Terms of Service

Last updated 15 September 2026

These terms are an agreement between Gundhus AS, Hellvikskogsvei 93, 1459 Nesodden, Norway, organisation number 922 852 014 (“Gundhus AS”, “we”, “us”), and the organisation that uses Waymail (“you”). By creating a workspace, or by using the Waymail API or console, you accept them on that organisation's behalf and confirm that you have the authority to do so. The Acceptable Use Policy and the Privacy Policy are part of these terms.

Waymail is owned and operated by Gundhus AS and marketed as part of the Waybound product portfolio. Gundhus AS is your contracting party for the service.

Waymail is for businesses and other organisations. It is not offered to consumers.

1. The service

1.1 Waymail is an API and a console for sending email from domains you control, through Amazon SES, and for recording what happens to each message. It includes contacts, topics, broadcasts, automations, templates, suppressions and webhooks. It sends email; it does not receive it.

1.2 Waymail is in private alpha. We may add, change or remove features, and will give you reasonable notice before a change that materially reduces what the service does for you.

1.3 Each workspace belongs to one region, chosen when it is created and fixed afterwards. The EU region is operated in Frankfurt, Germany.

2. Your account and credentials

2.1 Keep the information in your account accurate.

2.2 You are responsible for everything done with your workspace's credentials — console accounts and API keys alike. Keep API keys secret and on your servers, never in code that runs in a browser or an app. Revoke a key as soon as you suspect it has leaked, and tell us at hello@waymail.app if you believe your workspace has been compromised.

2.3 A workspace's owners and admins control who belongs to it and what each member may do. You are responsible for the people you invite.

3. Sending responsibly

3.1 You are the sender of every email sent from your workspace, and responsible for its content, for who receives it, and for your right to send it.

3.2 You must follow the Acceptable Use Policy and the laws that apply to your email and your recipients — among them data protection law such as the GDPR; the rules on electronic marketing where your recipients are, such as the ePrivacy rules in the EU and EEA, CAN-SPAM in the United States and CASL in Canada; and consumer protection law.

3.3 You must have a lawful basis for processing your recipients' personal data and, for marketing email, the consent or other permission the law requires. That includes any consent needed for open and click tracking, which are off until you switch them on for a sending domain.

3.4 Send only from domains you own or are authorised to use, and keep the DNS records Waymail asks for in place.

3.5 Do not remove or obstruct the unsubscribe mechanisms Waymail adds to marketing email, and honour opt-outs that reach you any other way.

3.6 If you let your own customers send email through your workspace — as a platform does — you are responsible for their sending as if it were your own, and must hold them to terms at least as protective as these.

4. Protecting the shared infrastructure

4.1 Every workspace sends through infrastructure it shares with other customers, and mailbox providers and Amazon judge that infrastructure by how everyone on it behaves. We therefore monitor each workspace's bounce and complaint rates, and act automatically — with a warning, a daily sending limit, or a suspension of sending — at the thresholds set out in the Acceptable Use Policy.

4.2 Each workspace has sending limits — per second, per day, and for the size of a broadcast — within the ceilings of its plan. We may adjust them.

4.3 Waymail stops sending to addresses that have hard-bounced, complained or unsubscribed. Removing an address from your suppression list is your decision and your responsibility, and is recorded in your workspace's audit log.

5. Your data

5.1 The messages, recipients, contacts and everything else you put into Waymail (“Customer Data”) remain yours.

5.2 You permit us to process Customer Data only to provide, secure and support the service, as these terms and the Privacy Policy describe, and as the law requires.

5.3 Message bodies are kept for the period your workspace's retention setting chooses — 7 to 90 days, or not at all — and delivery history for your plan's period: 30 days, 90 days or 13 months, or as agreed on Business. Other Customer Data is kept until you delete it. The Privacy Policy lists every period.

5.4 You can retrieve Customer Data through the API at any time while your workspace is active. After your workspace is closed, we delete Customer Data within 30 days, except where the law requires us to keep it; backup copies age out within a further 35 days.

5.5 Section 12 applies to the personal data in Customer Data.

6. Fees

6.1 Plans and prices are published at waymail.app. Each plan includes a monthly allowance of emails and a number of domains. An email is one accepted recipient — to, cc and bcc each count — and a subdomain counts as a domain. Allowances run by calendar month, in UTC.

6.2 On the Free plan, sending stops at the allowance until the next month begins. Paid plans keep sending past it, and each email past the allowance is charged at the plan's overage price.

6.3 During the private alpha, we set your workspace's plan with you. Fees are payable to Gundhus AS. Fees for a paid plan are charged in advance — yearly or monthly, as agreed — and overage monthly in arrears. Prices are in US dollars and exclude VAT and other taxes, which are added where they apply.

6.4 We may change prices with at least 30 days' notice; a change applies from your next billing period. A change of plan takes effect when it is made, and moving to a plan with shorter delivery history shortens how long your existing history is kept.

6.5 If a payment is more than 30 days overdue, we may suspend sending after telling you, until it is paid.

7. Availability and support

7.1 We work to keep Waymail available and to send email promptly, but during the private alpha we make no service-level commitment. Delivery also depends on recipients' mail servers, which are outside our control: a message Waymail has accepted is queued, not yet delivered.

