to deliver the page and to protect it against attacks: your IP address, the date and time, the page requested, the referring page, the amount of data transferred, the status code, and your browser and operating system. We don't combine this data with other data and don't use it to identify you.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is delivering the website securely and reliably. Vercel keeps these logs for at most 30 days. Our site runs in Vercel's Frankfurt region; static files are delivered through Vercel's worldwide network, so your request may be answered by a server near you. On Vercel and transfers to the USA, see sections 8 and 9.

No cookies, no analytics, no third parties#

routira.com sets no cookies and uses no analytics, tracking or advertising tools. Fonts, scripts and images come from our own website, so your browser contacts no other company when you visit it. That's why there's no cookie banner.

If you switch between light and dark mode, your browser remembers the choice in its local storage (rt-theme). If you pause the animations on the home page, it remembers that locally too (rt-motion). Both stay on your device, aren't sent to us, and are strictly necessary for the function you asked for (§ 25 (2) no. 2 TDDDG).

Requesting an invite#

Routira is in a private alpha. When you request an invite, we receive the details you enter: your email address and, depending on the form, your name, your company, whether you want Routira for yourself or your team, your mail provider and a note. We also receive the language of the page and the time of the request. Our website doesn't store the request: it passes it to our email provider Letterpier, which delivers it as an email to hello@routira.com, where it arrives in our own Routira workspace. To stop abuse, the website counts the requests sent per IP address (for IPv6, per network range) for 10 minutes, in memory only. The IP address isn't stored or passed on.

We use your details to review your request, to invite you and to answer your questions. We don't add you to a mailing list. Legal basis: Art. 6 (1) (b) GDPR (steps taken at your request before entering into a contract).

We delete your request once you've been invited and have created your account. If we can't offer you a place, we delete it at the latest 12 months after you sent it. You can ask us to delete it sooner at any time. Letterpier keeps message content and events for 30 days by default (configurable from 1 to 90 days), in Germany; its mail server keeps raw mail for 7 days and metadata for 30 days. Backups keep seven daily recovery points. A historical backup made on 29 September 2026 does not expire automatically; it only contains data present on that date.

3. Writing to us#

You can reach us at hello@routira.com, privacy@routira.com, security@routira.com and our other @routira.com addresses, and by phone.

When you email us, we process your email address, your name, the content of your message including attachments, and our reply. Mail to any @routira.com address is received by Letterpier (Germany) and passed on to our own Routira workspace, where only Michael Ketzer can read it. Our replies go out through Letterpier too. Letterpier keeps message content and events for 30 days by default (configurable from 1 to 90 days), in Germany; its mail server keeps raw mail for 7 days and metadata for 30 days. Backups keep seven daily recovery points. A historical backup made on 29 September 2026 does not expire automatically; it only contains data present on that date. Within Routira, your message is stored like all mail in Routira (section 4.3). We use it only to answer you and to meet our legal obligations. Routira's AI features, such as summaries and reply suggestions, are available in our workspace too; section 4.4 applies to them.

Legal bases: Art. 6 (1) (b) GDPR if your message concerns your account or a contract with us; Art. 6 (1) (c) GDPR for requests under data protection law, which we're legally obliged to answer; otherwise Art. 6 (1) (f) GDPR, our legitimate interest in answering the people who contact us and, for security reports, in keeping Routira secure.

How long we keep it: general and support messages for 24 months after the conversation ends; data protection requests until the end of the third year after the year in which we closed them, so we can show we handled them; security reports until the problem is fixed and then for 24 months. We keep messages longer only where commercial or tax law requires us to keep business letters, or while we need them to establish, exercise or defend legal claims.

When you call us, we write down only what we need to handle your request.

4. Using Routira#

This section covers app.routira.com and the Routira apps for Mac, iPad and iPhone. We're the controller for this processing, except where section 5 applies.

4.1 Your account and signing in#

To create and use an account, you need an email address. We store it together with your name if you add one, your language, time zone and settings, and the workspaces you belong to and your role in them.

You sign in with a six-digit code that we send to your email address through Letterpier. The code is valid for 10 minutes, allows five attempts and is stored only as a hash. After you sign in, you stay signed in on that device until you sign out. If you don't use Routira there for 30 days, the session ends.

To protect accounts, we store the IP address and browser each session was started with, and we count sign-in attempts per IP address. We use this to detect and stop misuse. We currently keep the session details for as long as your account exists, and the count for an IP address until the next sign-in attempt from that address replaces it. You can ask us to delete them sooner at any time.

