This policy explains what data we process, why, and for how long, across the ACME portal (acme.replai.net) and the CoyoteMail and RoadrunnerFTP applications.
The short version, before the detail.
- We do not read your email, and we do not store your messages, attachments or files on our servers.
- The portal stores your account configuration — addresses, servers and signatures — and, if you switch it on, the credentials needed for a new device to configure itself. Those credentials are stored encrypted.
- No analytics, no trackers, no advertising. We do not sell or share your data.
1. Who is responsible
| Controller | ARTSESSIONS S.L.U. |
|---|---|
| Tax ID | B64848997 |
| Address | Carrer Llull 240, 08005 Barcelona, España |
| Contact |
2. What these services are
- ACME (acme.replai.net): a web portal for managing users and the mail configuration that the applications then sync.
- CoyoteMail: a mail and calendar client for macOS and iOS. It connects directly to the IMAP, SMTP and CalDAV servers you configure, and to Google if you connect a Google account.
- RoadrunnerFTP: a file transfer client for macOS that works with SFTP, FTP, FTPS and S3-compatible storage (such as Cloudflare R2). It connects directly to the servers you configure.
3. What data we process
3.1 In the ACME portal
| Data | Purpose |
|---|---|
| Name and email address | To identify you and let you sign in. |
| Password | Stored as a hash (bcrypt). We do not keep it in plain text and cannot recover it. |
| Mail account configuration | Address, display name, username, IMAP and SMTP servers with their ports and encryption type, colour and order. |
| Mail passwords and Google tokens | Only if you enable credential syncing. Stored AES-encrypted using the server's encryption service, so that a new device configures itself without asking you anything. |
| Scheduled emails | Only if you schedule a message. The full message with its attachments, its recipients and the password or Google token of the sending account are stored AES-encrypted until the send time, because the server sends it even when your devices are off. As soon as it goes out (or you cancel it) the message, recipients and credential are deleted; only the subject and who it was for remain, encrypted, to show it in the app. |
| Addresses you write to | Only if contact syncing is on (app settings, on by default). The address and name of the people you write to from CoyoteMail, how often and when, encrypted, so autocomplete offers them on all your devices. Never the content of your messages. |
| Signatures | The content of your signatures and which account each belongs to. |
| Connected devices | One session identifier per device, the name the device reports, and the last-used date, so you can revoke a specific device. |
| Server logs | IP address, timestamp and requested pages, for security and troubleshooting. |
3.2 On your device, with CoyoteMail
- Your mail is downloaded and stored on the device itself, in a local database, so you can read it offline and search it quickly. It does not pass through our servers.
- Passwords and Google tokens are stored in the system Keychain, not in application files.
- Sender icons: when enabled, the app requests the icon directly from the sender's own domain, once per domain, with no cookies and no referrer. We do not use a third-party favicon service, because that would disclose to a third party who you correspond with. Even so, that server will know you opened a message from them. You can turn it off in Settings → General.
- Calendar alerts are scheduled as local system notifications. They never leave the device.
3.3 On your device, with RoadrunnerFTP
- Your server credentials are stored in the system Keychain.
- Files you transfer go directly between your computer and your server. They do not pass through our servers and we keep no copy.
3.4 What we do not do
Neither application includes analytics, telemetry, advertising trackers or third-party frameworks that collect usage data. We do not profile you and we make no automated decisions about you.
4. Google data and Limited Use
If you connect a Google account, CoyoteMail requests access to your mail
(https://mail.google.com/) and your calendar
(https://www.googleapis.com/auth/calendar). That access is used solely to show you
your own mail and calendar inside the app and to send the messages you write.
CoyoteMail's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We do not transfer this data to others except as necessary to provide the service, to comply with applicable law, or with your explicit consent.
- We do not use this data for advertising of any kind.
- We do not allow humans to read this data, except with your explicit consent, where required for security purposes on aggregated and anonymised data, or to comply with applicable law.
- We do not use this data to develop, improve or train generalised or non-generalised AI models.
You can revoke access at any time at myaccount.google.com.
5. Legal basis
- Performance of a contract (GDPR art. 6(1)(b)): handling your account and the configuration needed to provide the service.
- Consent (GDPR art. 6(1)(a)): credential syncing and sender icons, both of which you switch on and off yourself.
- Legitimate interests (GDPR art. 6(1)(f)): server logs and security measures to keep the service available and protected.
6. Retention
- Account data, for as long as the account exists. Deleting it removes its mail accounts, signatures and sessions.
- Synced credentials are removed as soon as you unpublish that account or delete it from the portal.
- Scheduled emails, until they are sent or you cancel them; the remaining summary (subject and recipients, encrypted), for 30 more days.
- Addresses you write to, while contact syncing is on and the account exists.
- Server logs, for a maximum of 12 months.
7. Recipients
We do not sell or share your data. The only parties involved are:
- Our hosting provider (Raiola Networks S.L. (servidores en España)), as a processor, under a contract compliant with GDPR art. 28.
- Google, only if you connect a Google account, and only as needed to access your own mail and calendar.
- Your own mail and file server providers, which the applications connect to directly at your instruction.
8. International transfers
Portal data is hosted in the European Union. If you connect a Google account, Google's own processing is governed by its terms and may involve transfers outside the European Economic Area covered by the European Commission's standard contractual clauses.
9. Security
- All traffic with the portal uses HTTPS.
- Portal passwords are stored as bcrypt hashes, not encrypted: they cannot be reversed.
- Mail passwords and Google tokens are stored AES-encrypted.
- Each device has its own session, revocable independently.
- On devices, credentials live in the operating system Keychain.
No system is infallible. If we detect a breach affecting your data, we will tell you and notify the supervisory authority where required.
10. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time, by writing to . We will respond within one month.
If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) or your local supervisory authority.
Deleting your account. You do not need to write to anyone: you can ask for it yourself at acme.replai.net/en/delete-account, or from inside the app under Settings → your CoyoteMail account → Delete account. You get an email with a confirmation link; opening it deletes your user, the stored mail accounts with their passwords and your signatures. The mailboxes at your mail provider are not touched, and logs and backups roll over on their own within 30 days at most.
11. Children
These services are not directed at children under 14, and we do not knowingly collect data from anyone of that age.
12. Changes
If we change this policy we will update the date at the top and, when the change is significant, tell you by email or in the app before it takes effect.
13. Contact
· ARTSESSIONS S.L.U., Carrer Llull 240, 08005 Barcelona, España.