Data Processing Agreement

1. Scope and roles

This DPA applies to the processing of personal data subject to the UK GDPR, or to other data protection law where equivalent terms are required.

• You are the controller of the personal data in Customer Data, as the Terms define it: the mail your email addresses receive and send, and the other content we store for you.
• Mailcycle is the processor of that data.
• Mailcycle is a controller of your account and billing data, which is governed by the Privacy Policy, not by this DPA.
• An AI model provider that an AI agent you run passes mail to is engaged by you, not by Mailcycle. It is not Mailcycle's subprocessor and is outside this DPA. Mailcycle's processing ends when the agent receives mail sealed to its keys.

Terms not defined here have the meaning given in the UK GDPR.

2. Processing instructions

We process personal data only on your documented instructions. Your use of the Service, and the configuration you choose within it, constitute those instructions. Additional instructions must be agreed in writing and may be chargeable if they require work outside the Service.

We will tell you if, in our opinion, an instruction infringes applicable data protection law, and may suspend that instruction until it is resolved.

Where we are required by law to process beyond your instructions, we will inform you first unless that law prohibits it.

3. Confidentiality

We ensure that everyone we authorise to process personal data for you is under a duty of confidentiality, by contract or by law. Access to production systems is limited to those who need it. We give anyone we authorise access only to what their role needs, bind them to confidentiality in writing, and brief them on data protection and security before they have access.

4. Security measures

We implement and maintain appropriate technical and organisational measures under Article 32, described in Annex B. We may update them provided the level of protection is not reduced.

5. Subprocessors

You give general authorisation for us to engage subprocessors. Annex A describes each one by its role and location. We give the current list, with each subprocessor's name, to any customer who asks at hello@mailcycle.email.

• Before a subprocessor processes personal data for you, we put in place a written contract that imposes on it data protection obligations meeting the requirements of Article 28(4) of the UK GDPR.
• We give at least 30 days' notice before a new or replacement subprocessor starts processing personal data for you, by a notice to your account in the app that names it, and by posting the change, with the subprocessor's role and location, on our notices page at mailcycle.email/notices and in its feed. The notices page and its feed are the formal channel for these notices, and the name is given on request to a customer whose app did not receive the notice. We hold no email address for you and keep no mailing list.
• If we must replace a subprocessor urgently, for example because it has failed, stopped providing its service or become a security risk, we may do so with shorter notice, and will post the notice as soon as we can with the reason. You may then object within 30 days of the notice.
• You may object on reasonable data protection grounds within the notice period, by writing to hello@mailcycle.email. We will discuss it with you in good faith. If we cannot offer a reasonable alternative, you may end the Terms for the affected Service without penalty, and we will refund any part of a plan period you have paid for that falls after the end date, and your unspent paid account balance, as section 7 of the Terms says.
• We remain fully liable to you for our subprocessors' performance of their data protection obligations, as Article 28(4) requires, subject to section 11.

6. Data subject rights

The Service gives you the tools to access, export, correct and delete personal data in the mail your addresses receive yourself. Where a data subject contacts us directly about data we process on your behalf, we will not respond substantively. We will redirect them to you and tell you promptly.

Where you cannot fulfil a request using the Service, we will provide reasonable assistance taking account of the nature of the processing.

Taking into account the nature of the processing and the information available to us, we will also give you reasonable assistance with your obligations under Articles 32 to 36 of the UK GDPR, including data protection impact assessments and prior consultation with a supervisory authority. Most of what you need is in this DPA, Annex B and our security overview. Assistance beyond that may be charged at a reasonable rate we agree with you first.

7. Breach notification

We will notify you without undue delay after becoming aware of a personal data breach affecting personal data we process for you. We notify you with a notice to your account in the app, which arrives in its support inbox with a push notification where a device has them on, and on our notices page when the breach affects all customers.

The notification will describe, as far as we know them, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point. Where we do not have the full picture at once, we will give it in phases without undue further delay. Notifying a breach is not an admission of fault.

