Legal information

Terms of use

Last updated: 28 September 2026 · 22 min read

By using Loop, you accept this Agreement. The Service is intended exclusively for businesses (B2B).

These terms govern the Loop service at loop.n-xplus.com: parties, accounts and roles, licence, plans and payments, Mail connections, responsibility for automation and the AI assistant, data protection, termination and applicable law. They describe current operation; changes are published here with a date.

1. Parties, purpose and acceptance

1.1. Parties

These Terms of Use (“Agreement”) are entered into between MercanWorks OÜ, incorporated under the laws of the Republic of Estonia, with its registered address at Harju maakond, Tallinn, Põhja-Tallinna linnaosa, Paavli tn 5a/1, 10412, Estonia and registration number 17413775 (“Company”, “we” or “Service Provider”), and the party using the website at loop.n-xplus.com (“Site”) and the Loop task management and no-code automation platform provided under the N-XPLUS brand (“Platform” or “Service”). “Customer” or “Business” means the commercial undertaking that creates a company workspace on the Platform, or on whose behalf it is created. “User” or “you” means the natural person using the Platform on the Customer's behalf (company owner, administrator or member). The Agreement is concluded with the Customer; Users are bound by it on the Customer's behalf and to the extent of the Customer's authorisation.

1.2. Declaration of acceptance

By accessing the Service, creating an account or company workspace, joining a company by invitation or using any module, you represent and agree that you have read, understood and fully accepted this Agreement, the accompanying Privacy Policy, Cookie Policy, Cancellation and Refund Policy, KVKK privacy notice and any updates made from time to time, and that they are legally binding. If acting for a company or legal entity, you warrant that you have authority to bind it to this Agreement.

Invited members are also bound by this Agreement from joining, within their access rights. The company owner ensures that everyone added to the company is aware of it.

1.3. B2B nature

The Service is designed exclusively for businesses, traders and professional teams (B2B). Users confirm they act for professional or commercial purposes and not as consumers under applicable consumer protection law.

1.4. Purpose

Loop is a browser-based service for small and medium-sized businesses to configure and track tasks, projects, forms and business rules without coding or local installation. Administrators define task types, fields, stages, forms and automation rules for their sector. The platform measures work, not employees: no tracking of location, screens, keyboard, mouse, availability or time online.

The platform is not accounting software, an official records system, HR or payroll software, an email server or an employee monitoring tool.

Privacy policy →

Cookie policy →

Cancellation and refund policy →

KVKK privacy notice →

2. Definitions

For clarity in this Agreement:

• “Company”: a tenant account on the platform with isolated data; the business acting as Customer under this Agreement.
• “Company owner”: the User who creates the company, manages its subscription and can close it. Ownership can be granted to another member; multiple owners are permitted, with at least one always remaining.
• “Administrator”: a User authorised by an owner to configure task types, fields, stages, forms and rules, invite members, assign roles and remove members.
• “Member”: an invited User who views and carries out assigned work.
• “Plan”: Free, Team, Business, Pro and Scale service levels, differentiated by capacity rather than features.
• “Rule” or “Automation”: conditions and actions configured without code to run automatically when an event occurs or at a specified time.
• “Public form”: a company form shared externally by link that records submitted responses on the platform.
• “AI assistant”: a setup helper that turns your requests into draft task types, fields, stages, tasks and rules, previews every proposal and saves nothing without approval (artificial intelligence; third-party model provider OpenAI).
• “Mail connection”: a User-authorised browser connection to their Gmail or Outlook account for reading, replying and managing mail in the platform. Access tokens and mail content remain only on the User's device.
• “Performance measurement”: person, project and stage metrics derived from task data, including the on-time completion score. These are reports, not automated decisions with legal effects for individuals.
• “Company Data”: all data entered by the company, including tasks, subtasks, comments, projects, project chats, attachments, form definitions and responses, field values, rules, activity and assignment history.
• “Content”: all software, code, interfaces, design, text, graphics and sector templates provided by the Company (predefined task types, fields, stages, rules and sample tasks).
• “Force Majeure”: unforeseeable events beyond the parties' reasonable control, such as natural disasters, war, cyberattacks or failure of internet or cloud infrastructure.

