Terms of Service & Privacy Policy
Terms of Service
1. The service
ExhibitMail is a software service for organizing and reviewing e-mail in connection with legal disputes: you upload mailbox exports, the service indexes and stores them in a private case workspace, AI features score messages for relevance against your case description and answer questions about the material with citations, and you can invite other people (such as your attorney) into the case.
ExhibitMail is a software tool, not a law firm. Nothing produced by the service — including relevance scores and AI assistant answers — is legal advice. AI output can be incomplete or wrong; always verify cited e-mails before relying on them. Decisions about your dispute belong to you and your counsel.
2. Your account and case access
Sign-in is passwordless: one-time codes sent to your e-mail address. You are responsible for maintaining control of that e-mail account. The person who creates a case is its owner and controls who else may access it; invited members access the case under these same terms. You must be at least 18 years old and legally able to enter into this agreement.
3. Your content and your responsibilities
You retain all rights to the e-mail and other material you upload. You grant us only the licence needed to operate the service on it (storage, indexing, display to case members, and processing through the AI features you invoke). You warrant that you have the legal right to upload and process the material in your case — including, where required, any consents relating to other people's correspondence — and that you will use the service only for lawful purposes connected to reviewing and organizing your own dispute material.
4. Fees, credits and payment
Starting a case is free: signup, mailbox upload, the guided setup and the included trial credits cost nothing. The first purchase on a case is a one-time case activation, priced by mailbox size at the moment of purchase per the price list published at exhibitmail.com/#pricing; it includes starter credits and an initial hosting period. Additional credits are bought as one-time packs via Stripe; prices are always shown before you confirm a purchase. Credits are spent on metered actions (such as AI scoring and assistant questions) at rates shown in the product, do not expire while the case is active, and are not transferable between cases or redeemable for cash.
After the hosting period included in activation, a flat monthly hosting charge (stated on the price list, currently charged in credits) applies while the case is active. If the case's credit balance cannot cover it, we notify the case owner and, after a grace period, place the case in an archived state: all case data remains accessible for reading, searching and download by its members, but AI features and new imports are paused. Nothing is deleted by archiving, and any credit top-up reactivates the case. Archived cases accrue no hosting charges. We may adjust the price list prospectively; changes never apply retroactively to purchases already made.
If you are a consumer in the EU/EEA you have a 14-day right of withdrawal on credit purchases: we will refund a credit purchase on request within 14 days to the extent the credits from that purchase are unused. For the case activation you consent to immediate performance (the activation takes effect at purchase); its included, unused credits are refundable within 14 days on the same basis as credit packs. By spending credits you consent to immediate performance of the service for the spent portion. For anything else regarding refunds, contact support.
5. Acceptable use
You may not use ExhibitMail to process material you have no right to hold, to infringe others' rights, to attempt to access other tenants' data, to probe or disrupt the service, or to resell the service. We may suspend accounts that break these rules or applicable law.
6. Confidentiality and security
Cases are private: each case is stored in its own isolated, encrypted database, access is invitation-only, and activity within a case is audit-logged for the case owner. Security measures are described further in the Privacy Policy below. We treat the contents of your case as confidential and access them only to operate the service, to investigate abuse or faults, or where the law requires.
7. Availability and changes
We aim to keep the service available and your data safe, but the service is provided "as is" without uptime guarantees. We may improve or change features over time. If we ever discontinue the service, we will give you reasonable notice and an opportunity to retrieve your material.
8. Deletion
You can delete your case at any time. Deletion destroys the case's encryption key, which makes the case data — including copies in any backups — permanently unreadable. This is irreversible.
9. Liability
To the extent permitted by law, our total liability under this agreement is limited to the amounts you paid us in the 12 months before the event giving rise to the claim, and we are not liable for indirect or consequential losses, including the outcome of any legal matter. Nothing in these terms limits liability that cannot be limited by law, and nothing affects the statutory rights you have as a consumer.
