Terms and conditions

1. The customer's account

The customer is responsible for keeping its login details confidential and for all activity on the customer's organisation, including actions by the users (Account administrators and regular users) that the customer creates and manages. OpenMailman disclaims liability for losses resulting from inadequate protection of login or integration credentials for Microsoft 365, Google/Gmail and IMAP mailboxes.

2. Processing of personal data

When the customer connects a mailbox (Microsoft 365, Gmail or IMAP), OpenMailman retrieves emails and attachments from the mailbox, displays them as conversations and tickets, sends replies through the connected account and analyses enquiries with AI. In this context OpenMailman acts as data processor under the General Data Protection Regulation (EU 2016/679), while the customer is the data controller. All processing is carried out in accordance with the data processing agreement the customer enters into with OpenMailman, see Data processing agreement. Mailboxes must not be connected until a valid data processing agreement has been entered into.

3. Prices and payment

OpenMailman comes in two plans: Free and Pro. The Free plan is free of charge with no trial period, and anyone can create an account. It includes one user, up to two connected mail accounts, manual filters and saved views. The Free plan does not include AI, OMC chat, OpenTIME, additional users and invitations, or replying directly in OpenMailman; replies are sent from the customer's own mail client. On the Free plan OpenMailman stores only mail headers and never mail content or attachments, see Privacy policy. The account can be upgraded to Pro by agreement.

Pro costs DKK 100 per user per month excl. VAT and includes full mail content, replying directly in OpenMailman, additional users and invitations, OMC chat, OpenTIME and 300 AI analyses per user per month (pooled for the organization). Beyond the pool, an extra AI analysis costs DKK 0.15 and an AI reply costs DKK 0.50. The AI balance can be topped up. Pro is provided under a commercial agreement between the customer and OpenSUN Systems ApS. AI usage is billed separately at the current rates. Individual terms may be agreed for larger customers, in which case they are set out in the commercial agreement. Payment is by invoice with the payment term stated on the invoice. In case of non-payment, access to the Service may be restricted or closed after written notice.

4. Termination

Termination of the Service follows the terms agreed in the commercial agreement between the customer and OpenMailman. On termination, OpenMailman is obliged to delete the customer's personal data in accordance with the data processing agreement. When the customer's organisation is closed, it is deactivated immediately, and a grace period of 30 days follows during which the customer can undo the closure by contacting us. When the grace period has expired, all of the organisation's data in OpenMailman is deleted permanently and irrevocably, including our own copies of mails, conversations, notes, attachments, AI summaries, connections and users. Data is deleted from backups no later than 14 days after deletion. The customer's emails in Microsoft 365, Gmail or on the customer's own mail server are not deleted. OpenMailman may terminate the customer's access to the Service with immediate effect in case of material breach of these terms.

5. Disclaimer and warranties

The Service is provided "as is". AI suggestions are advisory, and the customer must assess them before acting on them. OpenMailman disclaims liability for damage resulting from errors or changes in the systems the Service integrates with (Microsoft 365, Google/Gmail, IMAP providers and the Claude API), including loss of operations and loss of data caused by these third parties.

6. Intellectual property

OpenSUN Systems ApS owns all intellectual property rights in the Service, including software, logo and design. The customer's use of the Service does not grant any right to copy, distribute or modify any part of the material. The customer retains all rights to its own mail content and data.

7. Changes to the terms

OpenMailman may change these terms. Material changes are notified to the customer, and continued use of the Service after a change is considered acceptance.

8. Governing law and venue

These terms and any dispute arising from them are governed by Danish law. Any dispute that cannot be settled amicably is decided at the venue of OpenSUN Systems ApS in Denmark.

9. Support access

OpenSUN Systems’ own employees hold the role Superadmin (platform). Superadmins are only employees with an email address at @openmailman.com or @opensunsystems.com, and they must use two-factor authentication (2FA). To provide support and operations, the following applies:

• Set-up: Superadmins can always view and correct the customer’s set-up in order to provide support, e.g. account settings, users and teams, status of connected mailboxes and data sources, chat sites and the knowledge base set-up. Passwords, keys and tokens can never be seen in plain text, only replaced.
• Content: emails, conversations, chat messages, notes and knowledge articles can only be seen by Superadmins with time-limited access that the customer’s Account administrator grants and can revoke at any time. The access expires automatically and lasts at most 7 days.
• Private connections and private data are never accessible to Superadmins, whatever access the customer grants.
• Notice to the customer: the customer is notified every time, both in OpenMailman and by email (at most one email per 6 hours in total).
• Logging: all views and actions are recorded in the customer’s audit log, so the customer can see them.
• No impersonation: Superadmins act as themselves and never log in as the customer’s users.