3. Accounts, account security and authorisation

3.1. Opening an account

Accounts require an email address and password, with mandatory email verification. Passwords must contain at least 10 characters, including lowercase, uppercase and a number. Accounts are personal, belong to one real person and cannot be shared. Company access is obtained by creating it as owner or accepting an invitation from an owner or administrator.

The Company may refuse or suspend account or company creation, or request further information, where abuse, unlawful conduct or breach of this Agreement is suspected.

3.2. Registration obligations

You must provide accurate, current and complete company and contact details. Users bear all legal and financial responsibility arising from incorrect or outdated statements, such as an unreachable email address or inaccurate billing details.

3.3. Account security

You alone are responsible for password confidentiality. It is held only as a hash by the authentication provider; the Company neither knows nor asks for it. If you suspect compromise, reset it immediately and notify [email protected]. Mail access and refresh tokens are stored locally in your browser, so their security depends on your device and browser. You must avoid sharing devices or browser profiles, installing untrusted extensions, and leaving connections on devices you no longer use.

3.4. Unauthorised actions

All actions from your account — creating or deleting tasks, configuring rules, invitations, uploads, subscription changes, company closure and sending mail — are deemed yours even if performed by an unauthorised person. Report suspicious activity immediately to [email protected]; actions before notification remain your responsibility.

3.5. Roles and authorisation

Company permissions are assigned by role at the company's discretion:

• Owner: manages subscriptions, can grant ownership to another member and close the company; has all administrator permissions.
• Administrator: configures task types, fields, stages, forms and rules; invites members, assigns roles and removes members; manages confidential-field permissions and project access lists; views team performance.
• Member: views and carries out accessible work; sees personal performance.

3.6. The company's responsibilities

Owners' and administrators' permissions, invitations, project access lists and confidential-field access constitute company instructions. The company is responsible for granting and promptly removing access. Removed members lose access to company data immediately.

3.7. Third-party accounts

You confirm you are the lawful owner or authorised user of connected Gmail or Outlook accounts. Unauthorised access to another person's mail account constitutes an offence and results in immediate account termination. Article 7 defines the connection scope.

3.8. Exploring the demo company

The account-free demo company is a demonstration environment: entered data is neither sent to the server nor saved on your device and disappears on refresh. Features requiring a real account — Mail, payments and invitations — do not work in this mode.

3.9. One business per company workspace

Each company account is allocated to one business. Sharing it between businesses or transferring it to another business requires the Company's written consent. Granting ownership to another member of the same company is exempt.

4. Licence rights and intellectual property

4.1. Scope of the licence

During access and subject to payment of any applicable fees, the Company grants the User a limited, non-exclusive, non-transferable, non-sublicensable and revocable licence to use the platform for internal business purposes.

4.2. Ownership rights

All intellectual property in the Loop brand, N-XPLUS umbrella brand, platform software, source code, interface and visual design, database structure, automation engine, performance calculation method, sector templates and know-how belongs exclusively to the Company (MercanWorks OÜ).

You may use and modify the types, fields, stages, rules and sample tasks from sector templates within your company setup. You may not claim ownership of the templates themselves, reproduce them outside the platform or offer them to third parties.

4.3. Ownership of Company Data

Your company owns its entered data and its own task types, fields, stages, forms and rules. The Company has only the processing rights needed to provide the Service. Apart from service security, abuse monitoring and quota counting, it does not use the data for its own purposes, sell it, use it for advertising or train models with it.

4.4. Drafts generated by the AI assistant

AI-generated types, fields, stages, tasks and rules saved with your approval become Company Data; the provider claims no rights to them. Drafts come from a general-purpose model; uniqueness or copyright protection is not guaranteed.

4.5. Feedback

We may use your platform suggestions and feedback to improve the product without incurring obligations to you.

