Cirrux Terms of Service

Effective date: 16 August 2026.

These Terms of Service ("Terms") are the agreement between you and Werk Slim B.V. ("Cirrux", "we", "us", "our") about your use of Cirrux. By creating an account or using the service, you accept them. If you are signing up on behalf of an organisation, you confirm that you are allowed to bind it, and "you" means that organisation.

The short version

Your content is yours. We never sell it or train AI models on it, and no person here reads it unless you ask support to.
Everything runs on our own infrastructure in Frankfurt, Germany.
cirrux.livests €2,99 per user per month or €29 per user per year. 20 GB per seat, 100 GB on Plus.
Cancel any time. If it turns out not to be for you, we refund your first payment within 14 days.
Do not spam, do not break the law, do not attack our systems.
You can leave whenever you want. IMAP, CalDAV, CardDAV and plain file downloads mean your data walks out with you.
If something goes wrong, email help@cirrux.live and a person answers.

That summary is there to orient you. The numbered sections below are the actual agreement, and they are what counts if the two ever seem to disagree.

Who we are
Definitions
What Cirrux is
Your account
Workspaces, administrators and members
Custom domains
Acceptable use
Storage, sending limits and fair use
Prices, payment and taxes
Renewal, cancellation and refunds
Your content and who owns what
Privacy and data protection
Security
Third party services
Availability, maintenance and support
Getting your data out
Suspension and termination
Warranties and what we do not promise
Liability
Indemnity (business customers)
Changes to the service and to these Terms
Transfer of this agreement
Governing law and disputes
The rest
Contact

1. Who we are

Cirrux is a product of Werk Slim B.V., a private limited company incorporated under the laws of the Netherlands, with its office at Larenseweg 136, 1222 HM Hilversum, the Netherlands, registered with the Dutch Chamber of Commerce under number 77760026.

You can reach us at help@cirrux.live. That address reaches the people who build Cirrux, not a ticket queue.

2. Definitions

Service: the Cirrux apps (mail, calendar, contacts, drive), our websites, the public API and CLI, and the standard protocols we serve, including IMAP, SMTP, CalDAV and CardDAV.
Workspace: the account that holds your mailboxes, domains, members and subscription.
Member: a person with access to a workspace. Each member occupies a seat.
Administrator: a member with admin rights over a workspace.
Content: everything you or your members send, receive, upload or create in the service, including messages, attachments, calendar events, contacts and files.
Agreement: these Terms, our Privacy Policy, our Data Processing Agreement where you are a business customer, and any order form we have signed with you.

3. What Cirrux is

Cirrux provides email, calendars, contacts and file storage, built and operated by us rather than assembled from other people's services. It also includes Cirrux Sync, which keeps an existing mailbox (currently Google, with Microsoft and generic IMAP coming) in step with Cirrux, and Cirrux Backup, which keeps an encrypted copy of your Google account on European servers.

Cirrux speaks open standards, so you can use it with any IMAP, CalDAV or CardDAV client instead of our apps if you prefer.

Some features are marked as beta or early access in the product. Those can change or be withdrawn while we work on them, and you should not build a critical process on them without talking to us first.

Cirrux Backup is a second copy of your data, not a compliance archive. It does not come with legal hold, retention policies, or evidentiary guarantees unless we have agreed those with you separately.

4. Your account

Give us accurate account and billing details, and keep them current.
You need to be at least 16, or the age of digital consent in your country if that is higher. Below that, a parent or guardian holds the account.
Keep your credentials to yourself, and turn on two-factor authentication. You are responsible for what happens under your account until you tell us it has been compromised.
If you suspect misuse, email help@cirrux.live straight away and we will help you lock things down.
One account is for one person. If several people need the same address, use a shared mailbox or an alias rather than sharing a login.
There is no free tier. Every account is paid from day one. That is deliberate: free accounts are what spam operations run on, and keeping them off the platform is a large part of why mail sent from Cirrux reaches the inbox.

