T Tallymail

Legal & Privacy

1. About this document & jurisdictions

This single document is the complete legal agreement between you and Tallymail. It combines what other companies usually split into multiple files — Privacy Policy, Terms of Service, Acceptable Use Policy, Sign-up Agreement, and Data Processing Addendum — into one binding instrument.

Tallymail is a product of Regularis Legal Limited, a private limited company registered in England & Wales (Company No. 10710132), with registered office at 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF. Wherever this document refers to "Tallymail," "we," "us," or "our," it means Regularis Legal Limited.

International expansion: We may in future establish subsidiary or affiliated entities to contract with customers in specific jurisdictions (for example an Irish entity for EU customers, or a US entity for United States customers). If we do, we will amend this document, notify existing customers by email of the change and the new contracting entity, and give customers the option to cancel their subscription under Section 16.1 before the change takes effect. Until any such change is made and notified, Regularis Legal Limited is the sole contracting party for all customers worldwide.

2. Privacy Policy

2.1 What Tallymail does, in plain English

Tallymail is a Microsoft Outlook add-in and companion dashboard that reads emails from a user's mailbox via Microsoft Graph, calculates a financial value for each email based on the user's hourly rate, and lets the user save selected emails as billable time entries categorised into matters. Optionally, the service uses OpenAI to generate short text summaries ("narratives") for each saved entry.

2.2 What we collect about you (account holder)

Category	What's in it	Where it comes from
Account identity	Email address, display name, your assigned firm role and hourly rate.	Microsoft sign-in + what you enter on the Profile page.
Microsoft access tokens	OAuth access token, refresh token, expiry, scope ("Mail.Read" + standard sign-in scopes).	Issued by Microsoft after you sign in. Stored encrypted at rest in our database so we can re-read your mailbox without re-prompting you to sign in.
Tenant / firm record	Your firm's Microsoft tenant identifier, display name, plan.	From Microsoft and our billing system.
Audit log	Records of which actions you took in Tallymail (created matter, saved entry, deleted entry, exported CSV, etc.) and when.	Our own systems.

2.3 What we collect about your emails

Tallymail is a mailbox-aware product, so it processes email metadata and partial content. Specifically:

• At scan time only (not persisted): we read email subjects, sender / recipient addresses, send and receive dates, body previews (the first ~255 characters Microsoft Graph returns), and approximate word counts. Full message bodies are read transiently for word-count and AI-narrative purposes; we do not write the full body to our database.
• When you save an email as a billable entry (persisted): we store the subject, sender / counterparty address, direction (sent or received), the email's Microsoft message ID, the conversation ID, the first ~280 characters of the body (a "snippet"), the calculated word count, your chosen minutes and rate, the calculated cost, an optional AI-generated narrative, and the date and time the email was sent or received.
• What we do NOT store: full email bodies, email attachments, recipients beyond the primary counterparty, mailbox folders, contact lists, calendar events, or anything outside the scope above.

2.4 What we collect about your matters and clients

When you create a matter in Tallymail you may enter a matter title, client name, case reference, description, and a default hourly rate. This is client-confidential information about your cases and your clients. We treat it accordingly under section 5 (Data Processing) below.

2.5 Why we process this data (legal bases under UK / EU GDPR)

Purpose	Legal basis
Providing the service you have signed up to use (scanning your mailbox; calculating cost; saving time entries; displaying timelines; exporting CSVs)	Performance of contract (Art. 6(1)(b))
Storing OAuth tokens so you don't have to re-sign-in for every action	Performance of contract; legitimate interests in service usability (Art. 6(1)(b) and (f))
Calling OpenAI to generate narratives	Performance of contract — only when you opt in by capturing an entry or running "AI narratives"
Maintaining audit logs	Legitimate interests in security and compliance; legal obligation to keep certain financial records (Art. 6(1)(c) and (f))
Billing and payment processing	Performance of contract; legal obligation
Service security; preventing misuse	Legitimate interests (Art. 6(1)(f))

2.6 Where the data is stored

All Tallymail customer data is hosted in the European Union. Our database (Supabase) and application infrastructure (Render) are configured to the EU Frankfurt region. We do not transfer the data outside the EU/UK except for:

• OpenAI (USA): when AI narrative or summary features are used, the email subject, sender and body excerpt are sent to OpenAI for processing. OpenAI does not train on our API requests under their standard API terms and retains the data only as long as needed to comply with their legal obligations (currently up to 30 days). For US data subjects, see section 2.13.
• Microsoft: your mailbox access is via Microsoft Graph; the underlying mailbox stays in your Microsoft account, wherever Microsoft hosts that. We only fetch and read.
• Stripe (USA): billing and payment processing. Stripe is the data controller for the card details. Tallymail never sees full card numbers.