Legal bases: Art. 6 (1) (b) GDPR for your account; Art. 6 (1) (f) GDPR for the details kept against misuse, based on our and your legitimate interest in protecting accounts against misuse.

4.2 Connecting your mailbox#

To connect a mailbox by IMAP and SMTP, you give us its server details, your username and your password (or an app-specific password). Routira encrypts these credentials with a key of their own before storing them (envelope encryption with AES-256-GCM). They're decrypted only in the memory of our servers, to sync your mail and to send the messages you send. When you disconnect the mailbox, we delete the credentials and destroy their key immediately.

Your mail provider (for example OVHcloud) isn't our processor. You have your own contract with it, and Routira connects to it on your instruction. Its privacy policy governs what it does with your mail. If you change your password there or your provider blocks access, Routira can no longer sync until you reconnect.

Legal basis: Art. 6 (1) (b) GDPR.

Google user data (Gmail and Google Workspace)#

This section covers Gmail and Google Workspace accounts you connect to Routira. It adds to section 4.2.

How you connect. You sign in at Google, not in Routira, and Google asks you to allow one permission: "Read, compose, and send emails from your Gmail account, and manage your labels" (the gmail.modify scope). Routira never sees your Google password, and it doesn't use your Google account to sign you in to Routira. While Google's review of Routira is still running, Google shows a notice that the app isn't verified yet, and only invited people can connect Gmail.

What Routira accesses and why.

• Your messages with their attachments, labels, read and starred state: to show your mail in Routira and keep it in sync in both directions, so a change in Routira shows in Gmail and the other way round.
• Your Gmail address and the mailbox's history number: to know which account it is and to fetch only what changed since the last sync.
• Your labels: Routira shows them as folders, and a folder you create, rename or delete in Routira is changed in Gmail too (deleting a label never deletes its mail).
• Your send-as addresses (the aliases you set up and verified in Gmail): so you can choose them as From in Routira. Routira reads them and doesn't change them.
• The messages you send from Routira: they go out through Gmail, so Gmail keeps the Sent copy as usual.
• The features you use work on this data like on any other mailbox: search, rules, notifications and, if you use them, the AI features in section 4.4.

Routira never deletes mail at Google for good. When you delete a message in Routira, it moves to Gmail's Trash.

Storage and security. Google's access and refresh tokens are encrypted with a key of their own before they are stored (envelope encryption with AES-256-GCM) and are only decrypted in the memory of our servers to sync and send. Routira's copies of your Gmail messages are stored like every other mailbox's (sections 4.3 and 13), in the EU.

Sharing. Google user data is shared only with the service providers in section 8, and only as far as they need it to run Routira for you (hosting, database, storage, job runner and, if you use AI features, AI processing). They process it on our instructions and may not use it for their own purposes. We don't sell Google user data and don't use it for advertising.

Limited Use. Routira's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Routira uses Google user data only to provide and improve the features you see and use in Routira.
• It transfers the data to others only as needed to provide or improve these features, for security (for example to investigate abuse), to comply with applicable law, or as part of a merger, acquisition or sale of assets, and then only after telling you.
• It never uses or transfers the data for advertising, including retargeting, personalized or interest-based ads.
• It never transfers or sells the data to third parties such as advertising platforms, data brokers or information resellers, and never uses or transfers it to determine creditworthiness or for lending.
• Nobody at Routira reads your Gmail data, unless you have explicitly agreed to it for specific messages (for example in a support request), it's needed for security reasons, it's required by law, or the data has been aggregated and anonymized for internal operations.
• It never uses the data to develop, improve or train generalized AI or machine learning models, and neither may its AI provider (section 4.4).

Push updates. If Gmail push is switched on for your account, Google Cloud Pub/Sub tells us that your mailbox changed. The notice carries only your address and the mailbox's history number, never mail. Routira then fetches the change from Gmail.

Retention and deletion. When you disconnect the account in Settings → Mail accounts, Routira revokes its access at Google right away, deletes the tokens and destroys their key, and deletes its copies of your Gmail mail and everything derived from them within 30 days (section 10). Your mail at Google stays untouched. You can also remove Routira's access at any time at myaccount.google.com/permissions; Routira then stops syncing and asks you to reconnect.

Legal basis: Art. 6 (1) (b) GDPR.