5. Workspaces, administrators and members

If a workspace was created by or for an organisation, that organisation is our customer. It owns the workspace, including the mailboxes, domains and content in it, and it decides who gets access.

Administrators can add and remove members, reset access, manage domains, change the subscription, and see workspace level information such as billing details, member lists and audit data.
Administrators can also be given access to a member's mailbox where the organisation is entitled to that access. Deciding whether it is entitled is the organisation's responsibility, not ours.
If you use a Cirrux account provided by your employer or another organisation, your relationship about that data is with them. We act on their instructions.
Adding a member adds a seat and changes what you pay from that moment. Removing a member releases the seat.
A personal account that you pay for yourself is yours, and no organisation controls it.

6. Custom domains

You may connect any domain you own or are authorised to use, and you confirm to us that you have that right. You are responsible for your DNS records, including the MX, SPF, DKIM and DMARC records we ask you to set.

If those records are wrong, or the domain is moved elsewhere, mail can bounce or be delivered somewhere you did not intend. That part sits outside our control. If we receive credible evidence that a domain is not yours to use, we can disconnect it.

7. Acceptable use

Do not use Cirrux to:

break the law, or help someone else break it
send unsolicited bulk mail, or mail to lists you did not collect yourself with consent. This one matters more than the rest: our delivery reputation is shared by every customer on the platform.
send phishing, malware, or anything built to deceive recipients about who sent it
infringe someone else's intellectual property or privacy
harass or threaten people, or distribute material that sexually exploits children. We have zero tolerance here and we report it.
probe, overload or interfere with our systems, or work around limits, quotas or billing
resell Cirrux or present it as your own service, without a written agreement with us
run automated traffic at a scale that degrades the service for others, mine cryptocurrency, or use mailboxes as bulk file storage or a content delivery network

Security research is welcome. Tell us first at help@cirrux.live with "security" in the subject, test only against your own account, and stay away from other people's data. We will not come after anyone who does that in good faith.

If you break these rules we can rate limit you, suspend outbound sending, suspend the account, or end the agreement. We would rather talk to you first, and usually will. For spam, fraud, and anything that puts other customers' deliverability at risk, we act immediately and talk afterwards.

8. Storage, sending limits and fair use

Each seat includes 20 GB of storage across mail, drive and backups. Cirrux Plus raises that to 100 GB per seat.
If a workspace goes over its tier, we email the administrator. If usage is still over after seven days, we move the workspace to Plus automatically and bill the Plus rate from that point. Bring usage back under the limit within those seven days and nothing changes.
We apply sending limits per account to protect deliverability for everyone. They are generous for normal use. If you have a legitimate high volume case, talk to us and we will work it out rather than let you run into a wall.
Sending through the public API is subject to the same rules.

9. Prices, payment and taxes

cirrux.livests €2,99 per user per month, or €29 per user per year. Cirrux Plus, which raises storage to 100 GB per seat, costs €4,99 per user per month or €49 per user per year.
Supporter contributions are voluntary. They buy no additional service, and you can change or stop them at any time from your account settings.
Prices are in euro. VAT is calculated at checkout based on your location and the VAT number you provide, if any.
Payments run through Stripe. Giving us a payment method authorises recurring charges for your subscription until you cancel.
Seat changes during a period are prorated against that period.
If a payment fails we retry it and email you. Your subscription then enters a seven day grace period, during which incoming mail is temporarily deferred rather than rejected, so senders retry instead of receiving a permanent bounce. After the grace period, mail to your addresses is rejected and paid features stop. Sorting out the payment method restores everything.
We can change prices. We will give at least 30 days' notice by email before a change applies to your renewal, and you can cancel before it takes effect. A period you have already paid for is never repriced.

