Skip to content

Lumail Terms of Service

The rules for using Lumail: accounts, sending, data, and a zero-tolerance anti-spam policy.

Last updated 15 September 2026

Overview

Lumail (the "Service") is operated by Codelynx, LLC, a company registered in Delaware, United States. By accessing or using Lumail, you agree to these Terms and the Privacy Policy.

Lumail is an early-stage email marketing and delivery platform. Features, infrastructure, limits, and compliance materials may change as the Service develops. You are responsible for determining whether Lumail is suitable for your legal, security, and operational requirements before placing personal data in the Service.

1. Accounts and Authorized Use

You must provide accurate account and organization information, keep credentials and API tokens secure, and use the Service only for lawful business or professional purposes. You are responsible for activity performed through your account and for the actions of users, integrations, and agents that you authorize.

To send email, you may need to verify your organization, configure a sending domain, publish required DNS records, and comply with plan and provider limits. A shared Lumail testing domain may be available with stricter restrictions and may be withdrawn.

Zero tolerance

Anti-Spam Policy: violations mean immediate suspension.

Marketing or bulk email is permitted only when every recipient has explicitly and verifiably requested or agreed to receive the specific category of email you send. No cold outreach. No exceptions for public addresses, existing business relationships, or lists obtained from another party.

You may never use Lumail with

  • Purchased, rented, or borrowed lists
  • Scraped, harvested, or publicly collected addresses
  • Contest, giveaway, or lead-generation lists without explicit marketing consent for your organization
  • Email append, lookup, enrichment, or similar services used to find recipients
  • Cold outreach to create a relationship

You must be able to prove

The source of every list, how and when each address was collected, the consent language shown, and each recipient's affirmative request or agreement. Lumail may request this evidence at any time.

If you cannot promptly provide it, Lumail will immediately suspend your organization's sending access and may suspend or terminate the organization.

Strictly transactional or relationship messages needed to fulfill a recipient-initiated transaction or service request remain allowed. They must not promote unrelated products or services.

3. Tracking and Transactional Email

Open and click tracking can collect personal data. Marketing campaign sends use tracking. The transactional API, SDK, MCP send_email tool, and native double-opt-in confirmation emails default tracking to disabled unless you explicitly enable tracking.open and tracking.links. You are responsible for choosing lawful settings and giving any required notice or obtaining consent.

Sending a transactional email to a new address creates a subscriber record as TRANSACTIONAL unless Settings → Configuration → Add transactional recipients to the marketing list is on, in which case the record is created as SUBSCRIBED. Double opt-in does not apply to this path. Existing contacts are reused and never have their status changed. The transactional API is not a supported custom double-opt-in state machine, and a customer-defined tag does not constitute Lumail confirmation or populate Lumail's confirmation evidence. See GDPR in Lumail.

4. Data Protection Contract Status

An authorized organization owner or administrator can review and accept the Data Processing Agreement (DPA) in Settings → Configuration → Data Processing Agreement. Acceptance requires the signer's legal name and an express confirmation of agreement and authority. The accepted document and party details are recorded with their version and acceptance time and can be downloaded. The DPA forms part of these Terms for the accepting organization and prevails over conflicting provisions concerning its covered processing.

Version 2026-09-15.1 of the DPA incorporates EU SCC Modules Two and Three, the UK ICO Addendum and Swiss adaptations for applicable restricted transfers. It does not establish Data Privacy Framework certification, promise EU-only residency, complete the required transfer assessment or supply every supplementary measure. A DPA signature alone does not make every use of Lumail compliant. See Data Processing Agreement.

5. Infrastructure and International Processing

Lumail is not hosted entirely in one country. Its current infrastructure includes application hosting and self-hosted Hatchet workers in Nuremberg, Germany; PostgreSQL in AWS eu-central-1, Frankfurt, Germany; email delivery through Amazon SES in ap-southeast-2, Sydney, Australia; Cloudflare edge processing globally; and email-content archives in an APAC R2 location without an EU-only jurisdiction guarantee.

By using the Service, you instruct us to use the providers and locations described in the Privacy Policy. This instruction does not by itself create a valid GDPR transfer mechanism or waive any rights under applicable law.

6. Deliverability, Bounces, and Complaints

We monitor bounce, complaint, unsubscribe, and abuse signals. We may throttle, pause, or suspend sending to protect recipients, Lumail, and shared delivery infrastructure. Addresses that unsubscribe, hard-bounce, or complain may be suppressed to prevent further delivery.

Email acceptance does not guarantee delivery, inbox placement, timing, or rendering. Delivery can be affected by recipient providers, DNS, third-party infrastructure, content, reputation, legal restrictions, and events outside our control.

7. Prohibited Activities

You may not use Lumail to:

  • Send spam, phishing, malware, deceptive, illegal, or abusive content
  • Circumvent unsubscribe, suppression, verification, rate-limit, or security controls
  • Misrepresent sender identity, affiliation, message purpose, or consent
  • Probe, disrupt, reverse engineer, or obtain unauthorized access to the Service
  • Infringe privacy, intellectual-property, or other legal rights

We may investigate suspected violations and restrict or terminate access, including without advance notice where immediate action is reasonably necessary.

8. Customer Data and Service Providers

You retain rights in content and data that you submit. You grant Codelynx the limited rights needed to host, transmit, transform, analyze, and otherwise process that data to operate, secure, support, and improve the Service and to meet legal obligations.

You represent that you have the rights and lawful basis needed to provide the data and instructions. We may use service providers described in the Privacy Policy. Lumail does not sell subscriber lists.

9. Plans, Billing, and Changes

Paid plans are billed through Stripe under the price, interval, and limits shown at purchase. Taxes may apply. Unless required by law or stated otherwise at purchase, fees already charged are non-refundable. We may change plans, limits, or pricing prospectively and will provide notice when required.

We may modify, suspend, or discontinue features. Where reasonably possible, we will avoid changes that unnecessarily prevent customers from exporting their data, but we do not promise that every early-stage feature will remain available.

10. Disclaimer and Limitation of Liability

To the maximum extent permitted by law, the Service is provided "as is" and "as available" without warranties of uninterrupted operation, deliverability, legal compliance, fitness for a particular purpose, or non-infringement.

To the maximum extent permitted by law, Codelynx is not liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, data, goodwill, delivery opportunities, or reputation arising from the Service. Nothing in these Terms excludes liability that cannot lawfully be excluded.

11. Indemnity

To the extent permitted by law, you will defend and indemnify Codelynx against third-party claims arising from your content, recipient lists, sending practices, violation of these Terms, or violation of law or third-party rights.

12. Governing Law

These Terms are governed by the laws of the State of Delaware, United States, without regard to conflict-of-law rules, except where mandatory consumer or data-protection law provides otherwise.

13. Changes and Contact

We may update these Terms as the Service changes. We will update the date above and provide additional notice when required. Continued use after an update takes effect constitutes acceptance to the extent permitted by law.

Questions about these Terms should be sent to [email protected].