Application Terms

The parties. These Terms apply between instanceof s.r.o., Company ID 03007260, with its registered office at Čápkova 28/21, Veveří, 602 00 Brno, Czech Republic, registered in the Commercial Register kept by the Regional Court in Brno, file no. C 83229, which is also the controller named in our Privacy Policy (“we”), and the person or organization that creates an account in the application (“you”).

The Application. MailGiraffe (“the Application”) is a web application that we run. It brings the email from the mailboxes you connect into one place, sorts it by client and matter, and keeps track of who is responsible for each conversation, its deadline and its status. AI agents you set up can read what the person asking them can read and prepare drafts, and add clients and matters when someone allowed to do so asks them. The Application gives an agent no way to send email from your mailboxes. Apart from any tool you add yourself (clause 4.4), a message goes out only when a person sends it, by pressing Send in the Application or from the mailbox’s own Drafts folder.

The contract. By creating an account you accept these Terms, and a contract between you and us arises for an indefinite period. If you create an account for an organization, you confirm that you may act for it.

Business use. The Application is intended for use in a business or profession, and you confirm that you use it in that way and not as a consumer.

Your right to use it. For the duration of the contract and within your plan, you have a non-exclusive, non-transferable right to use the Application. The Application remains ours, and your data remains yours.

Free or paid. Your use of the Application is free of charge or paid, according to the plan currently selected for your account. What each plan includes and what it costs is shown in the Application when you select it.

Paid plans. A paid plan is paid in advance for each billing period through our payment partner, Stripe, and renews until you cancel it. You can change or cancel it at any time under Plan & billing. After you cancel, it runs to the end of the period you paid for, and your account then moves to the free plan if we still offer it. We do not refund the unused part of a billing period.

Free plan. We may withdraw the free plan at any time, for one account or for everyone, and the contract then ends unless you move to a paid plan. Where we reasonably can, we tell you by email first. We assume no liability under the free plan, as set out in chapter 6.

How to use the Application. You may use the Application only lawfully and within your plan. In particular, you agree to:

1. connect only mailboxes you are entitled to connect, and process only data you are entitled to process;
2. judge for yourself whether connecting a mailbox or using an AI provider is compatible with your professional secrecy and other confidentiality duties;
3. keep your sign-in details and API keys safe, and answer for the people you invite to your workspace and the access you give them;
4. not attack, overload or probe the Application, get around its access rules or plan limits, or use it to harm others;
5. check what an AI agent prepares before you use or send it. You are responsible for everything sent through the Application, whether by you or by the people in your workspace.

If the rules are broken. If you breach these Terms, we may suspend your access until the breach is put right, and we may end the contract at once if the breach is serious.

The Application depends on them. The Application works with services that are not part of it and that we do not control, in particular AI providers (such as Anthropic and OpenAI), email services (such as Gmail, and IMAP and SMTP mail servers) and MCP servers you connect. They may change, limit, fail or end at any time, and the features that rely on them may then change or stop working.

We are not responsible for them. We bear no responsibility for these services, including their availability, security and results, whether they accept and deliver a message, or how they handle data sent to them. Their own terms apply between you and them.

AI output. We do not guarantee that the output of AI tools is correct, complete, consistent or predictable; their nature rules that out. Evaluating that output and checking it before further use is always your responsibility.

Tools you add. The choice, setup, security and operation of any tool you give an AI agent from your own MCP server are entirely your responsibility. Such a tool acts with the access of whoever connected the server, and if it can send email or change data, an agent can make it do so without anyone reviewing it first.

Your key, your provider. AI agents run on API keys (tokens) you provide from your own account with an AI provider. We do not supply AI access. You contract with that provider and pay it directly, and you are responsible for your keys, the costs you incur and complying with its terms.

What goes to the provider. An agent runs only when someone asks it to. What it then reads, including email, goes to the provider whose key it runs on.

How we treat your keys. We store your keys encrypted and use them only to run your agents.

Free plan. Under the free plan we assume no liability for any harm arising from using the Application or from being unable to use it.

Paid plans. If we are liable for harm (including non-material harm, direct and indirect damage and lost profit) caused by the use of the Application under a paid plan, we compensate it up to the total price of your plan for one year.

Availability. We aim to keep the Application available, but do not guarantee that it runs without interruption, and we are not responsible for your own equipment or internet connection.

What these limits do not cover. Clauses 6.1 and 6.2 do not apply where the law does not allow liability to be excluded or limited, in particular for harm caused to a person’s natural rights, or caused intentionally or through gross negligence. They also leave untouched the rights of data subjects under Article 82 GDPR and our responsibility for our sub-processors under Article 28(4) GDPR.

This agreement. This chapter is the agreement on processing personal data under Article 28(3) GDPR. If you own a workspace, you are the controller of the personal data in it, and we process that data for you as your processor (“Customer Data”). If you yourself act as a processor for someone else, we are your sub-processor and you confirm that you are authorized to engage us. Where we decide why and how data is processed, such as for accounts and billing, we are the controller and our Privacy Policy applies.