10. Contact

Questions about these terms can be sent to info@openmailman.com.

Hosting

OpenMailman is operated at Hetzner via Laravel Forge, like OpenSUN Systems' other products OpenTIME and OpenDIMS. The application and the database are physically located on servers in Germany. Encrypted backups are stored in Helsinki (Finland, EU), see Backup below.

Encryption

All communication to and from OpenMailman is encrypted using SSL/TLS, the same technology used by online banks. When the customer connects a mailbox, the connection to Microsoft 365, Gmail or the IMAP server is likewise encrypted. Access tokens and passwords for connected mailboxes are stored encrypted.

Uptime

Hetzner states an uptime of 99.9% for its infrastructure. Brief disruptions may occur in connection with updates and improvements to OpenMailman. Any agreed uptime for the Service is set out in the commercial agreement.

Backup

The database is backed up daily so that data can be restored in the event of a failure. Backups are encrypted before they leave the server and are stored at Hetzner Object Storage in Helsinki (Finland, EU). Backups are kept for 14 days. Data is deleted from backups no later than 14 days after deletion. Restoration is tested manually.

Two-factor authentication and access control

Login to OpenMailman uses email and password with two-step verification: by default a 6-digit one-time code sent by email, or an authenticator app (TOTP) or passkey if the user has chosen one. The user can choose to remember a device for 30 days, so the email code is skipped on that device. Access inside the system is role-based, so a user can only see and do what their role allows. Private means private: content from private connections can be seen neither by other users, nor by Account administrators, nor by OpenSUN Systems’ Superadmins (platform), and all actions are recorded in an audit log.

Certifications

Hetzner is certified under ISO/IEC 27001, the international standard for information security, which covers, among other things, physical access control, hardware and data security, logical security, guard procedures, and network and documentation.

Contact us

If you have questions about our use of sub-processors or about data protection in OpenMailman, you are always welcome to contact us at info@openmailman.com.

Data controller and data processor

• Data controller for contact, account and log information and information given when creating an account yourself: OpenSUN Systems ApS, Rømersvej 4, 7430 Ikast, Denmark, CVR 43782495, info@openmailman.com.
• Data controller for mail content, attachments, contact data, chat messages and AI summaries in OpenMailman: the customer (the organisation using the Service). We process these solely as data processor, following the customer's instructions and the data processing agreement.

If you are the sender or recipient of an email at one of our customers, or have written in a customer's chat, you should contact the customer about your rights. We help the customer respond.

What information we process

• Name, email, phone number and other contact details of the customer's users.
• Login and activity data, including IP addresses and the audit log, in connection with use of OpenMailman.
• Content you provide yourself in the system, for example when contacting our support.
• Self-service account creation (sign-up): company name, optionally CVR number, name, email, optionally phone number, language, time, IP address and browser information, and your acceptance of the terms and conditions and the privacy policy.
• Free plan (data minimisation): we process and store only mail headers, i.e. sender, recipients, subject, date, Message-ID and threading, read status, folder, size and whether the mail has attachments. We never process the content or attachments of mail on the Free plan. On Pro, the full mail content is processed.
• As data processor for the customer: emails and attachments from connected mailboxes, sender and recipient addresses, contact history, notes, chat messages from the customer's embedded chat (OMC), AI summaries and categories, and tasks and time entries created in OpenTIME. Mail content may contain any type of personal data that the customer itself receives.
• The website openmailman.com sets no cookies and uses no visitor statistics, see Cookie policy.

How we collect the information

The information comes from you when you create an account or contact us, from the mailboxes and chat the customer connects, and automatically through the system's activity logging for security and troubleshooting.

Self-service account creation (sign-up)

You create an account yourself through the form at app.openmailman.com/signup. There is no trial period. This is how it works:

• The form is protected by a self-hosted captcha (ALTCHA) that runs on our own server in the EU, without cookies and without third parties, and by limits on the number of attempts per IP address, email and domain.
• We send a confirmation link to the email you entered. The link expires after 24 hours. Unconfirmed creations expire after 7 days, and name, phone number and IP address are deleted then.
• When the creation is submitted, we send an internal message with the details entered (company name, name, email, optionally phone number and CVR number, and the time) to sales@openmailman.com.
• When you confirm the link and choose a password, the organisation is created together with you as Account administrator.