Where transfers to the US are involved we rely on the EU Standard Contractual Clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework certification of the sub-processor.

2.7 How long we keep data

• Account & profile data — for the lifetime of your account, plus 90 days after deletion (for backup retention).
• Microsoft OAuth tokens — until you sign out, your refresh token expires (typically 90 days of inactivity), or you delete your account, whichever comes first.
• Time entries and matter data — until you delete them, plus 90 days in our backups. We do not auto-prune; lawyers commonly need to retrieve historical billing records for years.
• Audit logs — 12 months.
• Inference / cost-tracking events — 24 months.
• Backups — 30 days, rolling.

2.8 Your rights

If you are located in the UK or the EU, the UK GDPR or EU GDPR gives you the right to:

• Access the personal data we hold about you (subject access request);
• Have it corrected;
• Have it erased ("right to be forgotten");
• Restrict our processing of it;
• Object to processing based on legitimate interests;
• Receive it in a portable, machine-readable format;
• Withdraw consent (where consent was the legal basis);
• Lodge a complaint with the Information Commissioner's Office (UK), the Data Protection Commission (Ireland), or any other competent supervisory authority.

To exercise any of these, email help@tallymail.io from the address on your account. We will respond within 30 days.

2.9 Privacy notice specific to United States residents (CCPA / CPRA)

If you are a resident of California or another US state with comparable consumer-privacy legislation, you have additional rights, including:

• The right to know what categories of personal information Tallymail collects, the sources, the business or commercial purposes, and the categories of third parties with whom it is shared (set out above in section 2.2–2.6);
• The right to request a copy of the specific personal information collected about you in the preceding 12 months;
• The right to request deletion of your personal information;
• The right to correct inaccurate personal information;
• The right to opt out of "sale" or "sharing" of personal information (we do not sell or share personal information for cross-context behavioural advertising; this is provided for completeness);
• The right to limit the use of sensitive personal information;
• The right not to be discriminated against for exercising these rights.

Submit any CCPA / CPRA request to help@tallymail.io.

2.10 Children

Tallymail is a tool for legal and professional services. It is not intended for and not directed at anyone under the age of 18. We do not knowingly collect personal information from children.

2.11 Security

We use industry-standard measures including TLS in transit, AES-256 encryption at rest (provided by our hosted database), OAuth-based authentication, JWT-signed session tokens, hashed and salted secrets, and role-based access control. No system is 100% secure; we will notify affected customers within 72 hours of becoming aware of any personal-data breach as required by applicable law.

2.12 Cookies and local storage

Tallymail uses one essential session cookie (tm_session) and one browser localStorage entry (tm_token) to keep you signed in across page reloads. No third-party trackers, advertising cookies, or analytics cookies are used. You can clear these at any time using your browser's privacy controls; if you do, you will be signed out.

3. Terms of Service

3.1 Agreement to be bound

By creating a Tallymail account, signing in to Tallymail, or otherwise using Tallymail (the "Service"), you agree to be bound by this document. If you are accepting on behalf of a firm or company, you represent that you have authority to bind that entity, and "you" and "your" in this document include both you individually and that entity.

3.2 Eligibility

You must be at least 18 years old, legally able to enter into a binding contract in your jurisdiction, and not be barred by applicable law from receiving the Service. You must use Tallymail in connection with the lawful practice of your profession; Tallymail is not licensed for personal-only use.

3.3 Your account

• You are responsible for all activity on your account.
• One human user = one licence. Sharing of credentials is prohibited.
• You must keep your Microsoft account secure; loss of access to that account may result in loss of access to your Tallymail data.
• You must keep your hourly rate, role, and other Profile information accurate. Tallymail's calculations depend on what you enter.

3.4 Plans, trial, payment, taxes

• Plans, prices, and trial duration are as published on tallymail.io at the time of sign-up.
• Trials are non-transferable and may be limited to one per user / firm.
• Paid subscriptions auto-renew at the end of each billing period. You may cancel at any time; cancellation takes effect at the end of the current period.
• Prices are exclusive of VAT, sales tax, or other applicable taxes, which are added at checkout or invoiced separately.
• We may change pricing on 30 days' notice, applicable to the next renewal.

3.5 What you may do with Tallymail

Subject to your compliance with this document and your payment of applicable fees, Tallymail grants you a limited, non-exclusive, non-transferable, non-sublicensable, revocable licence to use the Service for the internal billing-support purposes of your firm.