What is processed.

1. Subject: enabling you to use the Application, which includes processing the personal data in Customer Data.
2. Duration: the duration of the contract, until the data is deleted or returned under clause 7.9.
3. Nature: automated reading of the mailboxes you connect, and of the addresses they can send from; storing, sorting, searching and displaying their content; placing drafts and labels in those mailboxes; sending the messages someone using your workspace asks to send, through those mailboxes or the outgoing servers set up for them; and passing data to the AI providers and other services you choose, when someone using your workspace asks for it.
4. Purpose: running the Application for you and providing support.
5. Types of personal data: identification and sign-in data of users, and everything contained in your mail and workspace, in particular names, contact details, the content of messages, details of attachments, clients, matters and drafts. Depending on your mail, this may include special categories of personal data (Article 9 GDPR) and data on criminal convictions and offences (Article 10 GDPR).
6. Data subjects: users of your workspace, your clients and their contacts, and anyone else who appears in your mail.

Your instructions. We process Customer Data only on your documented instructions, including on transfers to a third country, unless EU or Member State law requires otherwise. In that case we tell you before processing, unless that law prohibits it. These Terms, your settings and what people do in your workspace count as your instructions. We tell you immediately if we believe an instruction infringes data protection law.

Confidentiality. Everyone authorized to process Customer Data is bound by a duty of confidentiality. We keep Customer Data confidential and disclose it to third parties only where the law requires it, where it is necessary to provide the Application (in particular to the sub-processors in clause 7.7), or with your consent. This continues after the contract ends.

No other use. We use Customer Data only to run the Application and provide our services to you. In particular, we do not mine it for our own or anyone else’s purposes, and we do not use it to train, tune, test or otherwise develop AI models.

Security. We maintain technical and organizational measures under Article 32 GDPR, which we regularly evaluate and update. They include encrypted connections to the Application; encrypted storage of mailbox credentials and API keys; hashed passwords; access rules enforced on the server by role and assigned mailbox, which bind AI agents too; showing mail without scripts or remote content until someone asks; and hosting in the EU.

Sub-processors. You give us general authorization to engage sub-processors. We currently use:

We impose the same data protection obligations on them and remain fully liable to you for how they meet those obligations. We email you in advance about any intended addition or replacement. You may send us reasoned objections within 5 working days; mere disagreement is not a reasoned objection. If you send none, we may proceed. If we cannot resolve your objections, you may terminate the contract free of charge before the change.

Customer Data otherwise stays in the EU, unless your instructions send it elsewhere. The services you connect under chapter 4 are not our sub-processors: you engage them yourself.

Assistance. Taking into account the nature of the processing and the information available to us, we help you respond to requests from data subjects and meet your obligations under Articles 32 to 36 GDPR: security of processing, reporting breaches to the supervisory authority and to data subjects, data protection impact assessments and prior consultation. We notify you of any personal data breach without undue delay.

At the end. When the contract ends, you choose whether we delete Customer Data or return it to you. Deleting your workspace or account in the Application makes that choice: the data is deleted at once, and the messages in your mailboxes stay where they are. Otherwise, tell us within 30 days of the contract ending; if we hear nothing, we delete it. Existing copies are deleted too, unless EU or Member State law requires us to store them, and copies in backups disappear within 30 days of deletion.

Information and audits. We give you all information necessary to demonstrate that we meet these obligations, and we allow for and contribute to audits, including inspections, by you or by an auditor you mandate and bind to confidentiality, at a place we determine and on an agreed date. We need not open premises or equipment where that would endanger the confidentiality of other data. Each side bears its own costs, except that you cover our reasonable costs if an audit based on a suspected breach does not confirm it. We may refuse a manifestly abusive or unjustified request.

Your responsibilities. As controller, you decide the purposes and means of processing, and you may give us instructions and carry out audits under this chapter. You are responsible for having a legal basis for the processing, for informing data subjects, for your instructions being lawful and for having the agreements that data protection law requires with the services you connect.

Changes to these Terms. We may change these Terms to a reasonable extent as necessary, in particular when the Application, the services it depends on, our prices or the law change. We email you about a change at least one month before it takes effect. You may reject it and terminate the contract, free of charge, at any time before then. If you do not, the changed Terms apply from that date.

Ending the contract yourself. You may end the contract at any time by deleting your account in the Application, which also cancels any paid plan.

Discontinuing the service. We may discontinue the Application and end the contract on one month’s notice by email. No notice applies where an authority orders us to stop: we then comply with the order, and tell you as soon as we are allowed to. Withdrawing the free plan is governed by clause 2.3. Clause 7.9 applies to your data in every case.

Governing law and courts. These Terms, and all rights and obligations arising from or in connection with the contract, are governed by the law of the Czech Republic, excluding its conflict of laws rules. Disputes are decided by the general courts of the Czech Republic, and the court with local jurisdiction is the one for our registered office.

Contact. We write to the email address of your account, and you can reach us at support@librato.ai.