10. Renewal, cancellation and refunds

Subscriptions renew automatically, monthly or yearly, until you cancel.
You can cancel at any time from your account settings. Your workspace stays active until the end of the period you have already paid for, and then stops renewing.
Email help@cirrux.live within 14 days of your first payment and we refund it in full. No form to fill in and no reason required.
If you are a consumer in the EU, you also have a statutory right to withdraw from the agreement within 14 days. By signing up and using the service straight away, you ask us to start performing during that period. Our own refund promise above is at least as generous, so in practice you get your money back either way.
Beyond that, we do not refund periods that have already started, unless the law requires it or we have clearly failed to deliver.
Cancelling stops the billing. If you want your account and data deleted outright, email help@cirrux.live. Section 17 explains what happens to your data either way.

11. Your content and who owns what

Your content is yours. We claim no ownership of it.
You give us the limited permission we need to run the service for you: to store, transmit, index for your own search, back up, encrypt and display your content, and to deliver it to the recipients you address it to. Nothing beyond that.
We do not sell or share your content, we do not use it for advertising, and we do not train AI models on it. No person at Cirrux reads your messages or files, except when you ask support to look into a specific problem.
Automated processing on our servers is unavoidable, because it is the product: filtering inbound mail for spam and malware, running the filter rules you set, indexing so your own search works, and handling the routing metadata that mail delivery requires. Our Privacy Policy sets out exactly what reads your mailbox and what never happens to it.
You are responsible for having the rights to the content you put into Cirrux.
Cirrux itself, meaning the software, design, brand and documentation, stays ours. These Terms transfer none of it beyond the right to use the service. Where we publish something under an open source licence, that licence governs it.
If you send us feedback or feature ideas, we may use them freely and owe you nothing for it. We are grateful for them, and we will not treat them as confidential unless you tell us up front that they are.

12. Privacy and data protection

Our Privacy Policy explains what we collect and why. A few points belong here too, because they are commitments and not just descriptions.

Your content is stored on our own infrastructure in Exoscale's DE-FRA1 data centre in Frankfurt, Germany, and it stays in the EU.
For the personal data inside your content, you are the controller and we are the processor under the GDPR. We process it on your instructions, to provide the service. For your account and billing data we are the controller.
If you are a business customer, our Data Processing Agreement applies automatically, with nothing to request or sign. It sets out what we do with the personal data in your workspace, and it prevails over this section where the two disagree. We will send a countersigned copy if your procurement process needs one.
We use a small number of sub-processors, each named in Annex III of the DPA with what it receives. We give 30 days' notice before adding one that touches your content, and you can object.
If a data breach affects your data, we will tell you without undue delay and give you what you need to meet your own notification duties.
We hand data to authorities only where we are legally required to. We check that a request is valid, we give the minimum the request covers, and we tell you unless the law forbids it.

13. Security

Connections are encrypted in transit, and message bodies, attachments and files are encrypted at rest in object storage.
Two-factor authentication is available on every account, and we recommend using it.
Your side of this: protect your credentials, keep track of the app passwords you hand to mail clients, and revoke access for people who leave.
No system is perfectly secure. We take security seriously and we will tell you plainly if something goes wrong, but sections 18 and 19 apply.
Report anything you find to help@cirrux.live.

14. Third party services

Connecting a Google or Microsoft account, or using a third-party client, means that provider's terms apply to their side of it. We do not control what they do with their APIs. If a provider changes or withdraws access, features that depend on it can degrade or disappear, and that is not a failure we can promise our way out of.

Payments run through Stripe under Stripe's terms. We are not responsible for third-party services, but we will be straight with you about what broke and where.

15. Availability, maintenance and support

We aim for Cirrux to be available at all times, and we run our own company on it. We do not commit to a specific uptime percentage unless we have agreed one with you in writing.
We schedule planned maintenance for quiet hours and announce it in advance when it will be noticeable.
Support runs by email at help@cirrux.live, is included in your subscription, and is answered by the team that builds the product, quickest during Dutch business hours.
When something significant breaks, we tell you what happened rather than wait to be asked.