5. Acceptable use and prohibited conduct

Users must not do or permit third parties to do the following:

• (a) Copying, modifying, creating derivative works, reverse engineering or deciphering the Service's source code;
• (b) Renting, selling, distributing or providing the Service to third parties as a service bureau;
• (c) Unauthorised security testing, overloading, bypassing rate limits or circumventing user, storage, automation or AI capacity limits technically or through misuse of roles;
• (d) Collecting platform data through web scraping or automated scripts;
• (e) Connecting an unauthorised mail account or attempting to access another company's data;
• (f) Using public forms or automation for unsolicited bulk messages, deceptive data collection or automated traffic that burdens the Service;
• (g) Sending unsolicited bulk mail, impersonating others or violating provider sending rules through Mail;
• (h) Uploading or sharing unlawful or defamatory content, content infringing copyright or personal rights, or attachments containing malware;
• (i) Using the platform, including performance measurement, for employee surveillance, discrimination or pressure contrary to employment or data protection law;
• (j) Using the platform contrary to applicable law, connected Google/Microsoft service terms or third-party rights.

5.1. Consequences of a breach

Breach permits the Company to suspend an account or company without notice or terminate the Agreement immediately.

5.2. Reporting vulnerabilities

Report suspected vulnerabilities to [email protected] with “security” in the subject, without exploiting them or sharing them with third parties.

6. Plans, subscriptions and charges

6.1. Free plan

Access starts when the account and company are created, without provider approval. Free has no time limit, fees or card requirement. Each business may have one Free company; opening multiple companies to multiply capacity violates Article 5(c). Free includes 3 users (active members plus pending invitations under Article 6.3); 1 custom task type (template types and “General” excluded); 5 custom fields per type; 100 MB storage; 100 automation actions per month; 3 active rules at once; and 0 AI credits (assistant disabled).

Rule builder, report forms, public forms, team performance comparisons and confidential fields are available in paid plans. Personal performance is visible on every plan. Free companies are never upgraded without explicit consent.

6.2. Paid plans

Paid plans — Team, Business, Pro and Scale by quotation — are listed on the pricing page. The three paid plans have identical features and differ only in user capacity, storage, monthly automation actions and annual AI credits.

6.3. Prices, user counting and billing periods

Paid plans are based on user capacity: Team supports up to 10, Business up to 25 and Pro up to 50 active users; a separate Scale quote is provided for more than 50 users. Prices are per company and exclude taxes: Team TRY 5,500 per month, Business TRY 10,000 per month and Pro TRY 15,000 per month. Annual billing includes two months free (Team TRY 55,000, Business TRY 100,000, Pro TRY 150,000). Payment is collected in advance through Stripe; subscriptions renew automatically at the end of each billing period and can be cancelled through the Stripe customer portal. Cancellation takes effect at the end of the period.

Prices are net, per company, excluding taxes. Fees are collected at the start of the chosen monthly or annual period. Active members and pending invitations count. Additional users or AI credits are not sold separately; upgrade if capacity is insufficient.

6.4. Capacity, quotas and limits

There are no overage charges. At capacity, new items such as invitations, rules or files cannot be added; existing items continue to work.

The automation action quota is monthly and resets each new month. When it is exhausted, rules stop running and the rule log records a “quota” result. Actions initiated by the User are not rejected because of the quota. For AI, 1 credit equals 1 interaction with the assistant. The pool is annual; when exhausted, the assistant is disabled and re-enabled in the new period.

Attachments may be up to 25 MB each; total storage is subject to the plan allowance. Uploads are losslessly compressed and integrity is verified on download.

6.5. Upgrading and downgrading plans

Upgrades take effect immediately; remaining fees are credited proportionately and only the difference is billed. Monthly downgrades start next period through the Stripe portal. Annual plans cannot be downgraded mid-term; you may cancel renewal or change plans at renewal. Downgrades delete no data; existing items continue within the new monthly quotas, but additions beyond capacity are blocked.

