Privacy Policy

1. Who we are

RaceMyDesk is an AI-powered email assistant for enterprise, operated by RACEMYDESK, S.L., based in Palma de Mallorca, Spain. Our website is located at www.racemydesk.com.

For any privacy-related questions, you can reach us at [email protected].

2. The RaceMyDesk Outlook Add-in

The RaceMyDesk Outlook add-in helps you draft email replies directly inside Outlook. This section explains how the add-in handles your data, and applies in addition to the rest of this policy.

• What the add-in accesses. When you open a message and use the add-in, it accesses the content of the message you are currently working on (such as the subject, sender and recipients, and message body) in order to generate a suggested reply. In Outlook the add-in requests the "ReadWriteItem" permission, which allows it to read the message you have open and to write the generated draft back into your mailbox.
• How your email content is processed. All processing takes place within your organization's own private infrastructure. When you request a reply, the message content is processed on your organization's own RaceMyDesk server, and the add-in simply displays the already-processed result inside Outlook. Email content is never sent to any external RaceMyDesk cloud or to any third-party service.
• Artificial intelligence. The AI model that generates the drafts is fully self-hosted within your organization's infrastructure. Your email content is never sent to external AI providers such as OpenAI, Azure OpenAI or Anthropic, and it is never used to train or improve any AI model.
• Storage and retention. To provide features such as search, retrieval-augmented generation (RAG), history and related results, email and document content may be stored on your organization's own RaceMyDesk server. Drafts generated by the add-in are saved in your own Microsoft 365 mailbox and remain under your control. This data is retained for as long as the service contract remains in force; when the contract ends, the data is deleted.
• Account data and authentication. You sign in to the add-in with your RaceMyDesk credentials (email and password) against the RaceMyDesk backend, which issues a session token (JWT). The add-in only stores this session token in your browser, and it expires after 24 hours. The add-in does not store your corporate email address, name, Microsoft or tenant ID, or any Microsoft access tokens, and it does not use Microsoft / Entra single sign-on.
• Where data is hosted. Any RaceMyDesk components are always hosted on servers located within the European Union and the European Economic Area (EEA).

3. What data we collect

When you interact with our website, we may collect the following personal data:

• Contact form submissions: first name, last name, work email address, company name, role, company size, and your message. This data is collected when you voluntarily submit the contact form on our website.
• Usage data: We use analytics tools (Google Analytics and/or Matomo) to collect anonymised data about how visitors interact with our website, including pages visited, time spent, browser type, device type, and approximate geographic location. This data is collected through cookies or cookieless tracking and does not personally identify you.
• Account and authentication data: When you use the RaceMyDesk platform or the Outlook add-in, we process the login credentials you use to sign in (your work email address and password) in order to authenticate you and issue a secure session token. Passwords are never stored in plain text; they are stored only as a cryptographic hash, using industry-standard techniques.

4. How we use your data

We use the data we collect for the following purposes:

• To respond to your enquiries: When you submit the contact form, we use your information to reply to your message, schedule demos, and provide information about RaceMyDesk.
• To improve our website: Analytics data helps us understand how visitors use our site so we can improve content, navigation, and user experience.
• To ensure security: We may use technical data to protect our website from abuse, spam, and malicious activity.

5. Legal basis for processing (GDPR)

Under the General Data Protection Regulation (GDPR), we process your personal data based on the following legal grounds:

• Consent: By submitting the contact form, you consent to us processing your data to respond to your enquiry.
• Legitimate interest: We have a legitimate interest in analysing website usage to improve our services, provided this does not override your fundamental rights and freedoms.

For the processing carried out by the RaceMyDesk platform and Outlook add-in, the legal basis is the performance of the contract between RaceMyDesk and the customer organization, together with the associated Data Processing Agreement. In this context RaceMyDesk acts as a data processor on behalf of the customer organization, which is the data controller.

6. Cookies and analytics

Our website may use cookies and analytics tools to enhance your experience and analyse website traffic:

• Google Analytics: These cookies collect anonymised information about how you use our website. Google Analytics uses cookies such as _ga and _gid to distinguish users and track sessions. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.
• Matomo: We may use Matomo as an alternative or complementary analytics platform. When self-hosted, Matomo processes data entirely on our own servers with no data shared with third parties. Matomo can operate in cookieless mode, in which case no tracking cookies are placed on your device.
• Essential cookies: These are strictly necessary for the website to function and cannot be switched off.

You can manage your cookie preferences through your browser settings at any time.

7. Data sharing

We do not sell, rent, or trade your personal data to third parties. We may share your data with:

• Google (Analytics): Anonymised usage data is processed by Google under their Privacy Policy.
• Matomo (if self-hosted): When using self-hosted Matomo, your data is not shared with any third party, it remains entirely on our servers.
• Service providers: We may use trusted third-party tools for email delivery or hosting that process data on our behalf, under strict data processing agreements.

Email content processed by the Outlook add-in is not shared with any third party. It is processed entirely within your organization's own infrastructure and is not sent to external AI providers or to any external RaceMyDesk cloud.

8. Data retention

We retain your contact form data for as long as necessary to fulfil the purpose for which it was collected, typically no longer than 24 months after your last interaction with us. Analytics data is retained for 14 months in accordance with Google Analytics default settings.

Email and document content processed by the RaceMyDesk platform and Outlook add-in is stored on your organization's own server and retained for as long as the service contract remains in force, after which it is deleted. Drafts are stored in your own Microsoft 365 mailbox. Session tokens used by the add-in expire after 24 hours.

9. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct any inaccurate or incomplete data.
• Right to erasure: You can request that we delete your personal data.
• Right to restrict processing: You can ask us to limit how we use your data.
• Right to data portability: You can request your data in a structured, machine-readable format.
• Right to object: You can object to our processing of your data based on legitimate interest.
• Right to withdraw consent: You can withdraw your consent at any time.

To exercise any of these rights, please contact us at [email protected]. We will respond within one month.

10. Data security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Our website uses HTTPS encryption for all data transmission.

For the RaceMyDesk platform and Outlook add-in, email and document content is processed within your organization's own private infrastructure and is not transmitted to any external RaceMyDesk cloud or third-party service. Access to the add-in requires authentication, and sessions are governed by security tokens that expire automatically. All RaceMyDesk components are hosted on servers located within the European Union and the European Economic Area.

11. International transfers

Your data may be processed by Google (for Analytics) in servers located outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

12. Children's privacy

Our website and services are not directed at individuals under the age of 14. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us and we will promptly delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. When we make material changes, we will update the "Last updated" date at the bottom of this page. We encourage you to review this page periodically.

14. Contact us

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

• Email: [email protected]
• Website: www.racemydesk.com/contact
• Location: Palma de Mallorca, Spain

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) if you believe your data protection rights have been violated.

Last updated: 16 July 2026