3.6 What you may NOT do with Tallymail

You may not, and you may not permit any third party to:

1. Reverse engineer, decompile, disassemble, decrypt, or otherwise attempt to derive the source code, underlying algorithms, AI prompts, data schemas, file formats, business logic, or design of any part of the Service, except to the extent (and only to the extent) that applicable law expressly permits such activity notwithstanding a contractual prohibition.
2. Copy, modify, translate, adapt, or create derivative works of the Service or any part of it.
3. Build a competing product using the Service, observations of how it works, or any information obtained through your use of it. This includes (without limitation) any product whose purpose is to scan an email mailbox and calculate per-email cost based on a user's hourly rate, where that product is launched or made available within five (5) years of your last use of the Service.
4. Use, copy, or imitate the Tallymail brand, name, logo, user-interface designs, copy, navigation patterns, or any element of the look and feel.
5. Sell, resell, rent, lease, sublicense, distribute, publish, transmit, or otherwise transfer access to the Service, in whole or in part.
6. Use the Service to develop a product or service that is or could reasonably be considered competitive with Tallymail.
7. Scrape, crawl, harvest, or extract data from the Service by any automated means, including without limitation scripts, bots, headless browsers, or AI agents, except via the public APIs we expressly publish and under their published terms.
8. Probe, scan, or test the vulnerability of any Tallymail system or network, or breach any security or authentication measure.
9. Interfere with, disrupt, or impose an unreasonable load on the Service.
10. Use the Service to send spam, malware, unlawful content, or content that infringes the rights of any third party.
11. Process data on behalf of a person for whom you are not authorised to do so.
12. Remove, obscure, or alter any proprietary notices in the Service or in any export from the Service.
13. Use the Service in violation of any law, regulation, or third-party right, including (without limitation) export controls, sanctions, data-protection law, professional-conduct rules, and intellectual-property rights.
14. Use any output of the Service (including AI narratives and timeline exports) in any manner inconsistent with applicable professional, regulatory, or court rules.

3.7 Confidentiality of Tallymail

Information you learn or observe about Tallymail's design, architecture, business operations, pricing, roadmap, or any non-public technical information is our confidential information. You will protect it as you would your own confidential information of like importance, and not less than a reasonable standard of care. Confidentiality obligations survive termination indefinitely.

3.8 Your data and your responsibilities

• You retain ownership of the email content, matter records, and client information you cause Tallymail to process ("Customer Data"). You grant Tallymail the licence to process Customer Data necessary to provide the Service.
• You are responsible for the accuracy and legality of Customer Data and for your right to make it available to Tallymail.
• You are responsible for your compliance with the professional-conduct rules of your jurisdiction (in the UK: the SRA Code, BSB Handbook, or CILEx Code as applicable) when using Tallymail's outputs in client bills, court submissions, or other regulated contexts.

3.9 Service availability

We aim to keep Tallymail available 24/7 but do not guarantee uninterrupted access. Scheduled maintenance, third-party service outages (Microsoft, Supabase, Render, OpenAI), and force-majeure events are excluded from any availability commitment. Paid plans include a target uptime of 99.5% measured monthly; failures to meet this target are remedied as set out in the order form, not by termination of this document.

3.10 Term and termination

• This document applies for as long as you have a Tallymail account.
• You may close your account at any time by emailing help@tallymail.io or via the dashboard's "Delete account" function (once available).
• We may suspend or terminate your account immediately, without refund, if you breach this document, fail to pay, use the Service in a way that risks harm to us or others, or are reasonably suspected of misuse of the kinds described in section 3.6.
• On termination, you must cease using the Service. We will delete or return your Customer Data within 30 days, subject to backup-retention windows and any legal-hold obligations.
• Provisions which by their nature should survive termination — including sections on IP, confidentiality, anti-misuse, liability, indemnity, and governing law — will so survive.

3.11 Warranties and disclaimers

The Service is provided "as is" and "as available". To the maximum extent permitted by applicable law, Tallymail disclaims all warranties not expressly given in this document, including (without limitation) the implied warranties of merchantability, fitness for a particular purpose, satisfactory quality, and non-infringement.

Tallymail's outputs — including AI-generated narratives, cost calculations, and time estimates — are aids to professional judgement, not substitutes for it. You are responsible for verifying any output before relying on it for a bill, court submission, regulatory filing, or client communication.