6.6. Failed payments

If renewal payment fails, Stripe retries; your plan remains active with a “past due” status. Update payment details in the Stripe portal. If Stripe ends the subscription, the company moves to Free without data loss; existing items continue within Free's monthly quotas (AI disabled), while new additions are blocked. Reactivation by Stripe restores the paid plan; an ended subscription requires a new purchase from the pricing page.

6.7. Automatic renewal and cancellation

Unless cancelled before period end, paid subscriptions renew automatically for the same term at the current list price. Cancellation through Stripe takes effect at the end of the current period; cancellation after the renewal invoice applies to the following period. Service continues on the same plan until then. A company with an active subscription cannot be closed; cancel first.

6.8. Payment methods and card security

Payments are processed by PCI-DSS-compliant Stripe on its hosted payment page. Card numbers never reach or are stored on Loop's servers. The platform stores only plan, subscription status and Stripe customer/subscription IDs. Data sent to Stripe is listed in the Privacy Policy's provider table.

6.9. Taxation and VAT

• Estonia: the applicable VAT rate is added for Estonian companies.
• EU outside Estonia: reverse charge applies to EU businesses providing a valid VAT number; invoices are issued without VAT.
• Outside the EU, including Türkiye: invoices are net of VAT as exported services. Users alone bear local taxes (including KDV-2, withholding tax and similar charges) and filing obligations under their country's law. The Company is not responsible for those obligations.

6.10. Price changes

The Company may update prices. For existing subscriptions, changes apply no earlier than the next renewal and require at least 30 days' notice to the company's registered email address and publication on this page.

6.11. Withdrawal rights and refunds

The platform is an immediately supplied intangible digital service (SaaS) for businesses. Consumer withdrawal rights do not apply to this Agreement. Even if a User qualifies as a consumer, the Estonian Law of Obligations Act and Article 16(m) of EU Directive 2011/83/EU exclude withdrawal for immediately commenced digital services: service starts on account creation and paid-plan performance on upgrade approval. Separately, the Company offers a contractual full refund window of 7 days for annual plans at first purchase and each automatic renewal. Monthly plans are non-refundable once used, except where a Company-caused technical defect prevents use. Refunds go through Stripe to the original payment method. Contact [email protected] before a chargeback. The Cancellation and Refund Policy gives full details.

Pricing →

Privacy Policy — subprocessors →

Cancellation and refund policy →

7. Mail connections (Gmail and Outlook)

Mail is optional: connect your Gmail or Outlook (Microsoft 365, Hotmail) account to read, reply, send, reversibly delete, archive and mark messages as read or unread. This section governs connection scope and each party's responsibilities.

7.1. Authorisation

OAuth 2.0 authorisation takes place in your browser directly with Google or Microsoft. The Company has no client secret or intermediary server and never stores your mail password. Connections are used only for actions you initiate; the platform never independently reads, scans or sends mail in the background.

7.2. Requested permissions and duration

Only minimum permissions required for the feature are requested:

7.3. Data stays on your device

Access tokens, Microsoft's refresh token and the connected email address are in browser local storage (loop-posta-hesaplar); the connection verification key and refresh timestamp are in session storage and deleted when the tab closes. The Company does not know which user connected which account. Mail content is processed in browser memory, not permanently stored. Tokens and content never reach Loop's servers, database, logs, AI assistant or third parties. Transfers are direct and encrypted between the browser and Google or Microsoft. The Company cannot see, store, sell or use this data for advertising or model training.

You accept that using Mail on another device or browser requires reconnection, clearing browser data disconnects the account, and the Company cannot back up, recover or fulfil access requests for data it cannot access.

7.4. Provider terms and outages

Connected mail accounts remain subject to Google or Microsoft terms, privacy policies and limits, which you must follow. Access restrictions, permission changes, suspension, sending limits or provider failures are outside the Company's control. The Company is not responsible for message transmission, delivery, delay or provider outages; these are not Service defects or grounds for refunds.

7.5. Sent content and prohibition of bulk messaging

Every message is sent from your account in your name. You alone are responsible for content, recipients, attachments and legality. Unsolicited bulk messages, impersonation, deceptive content and breaches of provider sending rules are prohibited and subject to Article 5.