Purposes and legal basis

We process the information to deliver OpenMailman, provide support, improve the system, secure operations and communicate with you about your account. Processing is based on:

• Accounts and contact persons at customers: the commercial agreement (GDPR Art. 6(1)(b)) and our legitimate interest in operating, securing and improving the system (point (f)).
• Self-service account creation: performance of the agreement to create and use an account (point (b)) and our legitimate interest in preventing misuse of the form (point (f)).
• Accounting and bookkeeping: legal obligation (point (c)).
• Mail content and other customer data, including AI analysis: the customer determines purposes and legal basis as data controller, and we process them only on the customer's instructions (GDPR Art. 28). Mail content is data and never instructions to the AI, and AI analysis never blocks viewing, replying or assigning.

Disclosure

We do not sell your information. Information is only shared with the sub-processors necessary for operations (see Security and operations and the list below), always under a data processing agreement. Billing information (company name, CVR number, address and invoices) is processed in our accounting system Dinero.

Sub-processors

• Hetzner Online GmbH (Germany): hosting of OpenMailman, database and storage. The application and the database are physically located on servers in Germany (backups: see Hetzner Object Storage below).
• Anthropic (Claude API): AI analysis of enquiries, i.e. categorisation, summaries, suggestions for who should take a mail, and reply drafts. Only the content needed for each analysis is sent. Transfer and region: Anthropic PBC processes data in the USA. The transfer is based on the European Commission’s Standard Contractual Clauses (SCCs), which are part of Anthropic’s Data Processing Addendum (DPA). Data from API calls is not used to train Anthropic’s models and is by default deleted automatically by Anthropic within 30 days of receipt. The exception is content that Anthropic’s safety systems flag as violating their usage policy; it may be retained longer.
• TINXDK Cloud and Gigahost: sending of system emails (confirmation links for account creation, login codes, invitations, receipts and notifications) through a mail relay. The relay is never used for customers' own replies, which are always sent through the connected account.
• Hetzner Online GmbH (Object Storage, Helsinki, Finland/EU): storage of encrypted backups. Same provider as the hosting.
• Laravel Forge: administration of the server at Hetzner. Forge does not process customers' mail content.
• GitLab: storage of source code and running of tests. No customer data is ever stored in GitLab.

We only use sub-processors that are necessary for operations, always under a data processing agreement. Material changes to the list are announced to the customer, who may object.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability, and the right to object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time. Requests regarding your rights are sent to info@openmailman.com.

Retention

We only keep the information for as long as necessary for the purposes it was collected for, or as long as the law requires. Specifically:

• Unconfirmed account creations expire automatically after 7 days, and name, phone number and IP address are deleted then.
• Earlier requests for access (from before self-service creation) are deleted automatically 12 months after the last status change.
• Local mail copies (content, headers, attachments and AI summaries) are deleted automatically 12 months after the mail's sent or received time. The email remains in the customer's own mailbox. Your emails at your mail provider are not deleted.
• Fetched attachments in the cache are cleared after 30 days without use.
• The audit log is kept for 24 months.
• Data is deleted from backups no later than 14 days after deletion. Backups are encrypted and stored at Hetzner in Helsinki (Finland, EU).
• When a connection is deleted, all local data for that account is deleted.
• When the agreement ends, the customer's personal data is deleted under the data processing agreement, see Deleting an organisation.

Deleting an organisation

When an organisation in OpenMailman is closed, we first deactivate it. From then on nobody can log in, and we no longer fetch mail or chat. The deletion is carried out by OpenSUN Systems at the customer's request (only the platform's Superadmins can carry it out). A grace period of 30 days follows, during which the closure can be undone. The account owner (otherwise the account administrators) receives an email when the deletion is scheduled, if it is undone, and when it has been completed.

When the grace period has expired, we delete all of the organisation's data permanently and irrevocably, including our own copies of mails and headers, attachments, conversations, notes, contacts, chat, knowledge articles, AI summaries and decisions, connections and credentials, users (including passkeys and two-factor), invitations, settings and the organisation's audit log. OpenMailman's own access and subscriptions at the mail provider are revoked, for example subscriptions to notifications from Microsoft 365 and Gmail, and our stored access tokens are deleted.

Your emails in Microsoft 365, Gmail or on your mail server are not deleted. The deletion never changes anything at the customer or at the customer's mail provider. Data is deleted from backups no later than 14 days after deletion. We only keep an anonymous record that an organisation has been deleted (id, time and number of deleted rows), without personal data. Accounting records that the Danish Bookkeeping Act requires to be kept are kept outside OpenMailman in our accounting system (Dinero).