3.12 Limitation of liability

To the maximum extent permitted by law:

• Neither party will be liable for indirect, incidental, consequential, special, exemplary, or punitive damages, or for lost profits, lost data (other than data we are obliged to maintain under section 2), lost business, lost goodwill, or business interruption.
• Tallymail's total aggregate liability arising out of or relating to this document or the Service is capped at the greater of (a) the amount paid by you to Tallymail in the 12 months preceding the claim, or (b) £100 / €100 / US$100 depending on the contracting entity.
• Nothing in this document limits any liability that cannot lawfully be limited — including liability for death or personal injury caused by negligence, fraud, fraudulent misrepresentation, or breach of statutory consumer-protection rights.

3.13 Indemnity

You will indemnify and hold Tallymail (and its directors, employees, agents) harmless from and against any third-party claim arising from or relating to: (a) your breach of this document; (b) your Customer Data; (c) your use of the Service in violation of applicable law or professional-conduct rules; (d) any breach of section 3.6 (anti-misuse).

4. Acceptable Use Policy

You may use Tallymail only for legitimate, lawful professional purposes. You agree that you will not use the Service:

1. To process the data of any person without lawful basis to do so;
2. To process special-category personal data (as defined in the UK / EU GDPR) where Tallymail has not expressly agreed in writing to receive such data;
3. To process data of a child under 18, except in the context of legitimate client work where you act as that child's professional adviser or as adviser to their parent / guardian;
4. To inflate, fabricate, or otherwise manipulate billable-time records in a way that misleads a client, court, regulator, or auditor;
5. To circumvent any limit, quota, rate-limit, or access control we impose;
6. To use Tallymail to develop, train, or evaluate any machine-learning model that competes with the Service;
7. To interfere with the access of other Tallymail users or with the operation of the Service.

We may suspend or terminate accounts that violate this AUP without notice. We may also report violations to law-enforcement, professional regulators, or other authorities as appropriate.

5. Intellectual Property & Anti-Misuse

5.1 Ownership

Tallymail and its licensors own all right, title, and interest in and to the Service, including (without limitation):

• All source code, object code, binaries, scripts, and configuration files;
• All AI prompts, prompt engineering, fine-tuning data, and prompt-chain designs;
• All data schemas, database structures, query patterns, and indexing strategies;
• All algorithms — including the email-to-time formula in lib/cost.js and any successor — used to calculate billable-time values;
• All user-interface designs, interaction patterns, copywriting, screen layouts, icon designs, navigation patterns, and the overall "look and feel";
• The Tallymail name, the Counsel sub-brand, the Tallymail logo, and the colour palette;
• All documentation, knowledge-base articles, marketing materials, and training resources;
• All improvements, enhancements, derivative works, and successors to any of the above.

No express or implied licence to use any of the foregoing is granted except as stated in section 3.5.

5.2 Feedback and suggestions

If you provide Tallymail with any feedback, suggestion, idea, comment, request for enhancement, or other input relating to the Service ("Feedback"), you grant Tallymail a perpetual, irrevocable, royalty-free, worldwide, sublicensable licence to use, modify, and incorporate that Feedback into the Service or any successor product, without any obligation to compensate or credit you.

5.3 Reverse engineering and competitive use

The prohibitions on reverse engineering and competitive use in section 3.6 are material to the bargain between you and Tallymail. The parties agree that:

• Tallymail would be irreparably harmed by breach of those prohibitions, and money damages alone would not be an adequate remedy;
• In addition to any damages and costs, Tallymail is entitled to seek and obtain injunctive relief and specific performance in any competent court, without the need to post bond;
• The parties further agree that liquidated damages of £25,000 / €25,000 / US$25,000 per breach are a reasonable pre-estimate of the loss caused by a single instance of breach of section 3.6 paragraphs (1), (2), (3), (4), (6), (7), or (12), and are payable without prejudice to any other remedy;
• Tallymail may publish the fact (but not confidential details) of any final court or arbitral decision finding a breach of these provisions, as a deterrent to others.

5.4 Confidentiality of demos and trials

Information disclosed to you during a demonstration, trial, beta, or evaluation of Tallymail — including pricing, roadmap, technical architecture, screenshots not publicly published, and the contents of any commercial discussion — is Tallymail's confidential information and is subject to section 3.7. Where you have not separately signed an NDA, this document is the controlling confidentiality agreement.

5.5 Third-party rights

The Service incorporates open-source components and third-party APIs (Microsoft Graph, OpenAI, Stripe, etc.). Your use of those components is also subject to the licence terms of their respective owners, available in our public sub-processor list and source-code dependency manifests.

6. Data Processing Terms (DPA)

This section forms a Data Processing Addendum within the meaning of Article 28 UK GDPR / EU GDPR, and incorporates the EU Standard Contractual Clauses (Module Two: Controller to Processor) as needed where personal data is transferred outside the UK / EEA.

