Privacy Notice

Recall is a relationship-intelligence tool for travel advisors. We store the advisor's own business data — client notes, supplier interactions, email metadata they choose to forward to us — so we can surface it back to them as a working memory. We do not sell that data, we do not share it with other advisors, and we delete it on request.

• Advisor profile: name, email, agency or consortium affiliation, and (optionally) the URL of your public brand site so we can pre-fill your profile during onboarding.
• Client memory: names, trip history, preferences, and notes you enter — or that we extract from emails you forward to your Recall inbox address.
• Inbox + calendar signals: if you connect your Gmail or Outlook mailbox, we read message data (sender, subject, snippet, and — where a feature needs it — message content) and read-only calendar events to surface client moments. See "Connected mailboxes (Gmail / Outlook)" below for exactly what a connection allows.
• Diagnostics: error reports (via Sentry) and anonymous product analytics (via PostHog) so we can find broken screens and understand which features advisors actually use.

Connecting a mailbox is optional. If you choose to connect your Google (Gmail) or Microsoft (Outlook) account, you grant Recall permission to:

• Read your mailbox — messages and their content — to detect client signals, surface follow-ups, and match replies to conversations Recall started on your behalf.
• Read your calendar (read-only) — to connect upcoming events to your clients and trips. We never create, edit, or delete calendar events.
• Send email from your account — only messages that have gone through an explicit approval step in Recall before dispatch: something you approve yourself (for example "Approve & Send" in your Feed), or a campaign that you or an authorized operator on your account has reviewed and scheduled. Recall never generates and sends mail without an approval step.

Agency owners can also connect a Gmail or Outlook mailbox for their agency. An agency mailbox is used only to send Team Growth recruiting outreach that the owner has personally reviewed, edited if needed, and explicitly chosen to send — AI can draft a message, but drafting never sends anything, and no recruiting email is ever sent automatically or on a schedule. Agency mailbox tokens are stored with the same AES-256-GCM encryption and can be disconnected at any time from the agency portal's Settings page.

Your OAuth tokens are stored encrypted (AES-256-GCM) and are used only to provide these features for your own account. You can disconnect a mailbox at any time from Settings → Connections, which stops all access; you can also revoke Recall from your Google or Microsoft account security page. Recall's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: Google user data is used only to provide the advisor-facing features described here, is never sold, never used for advertising, and never used to train generalized AI or machine-learning models.

• Surface relevant memory back to you (Morning Feed, brief cards, client detail pages, supplier suggestions).
• Improve the product — bug fixes, feature decisions, and roadmap. Aggregated, never advisor-identifying.
• Send you the occasional product email (release notes, beta surveys). You can opt out from the email itself.

• We do not sell your data to anyone.
• We do not share your client list, supplier preferences, or pipeline with other advisors, consortia, or suppliers.
• We do not train third-party AI models on your client data. AI features that run on your data (e.g. the inbox summarizer) use providers under data-processing agreements that prohibit training.

The request-access form uses hCaptcha to help detect automated submissions. hCaptcha processes browser and device security signals under its Privacy Policy and Terms of Service. Recall sends the challenge token for server-side verification, not the name, email, agency details or notes from your signup form. If the check is unavailable, your request can be held for manual review rather than automatically approved.

Data is stored in PostgreSQL hosted by Replit, encrypted at rest. Inbound mail is processed by Postmark and immediately passed to our server — we do not keep a copy in Postmark's archive. Object storage (uploaded images, attachments) lives in Replit's App Storage with private ACLs by default.

Email hello@recall.travel from the address on your Recall account and we will delete your account, every client and supplier row you've added, and every memory tile we've generated for you, within 14 days. Removing a client in the app archives their record. Muting a supplier removes it from your working set. Neither action permanently deletes the stored data. To request permanent deletion of an individual client or your private supplier-related data, email hello@recall.travel from your account email.

Recall is in private beta. The product is changing weekly, including (occasionally) the data model. We will email you in advance if any change requires re-entering data. Bugs may happen — please tell us via the in-app Feedback button so we can fix them.

Questions, deletion requests, or anything else: hello@recall.travel. A human reads every email.