8. International transfers

8.1 We are established in the United Kingdom. Where our subprocessors process personal data outside the UK (Annex A says where), we make the transfer under the UK's adequacy regulations where they exist, including the UK Extension to the Data Privacy Framework where the subprocessor is certified under it, or otherwise under the ICO's International Data Transfer Agreement or the Standard Contractual Clauses with the ICO's Addendum.

8.2 If the data protection law that applies to you requires particular contractual clauses for your transfer of personal data to us, the clauses approved under that law are incorporated into this DPA, with you as data exporter and us as data importer, completed with the information in this DPA and its Annexes. Subprocessors are authorised under them as section 5 sets out. Where those clauses leave a choice to the parties, such as governing law, it is made as they allow and recorded in a countersigned copy, which you can ask for at hello@mailcycle.email. Where those clauses conflict with this DPA, the clauses prevail.

9. Audits

We will make available the information necessary to demonstrate compliance with Article 28, including our current security documentation and completed questionnaires.

You may audit no more than once in any 12-month period, on 30 days' written notice, during business hours, subject to confidentiality, at your cost, and without accessing other customers' data or systems that would compromise their security. Additional audits may be conducted where required by a supervisory authority or following a confirmed breach.

10. Return and deletion

You can export mail at any time in the app. Deleting the account removes personal data processed on your behalf from the live database immediately, with no export window afterwards, so export first. Copies in our database provider's point-in-time restore history are gone within 30 days. The same applies where we delete an account under the Terms. If you need written confirmation of deletion, ask before you delete the account and give us an email address to send it to; we will confirm once the restore history has expired.

11. Liability

Each party's liability under this DPA is subject to the limitations in section 14 of the Terms of Service, except where those limitations are prohibited by applicable data protection law.

Annex A: Processing details

Annex B: Security measures

• Encryption in transit: TLS for the API and apps; STARTTLS on inbound SMTP where the sender supports it.
• Encryption of Customer Data: inbound mail and attachments are parsed in memory and sealed to a per-address X25519 public key before anything is stored. Messages over 25 MB are refused. Past the 50th attachment in one message, only its name, type and size are kept. Mail you send passes through in plain text; the copy kept in the address's Sent folder, with any files attached, is sealed to the same per-address key before it is stored. Address labels and device metadata are encrypted on your device with ChaCha20 and HMAC-SHA-256. The private keys are derived from your recovery phrase. We hold no copy of them and cannot decrypt Customer Data once it is sealed, including in response to a request from you. An AI agent receives its address keys in a bundle sealed under a secret that reaches your app without passing through us.
• Encryption at rest: all stored data is also encrypted by the hosting provider.
• Authentication: no passwords exist in the system. Accounts authenticate by answering a single-use challenge with a key derived from the recovery phrase, of which we store only the public half. Device credentials are scoped per device, minted only on your explicit confirmation in the app, and independently revocable.
• Access control: restricted administrative access, using a separate console that opens only with its own key, by answering a challenge rather than by presenting a stored secret. Every administrative action is recorded in a tamper-evident audit log. Administrative tools can suspend, throttle, cap retention, change plans, record credits and refunds, resolve abuse reports and delete accounts. There is no means of accessing message content.
• Segregation: every device- and address-scoped operation is authorised against the owning account; identifiers alone confer no access. A device or AI agent can read and send only for the addresses assigned to it.
• AI agents: reply-only by default, enforced by us against salted hashes of the addresses each message can be answered at; a send mode only a signed-in session can change; and an hourly sending limit per agent.
• Resilience: point-in-time database restore for up to 30 days. Message bodies and attachments in object storage are not backed up.
• Rate limiting: burst limits at the network edge, hourly, daily and monthly quotas per account and per IP address, with keys stored only as hashes.
• Content handling: inbound MIME is parsed in memory on the server and sealed before storage; HTML is sanitised and trackers stripped on your device when a message is opened; remote content is never loaded; attachments are downloaded only through the authenticated API.
• Vulnerability management: a published vulnerability disclosure policy.

How to execute

For most customers no signature is needed: this DPA applies automatically as part of the Terms of Service. If your procurement process requires a countersigned copy, or you need us to review your own DPA template, email hello@mailcycle.email and we will turn it around.