6.1 Roles

• You (the customer) are the controller of any personal data — including your clients' personal data — that you cause Tallymail to process via your use of the Service.
• Tallymail acts as the processor of that personal data on your documented instructions, which are the instructions implicit in your use of the Service.

6.2 Tallymail's obligations as processor

Tallymail will:

1. Process personal data only on your documented instructions, including with regard to transfers, unless required to do otherwise by applicable law (in which case we will notify you in advance unless that law prohibits notification on important grounds of public interest);
2. Ensure that personnel authorised to process the personal data are bound by appropriate confidentiality obligations;
3. Implement appropriate technical and organisational security measures (see section 2.11);
4. Engage sub-processors only as listed in section 7, on terms no less protective than those in this document, and notify you of any intended changes;
5. Provide reasonable assistance with data-subject requests, data-protection impact assessments, and supervisory-authority enquiries;
6. Notify you without undue delay (and in any event within 48 hours of becoming aware) of any personal-data breach affecting your data;
7. At your option, delete or return your personal data on termination, subject to applicable legal retention requirements and our backup-retention window described in section 2.7;
8. Make available to you the information reasonably necessary to demonstrate compliance with Article 28, and submit to audit on reasonable advance notice and at your reasonable cost.

6.3 Customer's obligations as controller

• You will only put personal data into the Service that you have a lawful basis to process;
• You are responsible for providing the privacy notices your data subjects (including your clients) require;
• You will not use the Service to process special-category personal data without our prior written consent;
• You will respond to data-subject requests in your capacity as controller, with our assistance as required.

6.4 International transfers

Where personal data is transferred from the UK / EEA to a third country in connection with the Service (in particular to the United States via OpenAI, Stripe, or other US-based sub-processors), the transfer is made under the EU Standard Contractual Clauses (Module Two), the UK International Data Transfer Addendum, and / or the EU–US Data Privacy Framework where applicable, and the sub-processor has implemented supplementary measures.

7. Sub-processors

Tallymail engages the following sub-processors. We will give at least 14 days' notice of any change by updating this page. By using the Service you consent to these sub-processors.

Sub-processor	Purpose	Data processed	Location
Microsoft Corporation	Identity provider; Mail.Read scope for mailbox access via Microsoft Graph	Sign-in info; mailbox content (read-only, transient)	EU / global (per user's M365 tenant)
Supabase, Inc.	Hosted Postgres database	All persisted customer data	EU (Frankfurt)
Render Services, Inc.	Application hosting (API + static site)	Application traffic; logs	EU (Frankfurt)
OpenAI OpCo, LLC	AI narratives, drafts, summaries	Email subject, sender, body excerpt (when AI features are invoked)	USA — SCCs / DPF
Stripe Payments Europe Ltd / Stripe, Inc.	Billing and payment processing	Card details (held by Stripe); billing email; invoice records	EU + USA

8. Service Level Agreement & uptime commitments

8.1 Target uptime

Tallymail targets 99.5% monthly availability for the production API and dashboard, measured calendar-month, excluding (a) scheduled maintenance windows announced at least 24 hours in advance, (b) failure of any third-party sub-processor (Microsoft Graph, OpenAI, Stripe, Render, Supabase) beyond our control, and (c) issues caused by your own equipment, network, or Microsoft tenant configuration.

8.2 Service credits

If monthly uptime falls below the target, eligible paying customers who notify us in writing within 30 days of month-end may claim a service credit on a sliding scale against their next invoice:

• 99.0%–99.49%: 5% credit
• 97.0%–98.99%: 10% credit
• Below 97.0%: 25% credit

Service credits are the sole and exclusive remedy for any uptime failure and are capped at the fees paid during the affected month. Credits do not apply to trial or free accounts.

8.3 Support

Email support at help@tallymail.io is available to all paying customers, with reasonable-effort response times during business hours UK time. Enterprise customers may be offered an SLA-backed response time under a separate order form.

8.4 Maintenance windows

We may perform scheduled maintenance and emergency maintenance. Emergency maintenance (security fixes, critical bug fixes) may be performed without prior notice and is not counted as downtime for SLA purposes.

9. Security & incident notification

9.1 Security measures

Tallymail implements technical and organisational measures appropriate to the risk, including: TLS 1.2+ for all data in transit; encryption at rest for stored OAuth tokens and customer data via the storage provider's industry-standard encryption; principle-of-least-privilege access controls; audit logging of administrative actions; isolated multi-tenant logical separation; and routine review of dependencies for known vulnerabilities.