7.6. Disconnecting an account

Removing a connection in Mail deletes tokens and account details from your device. You can also revoke Google permissions or Microsoft app permissions under Privacy; links appear at the end of this section.

7.7. Limited use of Google data

Loop's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to provide the Mail feature visible to you; it is not used for advertising, read by humans except with your express permission or for security or legal reasons, transferred to third parties, or used to develop or train general-purpose artificial intelligence or machine learning models. Further details are set out in the Privacy Policy.

7.8. Message bodies and remote images

Email bodies are rendered in an isolated, script-free area. Remote images load only in a separate restricted frame; your browser contacts the sender's image server, which can see your IP address as in the mail provider's own interface.

Google account permissions →

Microsoft account app permissions →

Google API Services User Data Policy →

Privacy policy →

8. Automation, AI assistant, performance assessment and disclaimers

8.1. Nature of rules

Companies define the events, timing, conditions and actions of automation; the Company only supplies the execution engine. All results — assignments, stage changes, tasks and notifications — are company instructions and its responsibility. Runs are logged for 12 months. Exhausted quotas or invalid rule definitions prevent execution and are recorded in the log. The Company is not responsible for incorrectly configured rules.

8.2. Nature of the AI assistant

The AI assistant runs only at your request using OpenAI. Every proposal is previewed and saved only with approval. Conversation summaries with personal data masked are retained for abuse checks and credit counting for 12 months; see the Privacy Policy. Your request, company type, field, stage and rule names, and member names and roles are sent; task content, comments, project chats, attachments and confidential fields are not. Each turn uses an AI credit. Under the provider's official API policy, data is not used for model training by default. The Privacy Policy lists all sent and excluded data and explains masking.

Drafts may be incomplete, inaccurate or unsuitable. You must review, correct and approve them; approved drafts have the same effect as configurations you create yourself. The Company guarantees neither accuracy, completeness nor fitness for a particular purpose.

8.3. Nature of performance assessment

Performance reports derive from task data: timely completion, depth of delays and stage flow, summarised as the on-time completion score. They do not measure workload, quality, effort, working time, location or screen activity. The platform makes no automated decisions with legal effects for individuals.

Using metrics for employment decisions such as appraisal, discipline, pay, promotion or dismissal is the company's responsibility. Metrics or the score must not be the sole basis without human review (GDPR Article 22; KVKK Article 11/1-g): an authorised person decides and employees may object and express their views. The company must meet employment, data protection and staff information duties; the provider is not responsible for such decisions or outcomes.

8.4. No professional advice

Loop is not an accountant, tax adviser, law firm or HR consultant. Numbers, reports, rule results and assistant output are management information only, not accounting, legal, tax or HR advice, and do not replace official records.

8.5. Disclaimer of liability

The User irrevocably agrees and undertakes:

• To review automation rules, AI drafts and performance metrics before saving them or making decisions based on them,
• Not to hold the Company liable for lost profits, damage, penalties or third-party claims resulting from business, financial or HR decisions based on Loop data or output.

9. Data protection and compliance with GDPR and KVKK

9.1. Roles

For personal data processing, the Company (MercanWorks OÜ) acts in these capacities:

• Controller for account data (name, email, password hash, role, preferences), payment and subscription records, technical records, masked AI conversation summaries, rule logs and notification records.
• Processor for Company Data and personal data within it relating to customers, suppliers, employees and form respondents; the company is the controller.

