Terms of service.

01Who we are, who you are

"We", "us" and "Outboxes" mean the company above. "You" means the business placing the order.

Outboxes is sold to businesses only. By ordering you confirm that you act in the course of a trade, business or profession, not as a consumer, and that consumer rules such as the 14-day right of withdrawal do not apply. If you order for a company, you confirm you are authorised to bind it. Agencies ordering for their clients are our customer and answer for their clients' use.

02What you buy

• Domain plan. SMTP/IMAP mailboxes on domains you bring or that we register for you, up to five mailboxes per domain (the number of sender names you give), priced per domain per month or per quarter, minimum five domains.
• Agency plans. A dedicated sending server with dedicated IP addresses for a flat monthly fee, with the mailbox and domain allowances and fair-use limits shown on the pricing page when you order.
• Every plan includes DNS configuration (SPF, DKIM, DMARC, a tracking domain), per-mailbox sending limits, a CSV in the import format of Instantly or Smartlead, SMTP/IMAP credentials, forwarding of replies to an address you choose, and email support on working days.
• Not included: Google Workspace or Microsoft 365 mailboxes, warm-up as a service, a sending platform, lists, copy.

The pricing page at the time of your order describes what you buy. Your Stripe receipt and our confirmation email are the record of it.

03Ordering and review

You order by card through Stripe Checkout and tell us your sender names, the sequencer you use, whether you bring domains or we buy them, and your billing details including any EU VAT number.

Paying creates a customer account under the email you paid with. You sign in at app.outboxes.io with a password you set from the link we email you, or with a Google account that uses the same email. One account per paying email; keep your password to yourself, and tell us at once if you think someone else has it. Everything done from your account counts as done by you.

A person reviews every order before anything is built. We may refuse an order, and we will refuse in particular: no working company website, a disposable or free mailbox at checkout with no company behind it, adult content, gambling, cryptocurrency or financial promotions, sender names that are not real people, and anything we would not send under our own name. A refused order is refunded in full, normally within the hour on working days, and no contract comes into existence.

The contract is formed when we confirm your order by email from [email protected].

04Delivery

• Orders confirmed before 14:00 CET on a Luxembourg working day are delivered by the end of the next working day. Later orders count from the following working day.
• Domains you bring: we show the DNS records to add on your order page and continue the build once they resolve. Time waiting for your DNS extends the delivery date by the same amount.
• Domains we register: we register them after review and payment of the registration invoice (section 6); the build starts as soon as registration completes, usually the same day.
• Deliverables (CSV, credentials, DNS records, status) appear on your private order page, linked from the thank-you page and from our emails. Anyone with that link can download your credentials, so keep it inside your organisation. If it leaks, write to us and we rotate the passwords.

05Prices, renewal, cancellation

• Prices are in euro and exclude VAT. Luxembourg VAT is added unless you give a valid EU VAT number at checkout (reverse charge) or you are outside the EU. Tax is calculated by Stripe from your billing address.
• Plans are subscriptions, charged in advance to the card on file, and renew automatically for the same period (month or quarter) until cancelled.
• Cancel any time from "Invoices & plan" on your order page or the link in your receipt. Service runs to the end of the paid period, then nothing renews. Periods already started are not refunded, except as stated in sections 3 and 9.
• If a renewal payment fails, Stripe retries it. If it keeps failing we stop sending on your mailboxes and, after 30 days unpaid, treat the plan as cancelled (section 10).
• To add domains, place a new order or write to us. Reductions apply from the next renewal.
• We may change prices with 30 days' notice by email. A new price applies from your next renewal after that date; you can cancel before it.
• Domain registration is €12 per domain per year, invoiced separately after review and payable before we register; renewals are invoiced yearly unless you tell us to let the domain lapse.
• 14-day money-back. On your first order with us you may cancel within 14 days of payment for any reason and we refund the mailbox plan in full. Domain registrations are excluded, because the registry does not refund them. Later orders and renewals follow the cancellation rule above.

06Domains

• Domains we buy for you are registered with you as registrant, under our registrar account, for one year included in the fee. You may ask us to transfer them to your own registrar at any time after the registry's initial 60-day lock. Before they expire we ask whether to renew at the then-current fee or let them lapse.
• Domains you bring stay entirely under your control. You add the DNS records we give you or delegate the nameservers to us, and you keep them registered.
• A domain's reputation is yours. Where your plan includes domain swaps, we move the mailboxes to a fresh domain at the frequency stated on the plan; the registration fee for a domain we buy is as in section 5.