9.2 Personal data breach notification

Where Tallymail becomes aware of a confirmed personal data breach affecting your data, we will notify you without undue delay and in any event within 72 hours of becoming aware, providing (so far as known) the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed to address it. This notification SLA is a binding obligation under our DPA (Section 6).

9.3 Customer responsibilities

You are responsible for: keeping your Microsoft sign-in credentials secure; promptly revoking access for departing staff via the Team Members panel; using strong account hygiene on your Microsoft tenant; reporting any suspected compromise of your account to us immediately at help@tallymail.io.

9.4 Penetration testing

You may not perform penetration testing, vulnerability scanning, or any other security probing of the Service without our prior written consent. Customers on Enterprise plans may request a coordinated test under a separate written agreement. Unauthorised testing is a breach of Section 4 (AUP) and may result in immediate suspension.

10. Beta & preview features

We may offer features marked as "beta," "preview," "experimental," or similar. Beta features are provided "AS IS" with no warranty of any kind, may be unstable or incomplete, may change or be discontinued at any time without notice, may have lower performance and reliability than generally-available features, and are not covered by the uptime commitment in Section 8.

You acknowledge that data created, processed, or stored using beta features may be lost or corrupted, and you should not rely on beta features for production-critical workflows. Tallymail's total liability arising from beta features is capped at the fees paid for the beta feature itself, which is typically zero.

11. Third-party services & dependencies

Tallymail depends on third-party services to function. These dependencies are listed in Section 7 (Sub-processors). You agree that:

• Tallymail is not responsible for the availability, performance, or content of any third-party service it integrates with, including Microsoft Graph, OpenAI, Stripe, Render, or Supabase. Outages or changes by those services may affect Tallymail without notice.
• Your use of Microsoft Outlook and Microsoft Graph is subject to the Microsoft Services Agreement and any agreement between you and Microsoft. Tallymail is not a party to those agreements.
• Where you use AI features, your inputs are subject to the OpenAI API terms in addition to ours. OpenAI may process inputs in the United States; we transfer inputs to OpenAI under the EU-US Data Privacy Framework and applicable Standard Contractual Clauses.
• Payments are processed by Stripe. We do not see or store full card details; Stripe is the data controller for the payment-card data it holds.
• If a third-party service ceases to provide functionality we rely on (for example, Microsoft revoking Graph access at the tenant level), some or all Tallymail functionality may degrade or become unavailable.

12. AI use, model-training opt-out & output disclaimers

12.1 No training on your data

Tallymail does not use your data, your emails, your matter content, or any AI inputs derived from your account to train, retrain, fine-tune, or improve any generative AI model, whether owned by Tallymail or by any third party. Where AI features call OpenAI's API, we use the standard API endpoints subject to OpenAI's API terms — which (as of the effective date of this document) provide that API inputs and outputs are not used for OpenAI model training by default.

12.2 No human review of your content

Tallymail staff do not routinely read the email subjects, body excerpts, AI narratives, or matter information stored in your account. Access is limited to: (a) reasonable troubleshooting at your express request; (b) abuse investigations under Section 4 / Section 5; (c) where required by law or court order; or (d) anonymised aggregate analytics that do not identify individuals.

12.3 AI output is informational only

AI-generated narratives, draft replies, and summaries produced by Tallymail are model outputs based on the text you have provided. They may be inaccurate, incomplete, misleading, or fabricated. You are solely responsible for reviewing every AI output before relying on it, sharing it, billing on the basis of it, or sending it as a reply. AI outputs are not legal advice and do not establish or imply any solicitor / attorney / barrister-client relationship between Tallymail and any party.

13. Force majeure

Neither party is liable for failure or delay in performance of obligations (other than the obligation to pay sums due) caused by an event beyond its reasonable control, including but not limited to: acts of God; war, hostilities, terrorism, civil unrest; epidemic, pandemic, public health emergency; fire, flood, earthquake, severe weather; failure of public or private telecommunications networks; failure of cloud-infrastructure providers, including any of our sub-processors; cyberattack or denial-of-service against us or any provider we depend on; new or changed laws, government orders, or sanctions; strikes, lockouts, or industrial action (other than involving our own employees). The affected party must notify the other promptly. If the event continues for more than 60 days, either party may terminate this agreement on written notice.

14. Anti-corruption, export control & sanctions

14.1 Anti-bribery and anti-corruption

Each party will comply with the UK Bribery Act 2010, the US Foreign Corrupt Practices Act of 1977, the Irish Criminal Justice (Corruption Offences) Act 2018, and all other applicable anti-corruption laws. Neither party will offer, give, accept, or receive any bribe, kickback, facilitation payment, or improper advantage in connection with this agreement, whether to a public official or private individual. Breach of this section is a material breach allowing immediate termination.