9.2. Status as a data processing agreement

For Company Data, this section constitutes the data processing agreement between the Parties under Article 28 GDPR and Article 12/2 of Turkish Law No. 6698 (KVKK). The subject is hosting Company Data to provide the Service and processing it on the Business's instructions. Its duration is the Agreement term plus the deletion period in section 15. Its nature and purpose are task management, automation, forms, project chats and file attachments. Data types are the identity, contact and business data included in Company Data in section 2; data subjects are the Business's members, customers, suppliers and form submitters. As processor, the Company:

• Processes Company Data only to operate the Service on documented company instructions; apart from security, abuse checks and quota counting, no own-purpose use, sale, advertising or model training. Acceptance of this Agreement and use of a feature constitute documented instructions, including transfers under Article 9.4. The company is informed immediately if an instruction is considered contrary to data protection law.
• Ensures personnel with access are bound to confidentiality; access follows least privilege, production data is not used for experiments and test accounts remain separate.
• Implements technical and organisational measures in Article 9.5.
• Uses the subprocessors listed in the Privacy Policy (Supabase, Cloudflare, Stripe, OpenAI, Google Workspace for sending emails, browser push services and, for phone notifications, Google Firebase Cloud Messaging and Apple), imposes equivalent duties by written contract and remains fully responsible to the company for their performance. New subprocessors are announced by registered company email and in the Privacy Policy at least 30 days before processing. A company raising reasonable objections within that period may terminate without compensation.
• On becoming aware of a personal data breach affecting Company Data, the Company informs the Business without delay using the information available, so the Business can notify its supervisory authority within 72 hours under Article 33 GDPR and Article 12/5 KVKK (the Personal Data Protection Board in Turkey or the authority of the EU Member State where the Business is established). Informing data subjects is the Business's responsibility. For breaches affecting account, subscription or technical records for which the Company is controller, the Company notifies the Personal Data Protection Board and the Estonian Data Protection Inspectorate within 72 hours and informs affected users within a reasonable time via their registered email addresses and this site.
• Assists the company with data subject requests within platform capabilities, and supports impact assessments and prior consultation duties using available information.
• On termination, returns Company Data as chosen under Article 9.7 or deletes it within Article 15's period, except legally required records. Provides compliance information on written request and supports at most one audit annually by written questionnaire.

9.3. Company declaration (KVKK and GDPR)

The Business is controller for personal data it enters into the Platform and collects through members, public forms, project chats and file attachments. It represents and undertakes that, under Turkish Law No. 6698 (KVKK) and the GDPR where applicable, it has provided the required privacy information, obtained explicit consent where necessary, established a legal basis for international transfers (Estonia/EU; the USA when using the AI assistant; Stripe for payments; Cloudflare for attachments), and informed its employees about measurements within the Platform, including performance assessment. The Company is not responsible for deficiencies in the Business's own data protection compliance.

9.4. Data location and international transfers

Database and authentication infrastructure is in the EU (Frankfurt). Attachments are stored in Cloudflare R2; each request checks database permissions, and inaccessible metadata means inaccessible file bytes. Assistant requests go to OpenAI in the USA and payment data goes to Stripe; emails are sent through Google Workspace, and phone notifications are delivered through Google Firebase Cloud Messaging and, on iPhone, also Apple. Server functions process requests temporarily at the nearest point of a global edge network without storage. Transfers to subprocessors constitute the company's documented instructions under Article 9.2; information on the safeguards applied to these transfers can be requested at [email protected]. For companies established in Türkiye, transfers of Company Data to the Company and its subprocessors fall under KVKK Article 9. If a company asks to sign the controller-to-processor standard contract announced by the Personal Data Protection Board, the Company handles the request at [email protected]; unless the contract provides otherwise, the company transferring the data notifies the Board. Company Data is not shared with anyone other than the subprocessors listed in Article 9.2, except for legally required disclosures limited to a competent authority's written request.

9.5. Data security

Measures include company isolation enforced by database row security and live tests; TLS connections; passwords hashed only by the authentication provider; separate confidential-field storage with controlled access; Content Security Policy excluding third-party scripts; no client-side secrets; script-free Mail sandbox; SHA-256 file integrity checks; and regular dependency scanning. No additional certification, monitoring level or availability rate is promised.

9.6. Private fields

Confidential fields are readable only by authorised company members and are not sent to the AI assistant or public forms. The company determines confidentiality and access, and must keep those settings accurate and current.