07Acceptable use

You send under your own responsibility and must comply with the law where you are and where your recipients are, including the GDPR and ePrivacy rules in the EU, CAN-SPAM in the US and CASL in Canada. In practice that means business recipients only where the law allows it, a truthful sender identity and subject line, a working opt-out honoured promptly, no purchased consumer lists and no mail to people who asked you to stop.

Never: unsolicited mail to consumers, phishing, malware, fraud, adult content, gambling, cryptocurrency or financial promotions, counterfeit goods, harassment, impersonation, or anything else unlawful. Also no working around sending limits, no sharing credentials outside your organisation (for agencies: your clients), and no probing or attacking our infrastructure.

Per-mailbox daily limits protect the IP addresses everyone shares. We set them and raise them after warm-up. Fair use is five mailboxes per domain and, on Agency XL, 1,500 mailboxes; going beyond is not a breach, but we will ask you to move up a plan.

You indemnify us against claims, fines and costs caused by what you send.

08What we promise, what we do not

• We build and run the mailboxes with reasonable care and skill on servers we operate in Germany, monitor them, and answer email on working days. "Within the hour" during Luxembourg office hours is our target, not a guarantee.
• We aim for the servers to be available at all times but do not guarantee a specific uptime. Planned maintenance is announced by email.
• We do not promise inbox placement, open rates, replies or revenue. Deliverability depends on your list, your copy, your warm-up and the receiving networks. A domain or IP getting listed is a normal risk of cold email, not a defect in the service.
• Instantly, Smartlead, Gmail, Outlook, registries and other third parties are outside our control. A change on their side that breaks an import is not a defect, though we help you adapt.

09Liability

To the extent Luxembourg law allows, our total liability for all claims in any twelve-month period is limited to the fees you paid us in the three months before the event giving rise to the claim. We are not liable for lost profit, lost business, lost reputation, lost data beyond what our backups can restore, or any indirect or consequential loss. Nothing here limits liability for fraud, gross negligence, wilful misconduct, or death or personal injury.

If we fail to deliver an order within five working days of the date in section 4 for reasons on our side, you may cancel that order and receive a full refund of it. That is your remedy for late delivery.

10Ending the service, your data

• Your plan runs until you cancel it. We may end it with 30 days' notice by email, refunding any prepaid period beyond the notice, or immediately if you breach section 7, do not pay, or a legal or regulatory reason requires it.
• At the end of the paid period your mailboxes stop sending. Mailbox content and credentials are deleted 14 days later. Export what you need before then; reply forwarding means your replies are already in your own inbox.
• Domains registered in your name remain yours (section 6).
• Sections 7 (indemnity), 9, 11 and 12 survive the end of the contract.

11Data processing

What we do with your data as a customer is in the privacy policy. For the mail in your mailboxes and the people you write to, you are the controller and we are the processor. This section is our data processing agreement under Article 28 GDPR.

• Subject and duration: hosting and operating email mailboxes and domains for the term of your plan. Nature: storage, transmission, forwarding, spam and abuse filtering. Data: email addresses, names, message content and headers. Data subjects: your staff, your prospects and your correspondents.
• We process only on your documented instructions, which are these terms and the settings of the service, unless EU or Luxembourg law requires otherwise, in which case we tell you first where the law permits.
• Access to mailbox content is limited to what troubleshooting, abuse handling or a legal obligation requires. We do not otherwise read your mail. Everyone with access is bound by confidentiality.
• Security: encrypted transport (TLS) for the site, the API and mail, servers restricted to authorised staff, credentials delivered only through your private order page, backups within the EU.
• Sub-processors: Hetzner Online GmbH, Germany (servers) and Cloudflare, Inc. (DNS, domain registration, the order system; order metadata, never mail content). We give 14 days' notice by email before adding one; you may object and cancel.
• We help you answer data subject requests that concern the data we hold, and we tell you without undue delay after becoming aware of a personal data breach affecting your data.
• On request we provide the information needed to show compliance and allow an audit, at most once a year, with 30 days' notice, at your cost. At the end of the contract data is deleted as in section 10.

12Changes, law, the rest

• We may change these terms. Material changes are emailed to customers at least 30 days before they take effect; continuing to use the service after that date means you accept them, and you can cancel before it.
• Luxembourg law applies. The courts of Luxembourg City have exclusive jurisdiction, subject to any mandatory rule that says otherwise.
• These terms, the pricing page at the time of your order and your order confirmation are the whole agreement. If a clause is unenforceable the rest stands. You may not assign the contract without our consent; we may assign it to a successor of our business.
• Notices go by email: to the address you gave at checkout, and to [email protected] for us.
• This English text is the only version.