4.3 Your mail in Routira#

Routira keeps a synced copy of the mail in the mailboxes you connect, so it can show, search, sort and share it: senders and recipients, subject, date, message text, attachments, folders and flags. It also stores what you and your team add (notes, mentions, assignments, projects, folders, Later and Done) and what Routira derives from your mail (categories, priorities and their reasons, deadlines, summaries, agreements with their quotes, and a search index).

Where it's stored:

• Database. Message text, metadata, derived data and settings are stored in a Postgres database operated by Neon (Databricks, Inc.) in the AWS region Frankfurt, Germany. The provider encrypts it at rest.
• Original messages and attachments. They're stored in Cloudflare R2 with EU jurisdiction. Routira encrypts them before uploading (AES-256-GCM, with a key per workspace), so Cloudflare can't read them.
• Background jobs. Syncing, sending, reminders and notifications run on our own job server (a self-hosted Trigger.dev instance that we operate ourselves) on a server we rent from OVH GmbH in Germany. It processes mail in memory while it works.

Your mail stays with your provider. Routira changes it there only when you act in Routira (for example when you move or delete a message), and it never sends a message you didn't send.

Routira blocks images and other content a message would load from other servers. If you choose to load a message's images, your device fetches them directly from the sender's server, which then sees your IP address and when you opened the message.

We look at the content of your mail only if you ask us to in a support case, or where it's necessary to investigate a security incident or to comply with a legal obligation.

Legal basis: Art. 6 (1) (b) GDPR for your own data. For the data of people who write to you, see section 6.

4.4 AI features#

Routira uses AI to sort and prioritize your mail and to help you work with it:

• a category and a priority from P1 to P4 for each message, with a short reason, and deadlines you must handle;
• summaries of messages and conversations;
• smart replies and drafts;
• agreements, commitments and deadlines found in your mail, each with the quote it comes from;
• Ask Routira, which answers questions about your mail and names its sources;
• a search index that understands meaning (embeddings).

For each task, Routira sends OpenAI the text it needs: usually the subject, the names and addresses of senders and recipients, and the text of the messages concerned; for Ask Routira, your question and the passages relevant to it. Our contracting partner is OpenAI Ireland Ltd (Dublin, Ireland); the processing takes place on OpenAI's servers in the USA. We use OpenAI's API with storage of requests and responses switched off, and OpenAI doesn't use API data to train its models. OpenAI may keep requests for up to 30 days to detect abuse and then deletes them. We don't use your mail to train AI models either. We don't use OpenAI's EU data residency yet. We'll update this policy before we change where AI requests are processed.

Mail in your own mailboxes goes to OpenAI only after you've turned the AI features on: the app asks once and records your answer. You can switch them off again at any time in the settings. In team workspaces, AI on the team's mail also waits until an admin has accepted the data processing agreement, and admins can switch the AI features off for the whole workspace; mail from such a workspace isn't sent to OpenAI.

Everything the AI produces is marked as AI in Routira (section 12). AI can be wrong, so check summaries, drafts and extracted agreements before you rely on them. Routira never sends an AI draft without your action.

Legal bases: Art. 6 (1) (b) GDPR, because the AI features are part of the service you use; for the data of people who write to you, Art. 6 (1) (f) GDPR (section 6). On the transfer to the USA, see section 9.

4.5 Shared mailboxes and teams#

In a team workspace, the people you work with see what they have access to: shared mailboxes according to their rights (Viewer, Member or Manager), assignments, notes and mentions, and conversations you share with the team. Your name, your email address and your activity in the workspace (for example who assigned or answered a conversation) are visible to other members. Security-relevant actions in a workspace are recorded in an audit log. Its entries contain no mail content and are kept as long as the workspace exists.

4.6 Realtime updates#

So that changes appear at once on all your devices and for your team, Routira sends short signals through Pusher, a service of Bird B.V. (Netherlands), that something has changed. These signals contain only technical IDs, never mail content. Pusher processes them in its EU cluster in Ireland and doesn't store them.

Legal basis: Art. 6 (1) (b) GDPR.

4.7 Notifications#

If you allow notifications, Routira notifies you according to the priority of your mail. For this, we store a push token for each device.

• Mac, iPad and iPhone. Notifications are delivered by Apple's Push Notification service (APNs). By default they show only the mailbox or folder and the reason for the notification, without sender or subject. If you turn on previews for a device, the sender, the subject and, if you choose, the first line of the message are passed to Apple so they can be shown.
• Browser. Notifications are delivered by your browser's push service (for example Apple, Google or Mozilla). Their content is encrypted end to end for your browser, so the push service can't read it.