16. Getting your data out

Cirrux speaks IMAP, CalDAV and CardDAV, so any standard client can pull down a complete copy of your mail, calendars and contacts, and Drive files download as ordinary files. There is no export we have to grant you, no fee for leaving, and no format you need us to unlock. If you want help migrating away, ask and we will help.

17. Suspension and termination

You can cancel at any time, as described in section 10.
We can suspend or terminate if you break these Terms, if payment fails past the grace period, if there is fraud or abuse, or if the law requires it. A suspension stops outbound sending, IMAP and SMTP authentication, and web sessions. It is reversible, and we lift it as soon as the cause is resolved.
If we ever discontinue Cirrux, or a part of it you rely on, we will give at least 90 days' notice, refund the unused part of what you have paid, and keep export working for that entire period.
After a subscription ends we keep your workspace for 30 days, so you can reactivate or export, and then delete it permanently. Google backup data is deleted within 48 hours, as described in the Privacy Policy. If you ask us to delete your account immediately, we do, and that cannot be undone.
Ending the agreement does not cancel amounts already owed.

18. Warranties and what we do not promise

We provide the service with reasonable care and skill, and we do what these Terms say we will do.
Beyond that we provide it as it is. We do not promise that it will be uninterrupted or error free, that every message will arrive on time, that spam filtering will catch everything or never make a mistake, or that the service fits a particular purpose you have in mind.
Email is a store and forward system that depends on networks and receiving servers we do not control. Delivery and timing are best effort by nature.
If you are a consumer, nothing here takes away your statutory rights under Dutch law.

19. Liability

Nothing in these Terms limits our liability for intent or deliberate recklessness (opzet of bewuste roekeloosheid), for death or personal injury, or for anything else the law says cannot be limited.
Otherwise, our total liability under this agreement is limited to the amount you paid us in the 12 months before the event that caused the damage.
We are not liable for indirect or consequential loss, including lost profits, lost business, lost goodwill, or the cost of a replacement service. We are also not liable for loss of content where you were able to keep your own copy, which section 16 means you always are.
Any claim has to be brought within 12 months of the day you knew, or should have known, about it.
These limits apply as far as the law allows, and consumers keep their statutory rights in full.

20. Indemnity (business customers)

If you are not a consumer, you will cover us against third-party claims arising from your content, or from your use of the service in breach of these Terms, including regulatory fines caused by mail you sent. We will tell you about such a claim promptly, let you lead the defence, and will not settle it without your agreement.

21. Changes to the service and to these Terms

The product changes. Features get added, improved, and occasionally removed. We will not remove something significant that you depend on without notice and a path forward.
We can change these Terms. For material changes we email you and give at least 30 days' notice. If you do not agree, cancel before they take effect. Continuing to use Cirrux after that means you accept them.
Minor changes, such as corrections, clarifications and updated contact details, take effect when we post them. The effective date at the top of this page always reflects the current version.

22. Transfer of this agreement

You cannot transfer this agreement without our consent, which we will not withhold unreasonably. We can transfer it to a group company, or as part of a merger or a sale of the business, provided your rights are not worsened. If that happens, we will tell you.

23. Governing law and disputes

Dutch law governs this agreement.
Talk to us first at help@cirrux.live. Nearly everything gets resolved that way.
If it cannot be resolved, Dutch law applies.
Your own general terms, purchasing conditions or otherwise, do not apply to this agreement unless we have accepted them in writing.

24. The rest

If a provision turns out to be invalid, the rest stays in force and we replace the invalid part with the closest valid equivalent.
Not enforcing something once does not mean we have given up the right to enforce it later.
These Terms, together with the Privacy Policy and any order form or data processing agreement we have signed with you, are the whole agreement about the service, and replace any earlier version.
These Terms are written in English. Any translation is for convenience, and the English text governs.

25. Contact

Werk Slim B.V.
Larenseweg 136, 1222 HM Hilversum, the Netherlands
Dutch Chamber of Commerce number 77760026
help@cirrux.live

Help Privacy Terms DPA Sustainability