Cookies

We only use technically necessary cookies in the platform itself. The website sets no cookies. Read more in the Cookie policy.

For spam protection when creating an account we use a self-hosted captcha (ALTCHA) that runs on our own server in the EU, without cookies and without third parties.

When you start a chat with support, the chat (omc-support.js) stores a session token in your browser’s local storage (localStorage) on openmailman.com, so the conversation can continue if you reload the page. This storage is necessary for the chat you started yourself and therefore does not require consent. No cookies are set and no tracking is used. You can delete the data by clearing your browser’s stored data for openmailman.com.

Complaints to the Danish Data Protection Agency

If you believe we process personal data in breach of the rules, you have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk. We would, however, appreciate hearing from you first so we can resolve the matter.

Contact

Questions about this policy can be sent to info@openmailman.com.

What the agreement covers

The agreement applies to both Pro and the Free plan, because mail headers (sender, recipients, subject etc.) are personal data. On the Free plan only mail headers are processed (sender, recipients, subject, date, Message-ID and threading, read status, folder, size and whether there are attachments), never content or attachments. On Pro, the full mail content is processed.

The agreement covers all personal data processing OpenMailman carries out on the customer's behalf: retrieval and synchronisation of emails, storage of local copies, search, AI analysis (categorisation, summaries and suggestions), sending replies through the connected account, embedded chat, and creation of tasks and time entries in OpenTIME. The agreement is based on the Danish Data Protection Agency's standard contractual clauses and contains four annexes:

• Annex A: information about the processing, including purposes, types of personal data and categories of data subjects.
• Annex B: the sub-processors OpenMailman uses.
• Annex C: instructions for the processing and the security measures we implement as a minimum.
• Annex D: the parties' regulation of any other matters.

How to enter into the agreement

The customer enters into the data processing agreement with OpenSUN Systems ApS before connecting mailboxes. The agreement is entered into digitally in OpenMailman. The account administrator accepts the current version in the setup guide by ticking acceptance and entering their full name and title. The acceptance is stored with version number, time, IP address, user and organisation. A PDF copy of the agreement and the acceptance is e-mailed to the account owner and can be downloaded in OpenMailman at any time. Mailboxes can only be connected once the agreement has been accepted. When a new version is published, it must be accepted again before new mailboxes are connected. A valid, signed data processing agreement is a prerequisite for connecting mailboxes.

Sub-processors

OpenMailman is hosted at Hetzner in Germany, which is ISO/IEC 27001 certified. See Security and operations for details. The sub-processors we use are:

• Hetzner Online GmbH (Germany): hosting of OpenMailman, database and storage. The application and the database are physically located on servers in Germany (backups: see Hetzner Object Storage below).
• Anthropic (Claude API): AI analysis of enquiries, i.e. categorisation, summaries, suggestions for who should take a mail, and reply drafts. Only the content needed for each analysis is sent. Transfer and region: Anthropic PBC processes data in the USA. The transfer is based on the European Commission’s Standard Contractual Clauses (SCCs), which are part of Anthropic’s Data Processing Addendum (DPA). Data from API calls is not used to train Anthropic’s models and is by default deleted automatically by Anthropic within 30 days of receipt. The exception is content that Anthropic’s safety systems flag as violating their usage policy; it may be retained longer.
• TINXDK Cloud and Gigahost: sending of system emails (confirmation links for account creation, login codes, invitations, receipts and notifications) through a mail relay. The relay is never used for customers' own replies, which are always sent through the connected account.
• Hetzner Online GmbH (Object Storage, Helsinki, Finland/EU): storage of encrypted backups. Same provider as the hosting.
• Laravel Forge: administration of the server at Hetzner. Forge does not process customers' mail content.
• GitLab: storage of source code and running of tests. No customer data is ever stored in GitLab.

We only use sub-processors that are necessary for operations, always under a data processing agreement. Material changes to the list are announced to the customer, who may object.