10. Changes to these terms
We may update these terms; material changes will be announced in the product or by e-mail with reasonable notice, and the version you accepted is recorded with your account. Continued use after the notice period means acceptance of the updated terms.
11. Governing law
These terms are governed by Swedish law. Disputes are settled by the Swedish courts, with Göteborgs tingsrätt as first instance — except that consumers retain any right to sue or be sued in their home jurisdiction.
Privacy Policy (GDPR)
1. Who is responsible
Soundcare AB (Mailbox 1602, 411 42 Göteborg, Sweden, reg. no. 556882-6621) is the data controller for your account, billing and support data.
For the contents of a case — the e-mail corpora you upload, which typically contain personal data about you and third parties — you (or your organization) are the controller and Soundcare AB acts as your data processor: we process that material only on your instructions, i.e. to provide the features you use. Our standard data processing agreement (GDPR Art. 28) is published at exhibitmail.com/dpa, with a signable copy to download; we countersign via support.
2. What we process, and why
| Data | Purpose | Legal basis |
|---|---|---|
| Account data: e-mail address, sign-in history, terms acceptance | Providing access, securing accounts | Contract (Art. 6(1)(b)) |
| Case metadata: case name, members and roles, case description you provide during setup | Operating your case workspace and its AI configuration | Contract |
| Case content: uploaded mailboxes and the messages in them | Storage, search, scoring, AI answers — on your instructions | Processed on your behalf (you are controller) |
| Audit log: who signed in, searched, opened or tagged what, within a case | Security and accountability inside the case (visible to the case owner) | Contract; legitimate interest in security |
| Billing data: purchases and credit usage (card details go to Stripe, never to us) | Charging for the service, accounting | Contract; legal obligation (bookkeeping) |
| Support questions and the e-mail address you give with them | Answering you | Legitimate interest |
We do not use your data for advertising, we do not sell it, and e-mail content is never used to train AI models — AI features run on the Anthropic API under commercial terms that prohibit training on customer data.
3. Subprocessors
We use a small number of service providers to run ExhibitMail:
| Provider | Role |
|---|---|
| Railway Corp. | Cloud hosting of the application and encrypted case storage |
| Anthropic, PBC | AI processing (relevance scoring, assistant answers) — no training on your data |
| Stripe, Inc. | Payment processing (we never see card details) |
| Twilio Inc. (SendGrid) | Transactional e-mail: sign-in codes and notifications |
Where processing takes place outside the EU/EEA, transfers rely on the EU–U.S. Data Privacy Framework and/or the EU Standard Contractual Clauses, as applicable to each provider.
4. Security
- Every case is encrypted at rest under its own AES-256 key, including uploaded mailbox files; keys are wrapped by a separately held master key.
- Each case lives in its own isolated database with its own private URL — no shared indexes across tenants.
- All traffic is encrypted in transit (TLS). Access is invitation-only with one-time e-mail codes; there are no passwords to leak.
- All activity within a case is audit-logged.
5. Retention and deletion
Case content is kept for as long as the case exists. Deleting a case destroys its encryption key, making the content permanently unreadable — including in backups (crypto-shredding). Account and billing records are kept as long as your account exists and thereafter only as long as Swedish bookkeeping law requires (currently seven years for transaction records).
6. Cookies
ExhibitMail uses only strictly necessary cookies: a signed session cookie per case so you stay signed in. There are no tracking, analytics or advertising cookies, and therefore no cookie banner.
7. Your rights
Under the GDPR you can request access to, rectification or erasure of your personal data, restriction of or objection to processing, and a portable copy of data you provided. For personal data inside a case corpus, direct your request to the case owner (the controller for that material); we assist them as processor. You can complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or your local supervisory authority.
8. Contact
Privacy and legal requests: Soundcare AB, Mailbox 1602, 411 42 Göteborg, Sweden — or use the support button ("?") on exhibitmail.com; every question reaches a human, and we reply by e-mail.