14.2 Sanctions and denied parties

You represent and warrant that you, your firm, your beneficial owners, and your end users are not (and will not become): (i) listed on the UK Consolidated List, the EU Consolidated Financial Sanctions List, the US Treasury OFAC Specially Designated Nationals list, or any equivalent denied-party list; (ii) located in, organised under the laws of, or operating from a comprehensively sanctioned territory (currently including Cuba, Iran, North Korea, Syria, the Crimea, Donetsk and Luhansk regions of Ukraine, and Russia, as those lists are updated from time to time). You will not export, re-export, or provide access to the Service to anyone described in (i) or (ii).

14.3 Export controls

The Service may be subject to UK, EU and US export control laws. You will not use, export, or re-export the Service in violation of those laws or for any prohibited end use (including weapons of mass destruction, military intelligence, nuclear, chemical, biological, or missile end uses).

15. Marketing & publicity

Subject to your opt-out, Tallymail may identify you as a customer of the Service (including in marketing materials, our website, sales decks, and investor materials) using your firm name and logo as displayed in your account. We will not disclose pricing, usage volumes, internal configurations, or any client-confidential or matter-confidential information.

To opt out, write to help@tallymail.io at any time with subject line "Marketing opt-out" and we will remove your firm from marketing materials within 30 days. Quotes and testimonials require separate express consent.

16. Auto-renewal, price changes & refunds

16.1 Plans and pricing model

Tallymail offers four subscription tiers, all priced in GBP, billed monthly, each capped by a stated maximum number of matters per month with tiered per-matter overage rates:

• Individual: £39 per month, one fee earner, up to 200 matters per month. Overage: £0.30 per matter (201–500), £0.15 per matter (501+).
• Team: £129 per month, includes three (3) fee earners, up to 500 matters per month shared across the team. Overage: £0.25 per matter (501–1,500), £0.10 per matter (1,501+). Additional seats: £29 per seat per month.
• Enterprise: £129 per fee earner per month, with a minimum of five (5) seats, up to 300 matters per seat per month. Overage: £0.20 per matter (301–800), £0.08 per matter (801–2,000). Adding or removing seats during the billing period is prorated automatically by Stripe.
• Enterprise+: £249 per fee earner per month, with a minimum of ten (10) seats, up to 1,000 matters per seat per month, includes dedicated tenant, custom data residency, 99.9% SLA, 24/7 phone support, quarterly business review, and branded eBundle PDFs. Overage negotiated per contract. Counsel add-on included at no extra cost.
• Counsel add-on: £35 per fee earner per month, available on any tier (included in Enterprise+).

Pricing displayed in the application or on the website is indicative. The price charged is the price shown at Stripe Checkout at the moment you start (or modify) the subscription.

Customers are charged in the currency of the tiered price published for their country on the pricing page — pounds sterling for UK customers, US dollars for US customers, and euros for EU customers. All charges are levied by Regularis Legal Limited (the sole contracting entity, see Section 1). Currency conversions between the customer's card currency and the billing currency are performed by Stripe at the interbank rate applicable at the time of charge; Tallymail applies no additional FX margin.

16.2 Auto-renewal

All paid subscriptions auto-renew at the end of each billing period (typically monthly) at the then-current price for your plan and seat count, charged to the payment method on file via Stripe. By starting a subscription or trial, you authorise that recurring charge until you cancel. You can cancel at any time via the Manage Subscription button in your Plan & billing panel. Cancellation takes effect at the end of the current paid period; no partial refunds are issued for unused days.

16.3 Free trial

Free trials require a valid payment method to activate. You will not be charged during the trial period (currently 14 days). If you do not cancel before the trial ends, your card will be charged the recurring fee for the plan you selected and the subscription will continue under section 16.1.

16.4 Price changes

We may change subscription prices on at least 30 days' written notice by email to your billing address. Price changes do not affect the current paid period — they apply only from the next renewal after the notice period. If you do not wish to accept a price change, you may cancel before it takes effect and will not be charged the new price.

16.5 Refunds

Subscription fees are generally non-refundable. We may, at our discretion, issue pro-rata refunds where (a) we have materially breached this agreement and failed to cure within 30 days of written notice; (b) UK consumer law, the Irish Consumer Protection Act 2007, or equivalent consumer law mandates a refund; or (c) we have charged you in obvious error. Service credits under Section 8 are not refunds.

16.6 Taxes

Prices are exclusive of VAT, sales tax, GST, and any other applicable taxes. Where Stripe Tax is enabled on your account, applicable taxes are calculated and collected at checkout. You are responsible for any withholding taxes imposed by your jurisdiction and for any local taxes not collected via Stripe.