You can switch notifications off at any time in Routira or in your device settings. We delete a push token when you sign out on that device or when the token is no longer valid.

Legal basis: Art. 6 (1) (b) GDPR.

4.8 Mail to Routira addresses#

Routira can give you addresses at in.routira.com, for example for projects or for shared mailboxes that receive forwarded mail. Mail sent to these addresses is received by Letterpier in Germany and passed straight on to Routira, where it's stored like all your mail. Letterpier keeps message content and events for 30 days by default (configurable from 1 to 90 days), in Germany; its mail server keeps raw mail for 7 days and metadata for 30 days. Backups keep seven daily recovery points. A historical backup made on 29 September 2026 does not expire automatically; it only contains data present on that date.

Legal bases: Art. 6 (1) (b) GDPR; for the senders' data, Art. 6 (1) (f) GDPR (section 6).

4.9 The apps and TestFlight#

The Routira apps for Mac, iPad and iPhone show the Routira web app and add notifications and system features. Your sign-in is kept in your device's keychain, and the app stores the web app's data locally (section 4.11).

During the alpha, we distribute the apps through Apple's TestFlight. Apple then gives us your name and email address (if we invited you by email), your device model and operating system version, the install date, session and crash counts, crash logs, and any feedback you send through TestFlight (comment, screenshot, device and app details). We use this only to run the test and fix problems. We delete it from our own records when the test ends or the problem is fixed. What Apple processes itself is governed by Apple's privacy policy.

Legal bases: Art. 6 (1) (b) GDPR and Art. 6 (1) (f) GDPR, based on our legitimate interest in apps that work.

4.10 Emails from Routira#

We send sign-in codes and service emails (for example invitations to a workspace, security notices or notice of important changes) through Letterpier. They contain no tracking pixels and no tracked links.

Legal basis: Art. 6 (1) (b) GDPR.

4.11 Storage on your device#

The web app and the apps store on your device only what they need to work. This is strictly necessary for the service you asked for (§ 25 (2) no. 2 TDDDG), so we don't need your consent and don't show a banner. None of it is used for tracking.

5. Using Routira for an organization#

If you use Routira on behalf of a company or another organization, especially in a team workspace, the organization decides what happens to the mail processed there and is its controller. We process this mail on its behalf and according to its instructions, as a processor under our data processing agreement (Art. 28 GDPR).

If you're a member of such a workspace, please direct requests about this data to your organization first. If you contact us, we forward your request to it and help it answer.

We remain the controller for our own processing, for example your account, sign-in, security logs and our communication with you.

6. People who write to Routira users#

When someone uses Routira, we process the data of the people who exchange mail with them: names, email addresses, the content of messages and attachments, and anything else those messages contain. This data comes from the mailboxes our users connect.

We process it to provide Routira to our users, including the AI features (section 4.4). Legal basis: Art. 6 (1) (f) GDPR, based on our users' and our legitimate interest in organizing, understanding and answering correspondence efficiently. We protect this data like our users' own, use it for no other purpose, and delete it when the user deletes the message or disconnects the mailbox. In team workspaces, the organization is responsible (section 5).

We can't identify and inform everyone who writes to our users without disproportionate effort, so we provide this information publicly here (Art. 14 (5) (b) GDPR). You have the rights described in section 14. Please contact privacy@routira.com.

7. Legal bases at a glance#

8. Who receives data#

We use the following service providers as processors. They process data only on our instructions, under a data processing agreement with us:

The full list with legal entities, the data each provider receives and the transfer safeguards is on our subprocessor page.

Other recipients:

• Your mail provider. Routira connects to it on your instruction. It isn't our processor.
• Apple (Apple Inc., USA) delivers notifications on Mac, iPad and iPhone (APNs) and distributes the apps through TestFlight during the alpha. Apple isn't our processor here; it acts under its own terms, and there's no data processing agreement with Apple. Apple receives the device token and the text of the notification: by default only the mailbox or folder and the reason, and sender and subject only if you switch previews on (section 4.7). For TestFlight, see section 4.9.
• Your browser's push service delivers notifications in the browser, with content encrypted end to end.
• The people you work with in a team workspace see what they have access to (section 4.5).
• Authorities and courts, only where we're legally obliged to disclose data (Art. 6 (1) (c) GDPR), and legal advisers, where necessary to establish, exercise or defend legal claims (Art. 6 (1) (f) GDPR).