9.7. Data portability, backup and deletion

Task lists and performance data can be exported as CSV within the app; there is no one-click full backup or archive download. Regular export of Company Data is the Business's responsibility; the Company does not promise a particular backup frequency or restoration service. Deleting a file attachment removes its bytes from storage. For Company Data that cannot be exported within the app (project chats, file attachments and form responses), the company owner may submit a written request to [email protected] before the deletion period expires; requests are fulfilled to a reasonable extent in a commonly used file format. The owner may close the company workspace; all its data is permanently deleted 30 days after closure. The account itself can be deleted in the app (Settings > Delete account); if the person is a company's only active owner, the company is closed as well and all its data is permanently deleted after 30 days. Without sign-in, deletion is made on an email request to [email protected] or [email protected]. Retention periods and data subject rights are set out in the Privacy Policy and KVKK privacy notice.

Privacy policy →

KVKK privacy notice →

10. Third-party dependencies

10.1. Service dependencies

Operation depends on Supabase (database/authentication), Cloudflare (hosting/storage), Stripe (payments), OpenAI (AI), Google Workspace (email sending), browser push services (Google, Apple, Mozilla), Google Firebase Cloud Messaging and Apple for phone notifications, and Google/Microsoft mail services for Mail connections.

10.2. Outages

The Company is not responsible if third-party termination, restrictions, charges, permission or interface changes or technical failures prevent related platform functions. Such interruptions are not Service defects or grounds for refunds.

10.3. Browser and device

The platform works in current browsers. Push notifications, Mail and file previews depend on browser capabilities and permissions. Browser push is end-to-end encrypted through browser-vendor services. The mobile app runs on Android and iOS; phone notifications are delivered through Google Firebase Cloud Messaging and, on iPhone, also Apple, over an encrypted connection but without end-to-end encryption. Timing and delivery guarantees depend on these services. Task notifications are not sent by email; notifications are delivered in the app, in the browser or on the phone. Account verification and password reset messages, company invitations and the summary email chosen by company owners and administrators are sent by email through Google Workspace.

11. Service continuity, maintenance and changes

11.1. Maintenance

The Company may temporarily suspend the Service for planned maintenance, scheduled during low-traffic hours where possible.

11.2. Changes

The Company may develop, change or remove features, update sector templates, stop Mail support for individual providers and change capacities for new subscriptions. Material user-experience changes are announced here in advance; contractual changes follow Article 17.1. Existing company configurations and data are not deleted due to feature changes without notice.

11.3. Force majeure

Force Majeure suspends obligations until the obstacle ends. After 30 days, either party may terminate without compensation.

12. Disclaimer of warranties

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICE IS PROVIDED “AS IS” AND “AS AVAILABLE”. THE COMPANY MAKES NO EXPRESS OR IMPLIED WARRANTY OF UNINTERRUPTED, SECURE, ERROR-FREE OR VIRUS-FREE OPERATION; FITNESS FOR PURPOSE; EXPECTED AUTOMATION RESULTS IN ALL CONDITIONS; ACCURATE OR COMPLETE AI OUTPUT; PERFORMANCE METRICS REFLECTING A PERSON'S ACTUAL WORK; DELIVERY OF MAIL OR TIMELY NOTIFICATIONS; OR IMPROVEMENT OF BUSINESS RESULTS.

13. Limitation of liability

13.1. Indirect losses

To the fullest extent permitted by law, the Company, its directors, shareholders, employees and partners are not liable, whether in contract, tort or negligence, for lost profits or reputation, business interruption, replacement goods or services, or indirect, special, incidental or punitive damages.

13.2. Liability cap

Total cumulative liability to the Customer and its Users may not exceed fees paid in the 12 (twelve) months preceding the event. For unpaid Free use, the cap is 100 (one hundred) euros, subject to mandatory Estonian law. Company Data loss caused by breach of Article 9 is compensated as direct damage subject to this cap.

13.3. Data stored on your device

Mail tokens, message content and browser-stored preferences are inaccessible to the Company; it is not responsible for their loss on your device, disconnections or provider-side changes.