17. General provisions

17.1 Entire agreement

This document, together with any order form or amendment signed by both parties, is the entire agreement between you and Tallymail relating to the Service, and supersedes all prior agreements, proposals, marketing materials, and representations on the same subject. No oral statement or pre-contractual representation forms part of this agreement.

17.2 Severability

If any provision is held unenforceable by a court of competent jurisdiction, the remainder of this document remains in full force, and the unenforceable provision will be modified to the minimum extent necessary to render it enforceable, preserving the original intent.

17.3 Assignment

You may not assign or transfer your rights or obligations under this agreement without our prior written consent. We may assign this agreement freely in connection with a merger, acquisition, corporate reorganisation, or sale of all or substantially all of our assets, on notice to you.

17.4 Survival

Sections that by their nature should survive termination will do so, including (without limitation): Sections 2 (Privacy) so far as relates to retention; 3.12 (Limitation of liability); 3.13 (Indemnity); 5 (Intellectual Property & Anti-Misuse), including the liquidated-damages clause; 6 (DPA) so far as relates to return / deletion of data; 8.2 (residual service-credit claims); 9.2 (breach notification of incidents discovered post-termination); 12 (AI outputs); 14 (Anti-corruption / sanctions); 17 (this Section); and 18 (US-specific terms).

17.5 Notices

Legal notices to Tallymail must be sent by email to help@tallymail.io with subject line "Legal Notice" and copied to the registered office of the contracting entity (once published) by recorded delivery. Legal notices to you will be sent by email to the address on your account; you are responsible for keeping that address current. Notices are deemed received on the first business day after sending.

17.6 No third-party beneficiaries

This agreement is for the exclusive benefit of the parties. Except as expressly stated (for example, the rights of Tallymail's affiliates under Section 5), no third party has any right to enforce any provision, and the UK Contracts (Rights of Third Parties) Act 1999 is expressly excluded.

17.7 Waiver

A failure or delay by either party to exercise any right or remedy under this agreement is not a waiver of that right or remedy. A single or partial exercise of a right or remedy does not prevent further exercise of it.

17.8 Independent contractors

The parties are independent contractors. Nothing in this agreement creates a partnership, joint venture, agency, employer-employee, or franchise relationship between them.

17.9 Electronic signature and counterparts

This agreement may be accepted by clicking "I accept," signing in to the Service, paying for a plan, or otherwise indicating assent electronically. Electronic acceptance is binding to the same extent as a handwritten signature under the UK Electronic Communications Act 2000, eIDAS Regulation, and the US ESIGN Act 1999. Where executed as a separate order form, it may be signed in counterparts (including PDF or DocuSign), each of which is an original.

17.10 Headings

Section headings are for convenience only and do not affect interpretation. References to sections include sub-sections.

17.11 No professional advice

Tallymail is software. It is not a law firm, accountancy practice, or financial adviser. Outputs of the Service — including AI narratives, time-entry calculations, and matter summaries — are not legal advice, accountancy advice, tax advice, or financial advice. You are responsible for the accuracy of any time entry you bill to a client. Tallymail provides no opinion on the propriety, recoverability, or admissibility in court of any time entry or invoice produced using the Service.

17.12 Anti-spam

To the extent Tallymail sends you transactional emails (sign-in alerts, billing receipts, security notices, invitation links), those are not unsolicited commercial communications and you may not opt out of them while you have an active account. Marketing emails (if any) will include an unsubscribe link and comply with the UK Privacy and Electronic Communications Regulations 2003, GDPR, the Irish ePrivacy Regulations 2011, and the US CAN-SPAM Act 2003.

17.13 Open-source attribution

The Service uses third-party open-source libraries. A list of components and their licences is available on request to help@tallymail.io.

18. Changes to these terms

We may change this document from time to time. Material changes will be notified by email to the address on your account at least 30 days before they take effect, except where a shorter notice period is required by law (in which case the shortest period permitted by law applies). Non-material changes — clarifications, formatting, sub-processor list updates, and contact details — may be made by updating this page with no individual notice. Continued use of the Service after the effective date constitutes acceptance.

If you do not accept a material change, your sole remedy is to cancel your subscription before the change takes effect under Section 16.1. No further refund or compensation is owed.

19. Contact

• General & privacy enquiries: help@tallymail.io
• Reporting misuse or IP infringement: help@tallymail.io with subject line "IP / Misuse Report"
• Data-subject access & deletion requests: help@tallymail.io with subject line "Data Subject Request"
• Postal address: Regularis Legal Limited, 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF, United Kingdom.