Mailcycle notices

Breach notice, and three DPA commitments, brought in line with the law

2026-09-25T00:00:00Z

Takes effect 2026-10-26.

These changes narrow promises we made, so they take effect on 26 October 2026, 30 days after this notice. Until then the earlier wording applies. If you do not accept them, you may end the Terms before then, and we refund any part of a plan period you have paid for that falls after that date, and your unspent paid balance.

Personal data breaches (Privacy Policy section 8). We notify the Information Commissioner's Office, and any other authority we must notify, without undue delay and within the time the law requires. We tell you directly, in the app, when a breach is likely to result in a high risk to you, which is the test the law uses, rather than for every breach likely to result in any risk, and without a fixed 72-hour limit for telling you.

Breaches affecting data we process for you (DPA section 7). We notify you without undue delay, as Article 33(2) of the GDPR requires, rather than within a fixed 72 hours.

Confidentiality (DPA section 3) now describes what is true of our one-person operation instead of training and access reviews. Written confirmation of deletion (DPA section 10) is given when you ask before deleting the account and give us an address to send it to.

Privacy Policy changes (section 11) are announced before they take effect, and at least 30 days before if they change how we use personal data we already hold.

Refunds, the account balance, liability and transfers, after a legal review

2026-09-25T00:00:00Z

We had our legal pages reviewed and changed them where the law gives you more than they said. These changes only add to your rights or describe what already happens, so they take effect now.

Cancelling within 14 days. If you are a consumer, you can now cancel each new plan purchase and each balance top-up within 14 days, not only your first plan payment, from Plans & Billing, Cancel within 14 days. We refund within 14 days, with no fee, including the network fee on a cryptocurrency refund. At checkout you now tick a box asking for the plan to start straight away, and after paying you can save a receipt.

Your account balance. Money you paid into the balance and have not spent is refunded if you cancel the top-up within 14 days, if we close your account or stop your plan or the Service, if you leave because of a change we made, or if you ask before deleting your account. The delete screen now shows the balance and opens the request for you. Credit we give you free is kept apart and is not refunded.

Liability. The Terms now separate consumers and businesses. For consumers, we are responsible for foreseeable loss our breach causes, and your Consumer Rights Act rights are unaffected. The customer indemnity applies to business customers only. If you are a consumer, you can bring a claim in your local courts.

Support. Requests are answered in order of the support level on the pricing page: Priority first, then Standard, then Basic. Reply times are stated as targets.

International transfers. The DPA now relies on the EU's adequacy decision for the UK, with the Standard Contractual Clauses as a fallback, governed by the law and courts of the Netherlands. The Privacy Policy now says that mail is processed in the clear, for the length of the request, at whichever Cloudflare data centre handles it, which may be outside the UK and the EEA.

Our SDKs for TypeScript, Python, Go and Rust are now licensed under the Apache License 2.0, so you can build them into your own software and ship it. The mailcycle-mcp licence keeps its terms, with your consumer rights stated.

Our registered company details are now shown on every page of this website, the documentation and the app.

Corrections to the Terms, Privacy Policy, Refund Policy, DPA and Subprocessors page

2026-09-25T00:00:00Z

We compared our legal pages with what the service actually does and corrected them where they differed. None of these changes takes anything away from you; they describe what already happens, or what the app now does.

Deleting your account now cancels a card subscription with Polar at the same moment. If it cannot be cancelled, the account is not deleted. A subscription bought through the App Store or Google Play is not cancelled by deleting the account and has to be cancelled in the store. Any account balance is deleted with the account. A new page, mailcycle.email/delete-account, explains how to delete an account and what is kept.

You can now cancel a subscription in the app, under Plans & Billing. The plan stays until the end of the period you paid for, nothing more is charged, and the account then moves to Free.

Periods paid in cryptocurrency or from the account balance are 30 days. Card and in-app subscriptions renew on the payment provider's monthly billing date.

A first plan bought from the account balance can now be cancelled or refunded like any other first plan payment, and the refund goes back to the balance.

The Terms and the Refund Policy described chargebacks as recorded automatically. Our card provider does not tell us about disputes: a reversed card payment reaches us as a refund. The pages now say so: a refund is recorded, the plan is not taken away automatically but runs to the end of the period paid for and is not renewed, and we may mark an account past due or suspend it by hand. A full refund of a card plan payment also cancels the card subscription.

The Refund Policy now says that when Apple or Google refund a purchase, the subscription stops renewing and the plan runs to the end of the period that purchase paid for.

General notices are now posted on this page and its feed. A notice for one account arrives in the app's support inbox, with a push notification where the device has them on. Subprocessor changes are posted here at least 30 days ahead; there is no email list, because we hold no email address for you.

A personal data breach is now described the same way in the Privacy Policy and the DPA: we notify affected customers without undue delay, and within 72 hours of becoming aware of it, in the app, and here when it affects everyone.

The Privacy Policy's minimum age is now 18, the same as the Terms. Sign-up asks you to confirm that you are 18 or over and agree to the Terms and the Privacy Policy.

The Terms now define Customer Data as the mail and content we process for you, matching the Privacy Policy and the DPA; account and billing data is ours as controller. References to an Enterprise order form now refer to the written agreement we sign with Enterprise customers. The DPA's refund on objecting to a new subprocessor now matches the Refund Policy. The security page now says that a paired device can send from Personal up.