Surpass™
Privacy Policy
Version 1.0, Effective 10 November 2026
The short version
Surpass™ sends nothing to RepEMS about you or your work.
Surpass™ is software you install on your own Windows computer. It reads and organises the mail, contacts and calendar in your own Outlook mailbox, and everything it learns about them stays on your computer. There is no analytics, no telemetry and no crash reporting in Surpass™, and the software has no way to upload your mail, your contacts, your calendar or anything derived from them. The only thing Surpass™ ever sends to us is a licence check, described in full below, and it carries no information about you or your mailbox.
If you need support, Surpass™ can prepare a diagnostics file for you to review and send yourself. Nothing in that file leaves your computer unless you have read it and sent it.
Who we are
Surpass™ is published by RepEMS LLC, a Texas limited liability company. This policy covers the Surpass™ desktop application and the licence service that supports it. It does not cover our other products, which are different in shape and have their own policies; a policy written for a hosted service would describe what is sent to us and what happens to it there, and that would be inaccurate here.
You can reach us about this policy at outreach@repems.com or on 832-800-3240.
What stays on your computer
Surpass™ keeps what it needs in a database on your own machine. That includes the filing history it learns from, the contacts and company information it builds up, your settings, and the records behind the suggestions it makes. None of it is copied anywhere else.
That database is encrypted at rest. Surpass™ generates an encryption key once, on that computer, and protects it with the Windows Data Protection API, which ties it to your Windows account. A copy of the database folder taken to another machine, or opened under another Windows account, cannot be read.
What Surpass™ sends, and to whom
Three destinations, and no others.
In a released build of Surpass™ there are exactly three places the software can send anything. Two of them are Microsoft, acting on your own mailbox at your instruction. The third is our licence service.
1. Microsoft, to sign you in
When you sign in, Surpass™ uses Microsoft's own sign-in service to authenticate you and to obtain the permissions below. Your password is never seen by Surpass™ and never reaches us. The sign-in is between you and Microsoft.
2. Microsoft, to work with your own mailbox
Surpass™ works with your mailbox through Microsoft Graph, using the permissions you grant at first sign-in. Those permissions are:
Mail.ReadWrite read and write your mail
Calendars.ReadWrite read and write your calendar
Contacts.ReadWrite read and write your contacts
The write half is genuinely used and we would rather say so plainly than describe this as reading your email. Surpass™ files messages into folders, creates folders, updates contact fields, and can create calendar entries. It does this in your own mailbox, as you, at your instruction. Nothing goes to any mailbox or service other than your own, and none of it passes through us.
3. Our licence service, to check your licence
Surpass™ contacts our licence service to start a trial, to activate a licence key and to check in periodically, about once every seven days. These are the only three calls it makes to us, and this is everything they carry:
starting a trial a hardware identifier
activating a hardware identifier and your licence key
checking in a hardware identifier and your licence key
The hardware identifier is a one way SHA-256 hash of your computer's primary disk serial number and its motherboard identifier. It cannot be reversed into either value, and it identifies a computer rather than a person. No name, no email address, no mailbox content, no folder names, no file names and no usage information is sent with any of these calls, because the software has no code that would gather them.
What we do not collect
There is no analytics, no telemetry and no crash reporting in Surpass™.
We are being specific here rather than general, because it is the plainest way to say it. Surpass™ contains no analytics library, no telemetry, no usage reporting and no automatic crash reporting. It has no mechanism that uploads anything to us other than the three licence calls described above. We do not know which features you use, how often you run the software, or whether it has ever crashed, unless you tell us.
We accept the trade that comes with this. We learn about problems because customers tell us about them, not because the software reports them.
Support, and the diagnostics file
The diagnostics file is yours, and sending it is your act.
Surpass™ can prepare a diagnostics file to help us investigate a problem. You choose where it is saved, you can open and read it before doing anything with it, and you decide whether to send it to us. Surpass™ never uploads it and has no way to do so.
You should know what is in it before you send it. The file contains information from your Surpass™ database, and some of that is personal: contact names, email addresses, telephone numbers, company names and job titles that Surpass™ has collected from your mail, along with message subjects and folder names. It also contains the application's error log.
If you send us a diagnostics file, we use it only to investigate the problem you reported, we do not add anything in it to any other record, and we delete it when the matter is closed. If you would rather not send the whole file, tell us and we will ask you for the specific detail we need instead.
What we hold about you, and where it comes from
It comes from the purchase, not from the software.
When you buy Surpass™, the sale is handled by Paddle, which acts as the merchant of record. Paddle collects your payment details; we never see them. Paddle passes us what we need to issue and support your licence, which is your name, your email address, your company name where you give one, and the status of your subscription. We generate your licence key and hold it alongside those records.
Our licence service also records the hardware identifiers your licence has been activated on, so that the device limit in your licence terms can be applied, and the dates of your activations and check ins. That is the whole of what our service stores.
We use these records to deliver and support the product you bought, to apply your licence, to contact you about your subscription, and to meet our tax and accounting obligations. If you have asked to hear from us about the product, we use your email address for that too, and every such message carries a way to stop them.
Who else sees it
We do not sell your information and we do not share it for anyone else's marketing. We use a small number of service providers to run the business, and each sees only what it needs:
Paddle takes the payment and is the seller of record
Microsoft provides the cloud platform our licence service runs on
our email delivers messages we send you
our accountant and advisers, where the law or an audit requires it
We will also disclose information if the law requires it, or to establish or defend a legal claim.
How long we keep it
We keep your licence and account records for as long as your subscription is active, and afterwards for as long as we need them for tax, accounting and legal purposes. We keep a diagnostics file only until the support matter it relates to is closed. Marketing consent is kept until you withdraw it.
Your choices
You can ask us what we hold about you, ask us to correct it, ask us to delete it where we are not required to keep it, and withdraw any marketing consent at any time. Write to us at outreach@repems.com and we will answer.
Deleting your account records does not affect anything on your own computer. Your Surpass™ database is yours and it is on your machine; we cannot reach it, and we cannot delete it for you. You remove it by uninstalling Surpass™ and deleting its data folder.
You can also revoke the permissions you granted Surpass™ to your mailbox at any time, from your Microsoft account settings. Surpass™ will then be unable to read or change anything in your mailbox.
Where your information is held
Our licence service and our business records are held in the United States. If you are outside the United States and buy Surpass™, your purchase information is handled by Paddle under its own terms and reaches us in the United States.
Children
Surpass™ is business software and is not directed at children. We do not knowingly collect information from anyone under 18.
Changes to this policy
If we change this policy we will post the new version here and change the version number and the effective date at the top. If a change materially affects what Surpass™ sends or what we hold, we will tell you in the application or by email rather than relying on you noticing.
Contact
RepEMS LLC, outreach@repems.com, 832-800-3240