Support access

As part of the customer’s instructions and our security measures, OpenSUN Systems’ Superadmins (platform) may access the customer’s account in order to provide support. Superadmins are only employees with an email address at @openmailman.com or @opensunsystems.com, and they must use two-factor authentication (2FA). Access to the customer’s content takes place solely on the customer’s instructions, in the form of time-limited access granted by the customer’s Account administrator. The following applies to the access:

• Set-up: Superadmins can always view and correct the customer’s set-up in order to provide support, e.g. account settings, users and teams, status of connected mailboxes and data sources, chat sites and the knowledge base set-up. Passwords, keys and tokens can never be seen in plain text, only replaced.
• Content: emails, conversations, chat messages, notes and knowledge articles can only be seen by Superadmins with time-limited access that the customer’s Account administrator grants and can revoke at any time. The access expires automatically and lasts at most 7 days.
• Private connections and private data are never accessible to Superadmins, whatever access the customer grants.
• Notice to the customer: the customer is notified every time, both in OpenMailman and by email (at most one email per 6 hours in total).
• Logging: all views and actions are recorded in the customer’s audit log, so the customer can see them.
• No impersonation: Superadmins act as themselves and never log in as the customer’s users.

Deletion and termination

When the agreement ends, the customer's organisation is deactivated immediately, and the customer has a grace period of 30 days to undo it. After that, the processor deletes all of the customer's personal data permanently and irrevocably, including the processor's own copies of mails, attachments, conversations, notes, chat and AI summaries, and revokes its own access and subscriptions at the customer's mail provider. The customer's emails at the mail provider (Microsoft 365, Gmail or the customer's own mail server) are not deleted.

Backups containing the customer's data are encrypted and stored at Hetzner in Helsinki (Finland, EU) and are deleted no later than 14 days after the deletion. Sub-processors delete according to their own deadlines (Anthropic: no later than 30 days after the call, see the overview above). The processor does not retain personal data after the deletion, except for an anonymous record of the deletion and the accounting records that the Danish Bookkeeping Act requires.

Questions

If you have questions about the data processing agreement, you are welcome to contact us at info@openmailman.com.

1. Permitted use and access

OpenMailman is a B2B solution that includes a shared inbox and tickets across IMAP and, when available, Microsoft 365 and Gmail, intended solely for registered organisations and approved users. Unauthorised access or attempts to circumvent the system's security measures are prohibited. The customer is responsible for ensuring that only the right people gain access through the roles the customer creates, and for having a lawful basis to connect mailboxes and to inform employees and others affected about the processing.

2. Intellectual property and copyright

All content, software, design, source code and trademarks in OpenMailman belong to OpenSUN Systems ApS and are protected by Danish and international copyright. The material may not be distributed, modified or reused for purposes outside the platform's intended functions without prior written consent.

3. Accuracy of information

We strive to keep the information and functions in OpenMailman up to date and correct at all times. AI suggestions may be inaccurate. In connection with updates or external factors (for example changes at Microsoft, Google, IMAP providers or the Claude API), brief errors or interruptions may occur.

4. Reference to our other conditions

These terms only govern the general use of the platform. For commercial and operational terms, see Terms of service; for hosting and security, see Security and operations; for processing of personal data, see our Privacy policy and Data processing agreement; and for cookies, see Cookie policy.

Publisher information

OpenMailman is provided and operated by:

• OpenSUN Systems ApS
• Rømersvej 4
• 7430 Ikast, Denmark
• CVR 43782495

Questions about these terms can be sent to info@openmailman.com.

Necessary cookies

When you are logged in to the OpenMailman platform itself, technically necessary cookies are used for the login session and for protection against forged requests (CSRF). They keep you logged in and secure the session, and cannot be used to track you across other websites. They do not require consent because they are necessary for the platform to work. The platform also stores functional cookies for your own choices: light/dark mode (appearance), whether the sidebar is open (sidebar_state) and, if you choose to remember a device, a signed cookie (om_device_…) for 30 days that skips the email code. They are used only for the function and never for tracking.

Our own visitor statistics

The public part of openmailman.com uses no visitor statistics and sets no cookies. Fonts are loaded from fonts.bunny.net (Bunny Fonts), which sets no cookies; your IP address is, however, technically part of the request itself, as with any other external file load. The same applies to the fonts in the platform itself.

When you start a chat with support, the chat (omc-support.js) stores a session token in your browser’s local storage (localStorage) on openmailman.com, so the conversation can continue if you reload the page. This storage is necessary for the chat you started yourself and therefore does not require consent. No cookies are set and no tracking is used. You can delete the data by clearing your browser’s stored data for openmailman.com.

Statistics cookies (require consent)

We use no statistics or marketing cookies and no third-party tracking tools. If that changes, we will first obtain your consent and update this policy.

Delete cookies

You can always delete stored cookies through your browser settings:

• Windows/PC: CTRL + SHIFT + Delete
• Mac: SHIFT + CMD + Delete

Questions

If you have questions about this policy or about data protection in general, you can contact us at info@openmailman.com. See also our Privacy policy.