13.4. Exceptions

These limits do not apply to intent, gross negligence, injury to life, body or health, or liability that cannot legally be limited.

14. Indemnification

The Customer agrees to indemnify and hold the Company harmless against all claims, proceedings, losses, penalties and expenses, including legal fees, arising from the Customer's or its Users' actions involving: (a) breach of this Agreement; (b) unlawful use of the Platform; (c) breach of connected third-party service terms (Google, Microsoft) or third-party rights; (d) infringement of third-party copyright, privacy or personal data rights by data entered into the Platform or collected through public forms, project chats or attachments; (e) content sent through Mail connections; or (f) decisions about employees based on Platform measurements, including performance assessment.

15. Termination of the agreement

15.1. Termination by the User

Paid subscriptions may be cancelled anytime in Stripe's portal, effective at period end. Without an active subscription, owners can close the company and reopen it within 30 days; afterwards all data is permanently deleted. Members can ask an owner or administrator for removal. The account itself can be deleted in the app (Settings > Delete account); if you cannot sign in, request it by email to [email protected].

15.2. Termination by the Company

The Company may suspend accounts or companies or terminate immediately without notice for breach, non-payment, suspicious or unlawful activity, or cessation of operations. Termination for breach gives no refund.

If the Company ends the entire Service, it gives at least 60 days' notice by registered company email and on this site, keeps Article 9.7 exports available during that time and refunds unused prepaid periods through Stripe.

15.3. Suspension and export period

Unless serious breach, illegality or risk to others prevents it, suspension or provider termination allows a reasonable period for CSV export.

15.4. After termination

After termination or closure, Company Data is permanently deleted after 30 days under the Privacy Policy. Export before then or request a copy from [email protected] under Article 9.7. The Company cannot delete device-held Mail tokens; disconnect in Mail or clear browser data.

15.5. Surviving provisions

Provisions that by nature survive termination remain effective, including intellectual property, liability limits, indemnity, applicable law and unpaid fees.

Privacy Policy — retention periods →

16. Governing law and jurisdiction

16.1. Governing law

This Agreement is governed by and interpreted under Estonian law, without regard to conflict-of-law rules.

16.2. Jurisdiction

Harju County Court (Harju Maakohus) in Tallinn, Estonia has exclusive jurisdiction over disputes arising from or relating to this Agreement. The User irrevocably accepts that jurisdiction.

16.3. Amicable resolution

Before litigation, the parties attempt good-faith resolution for 30 days. Requests for discussions must be sent in writing to [email protected].

16.4. Right to contact data protection authorities

This does not restrict complaints about personal data to competent authorities: the Turkish Personal Data Protection Board for Türkiye residents; for EU residents, the authority at habitual residence, work or the alleged infringement, including Andmekaitse Inspektsioon in Estonia where the Company is established.

17. Miscellaneous provisions

17.1. Changes

The Company may update terms for legal, security, technical or Service changes. Dated versions appear here; material changes require at least 30 days' email notice to the company. Continued use means acceptance. Material adverse changes to paid subscriptions apply no earlier than renewal; if you disagree, cancel before renewal and close the company.

17.2. Severability

If a competent court finds any provision invalid or unenforceable, the remaining provisions stay fully effective.

17.3. Assignment

Users cannot assign contractual rights or duties without written consent. The Company may assign the Agreement in a merger or business transfer.

17.4. Waiver

Failure to exercise a right does not waive it.

17.5. Notices

Legal notices are sent by the Company to the registered email address. Task notifications from the platform are not sent by email; only the summary email chosen by company owners and administrators is sent; Users must keep their email current for legal notices. Notices to the Company go to [email protected].

17.6. Entire agreement

This Agreement and its annexes — Privacy Policy, Cookie Policy, Cancellation and Refund Policy and KVKK Privacy Notice — form the entire agreement and replace prior oral or written agreements.

17.7. Language

The Turkish version of this agreement is authoritative. If it is translated into another language, the Turkish version prevails in the event of a discrepancy.

18. Contact details

For all your questions, requests and legal notices regarding this Agreement:

Contact page →