We don't sell personal data and don't pass it on for advertising.

9. Transfers outside the EU#

Some of our service providers are based in the USA or process data there:

• OpenAI (AI features) processes data in the USA.
• Vercel, Databricks (Neon) and Cloudflare are US companies. They store our data in the EU, but may access it from the USA in individual cases (for example for support or security) and are subject to US law.
• Apple processes data for push notifications and TestFlight in the USA.
• Pusher (Bird B.V., Netherlands) processes data in the EU. The service is also operated by companies of the Bird group in the United Kingdom, for which the EU has adopted an adequacy decision (Art. 45 GDPR).

Safeguards: the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR), which are part of our providers' data processing agreements. In addition, Vercel, Databricks and Cloudflare are certified under the EU-U.S. Data Privacy Framework, for which the EU has adopted an adequacy decision (Art. 45 GDPR). Apple provides push notifications and TestFlight under its own terms, as an independent controller, and bases transfers from the EU on the EU Standard Contractual Clauses, according to its privacy policy. We keep what Apple receives to a minimum: by default, notifications contain no sender or subject (section 4.7). You can ask us for a copy of the safeguards at privacy@routira.com.

10. How long we keep data#

When you delete your account, we delete your account and its data without undue delay, at the latest within one month. Backups age out within a further 30 days. Conversations you shared into a team workspace stay with that team. We keep data longer only where the law requires it (for example commercial or tax retention periods) or while we need it to establish, exercise or defend legal claims.

11. Automated decisions and how Routira sorts mail#

We don't make decisions based solely on automated processing that have legal effects on you or similarly significantly affect you (Art. 22 GDPR).

Routira sorts and prioritizes mail automatically. It combines rules and your settings with an AI assessment of the content and suggests a category and a priority from P1 to P4, with a short reason you can see. This determines the order in which mail appears and whether and how you're notified. It doesn't delete, send or permanently hide anything. You can change any category or priority at any time. For people who write to our users, the sorting only affects how soon our user sees their message.

12. AI transparency#

In line with Art. 50 of the EU AI Act (Regulation (EU) 2024/1689), Routira tells you when you're dealing with AI. Ask Routira presents itself as an AI assistant. Summaries, drafts and smart replies, priorities with their reasons, categories and extracted agreements produced by AI are marked as AI in the app. AI results can be wrong. Please check them before relying on them.

13. Security#

We protect your data with technical and organizational measures: encrypted connections, encryption of original messages, attachments and mailbox credentials by Routira, access controls, and hosting in the EU. Details are on our security page.

14. Your rights#

You have the right:

• to access the data we hold about you (Art. 15 GDPR);
• to have incorrect data corrected (Art. 16 GDPR);
• to have your data erased (Art. 17 GDPR);
• to restrict processing (Art. 18 GDPR);
• to receive your data in a structured, commonly used, machine-readable format, or have it transmitted to someone else (Art. 20 GDPR);
• to withdraw consent at any time with effect for the future (Art. 7 (3) GDPR);
• to lodge a complaint with a supervisory authority (Art. 77 GDPR).

Right to object#

You have the right to object at any time, on grounds relating to your particular situation, to processing of your data that is based on Art. 6 (1) (f) GDPR (Art. 21 GDPR). We then stop processing it, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. Write to privacy@routira.com.

How to exercise your rights#

Write to privacy@routira.com, ideally from the email address your account uses. We confirm your request and answer within one month (Art. 12 (3) GDPR). If we have reasonable doubts about your identity, we may ask you to confirm it. You can disconnect mailboxes in Routira yourself at any time. Until you can export your data and delete your account in the app, we do it for you on request by email.

If your request concerns a team workspace, we forward it to the organization responsible (section 5).

Supervisory authority#

The supervisory authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2-4
40213 Düsseldorf
Germany
poststelle@ldi.nrw.de

You can also contact any other supervisory authority, in particular the one where you live or work.

15. Do you have to provide data?#

You don't have to provide any data to visit routira.com. To request an invite, we need your email address. To use Routira, you need an account with an email address, and to connect a mailbox, its access data. Without them, we can't provide Routira.

16. Minimum age#

Routira is for people aged 18 and over. If we learn that an invite request or an account belongs to someone younger, we delete the request, or close the account and delete its data.

17. Changes to this policy#

We update this policy when Routira, the law or our service providers change. The date at the top shows the current version. We'll tell account holders about significant changes by email before they take effect.

• 27 September 2026: first version.