7.2 We aim to carry out maintenance without downtime, and give notice of planned downtime when we can.

7.3 Support is by email, at hello@waymail.app.

8. Suspension

8.1 We may suspend a workspace's sending, or its access to Waymail, without prior notice when that is needed to prevent harm to the service, to its standing with mailbox providers and Amazon, to other customers or to recipients; to respond to a serious or repeated breach of these terms or the Acceptable Use Policy; to respond to a security incident; or to comply with the law or an order from an authority. The protections in section 4 act automatically.

8.2 We will tell you why, unless the law or security prevents it, and lift the suspension once we are satisfied its cause has been dealt with.

9. Term and ending

9.1 These terms apply from when you first accept them until your workspace is closed.

9.2 You can stop using Waymail at any time, and ask us to close your workspace.

9.3 We can end these terms with 30 days' notice for any reason; immediately, if you commit a material breach and do not remedy it within 14 days of our notice; or immediately, for a serious breach of the Acceptable Use Policy such as sending phishing, malware or spam.

9.4 When these terms end, sending stops. Unless they ended because of a breach by you, you have 30 days to export Customer Data through the API before it is deleted under section 5.4.

9.5 Sections 5, 10, 11, 13, 14, 15 and 17 survive the end of these terms, and section 12 survives for as long as we hold any Customer Data.

10. Intellectual property

10.1 Waymail — its software, documentation and brand — belongs to Gundhus AS and its licensors. While these terms apply, you may use it for your organisation's own business. The Waymail SDK is published under its own licence, which governs it.

10.2 If you send us feedback, we may use it freely, with no obligation to you.

11. Confidentiality

Each of us will keep the other's non-public information confidential, use it only for the purposes of these terms, and share it only with people who need it for those purposes and are bound to keep it confidential. This does not cover information that is public through no fault of the recipient, that the recipient already knew lawfully, or that the law requires it to disclose — in which case it gives the other notice first, where the law allows.

12. Data processing

This section is the contract Article 28 of the GDPR requires for the personal data in Customer Data.

12.1 Roles. You are the controller of that personal data — or a processor acting for your own client, in which case we are your subprocessor. We are your processor.

12.2 Subject matter and duration. Providing the Waymail service, for as long as these terms apply and until Customer Data is deleted under section 5.4.

12.3 Nature and purpose. Storing, sending and tracking email; recording what happens to each message; managing contacts, topics and suppressions; and delivering webhooks — all as you direct through the API, the console and your settings.

12.4 Personal data and data subjects. Email addresses and names; message content and attachments, which may contain any personal data you choose to include; contact properties and topic subscriptions; delivery, open and click events, including user-agent strings; and suppression entries. The data subjects are your recipients and contacts, and anyone named in the messages you send. Do not send special categories of personal data (GDPR Article 9) through Waymail unless you have a lawful basis, and appropriate safeguards, for sending them by email.

12.5 Our obligations. We will:

1. process the personal data only on your documented instructions — these terms, your use of the API and console, and your settings — unless EU or EEA law requires otherwise, in which case we will tell you before processing unless that law forbids it; and tell you if we believe an instruction infringes data protection law;
2. ensure that everyone authorised to process it is bound by confidentiality;
3. protect it with the technical and organisational measures Article 32 requires, including those described on the Security page and under Security in the Privacy Policy;
4. engage subprocessors only as section 12.6 allows;
5. help you respond to requests from data subjects — mostly through the API, which lets you find, export, correct and delete contacts and messages — and help you meet your obligations under Articles 32 to 36, taking into account the nature of the processing and the information available to us;
6. notify you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting Customer Data, with the information you need to meet your own obligations;
7. delete Customer Data when the service ends, as section 5.4 describes; and
8. make available the information needed to demonstrate compliance with Article 28, and allow for and contribute to audits — by answering reasonable written questions and providing documentation and, where that is not enough or a supervisory authority requires it, by an audit on 30 days' notice, at your cost and no more than once a year.

12.6 Subprocessors. You authorise the subprocessors listed in the Privacy Policy. We will tell you at least 30 days before adding or replacing one. You may object on reasonable data protection grounds, and if we cannot resolve the objection, you may end these terms without penalty before the change takes effect. Each subprocessor is bound by data protection obligations equivalent to these, and we remain responsible to you for its performance.

12.7 Transfers. Customer Data of an EU workspace is stored and processed in the EU. Where personal data is transferred outside the EEA, the transfer is covered by an adequacy decision or by the Standard Contractual Clauses adopted by the European Commission.

13. Warranties and disclaimers

13.1 Each of us confirms that it has the authority to enter into these terms.

13.2 You confirm that you have the rights, permissions and lawful basis to send the email you send through Waymail, and to have us process Customer Data for you.

13.3 Apart from what these terms say expressly, Waymail is provided “as is” and “as available”. To the extent the law allows, we make no other promises — including that every message will be delivered, that it will reach the inbox rather than a spam folder, or that the service will be uninterrupted or free of errors.

14. Liability

14.1 Neither of us is liable for indirect or consequential loss, or for lost profit, revenue or goodwill.

14.2 Each party's total liability under these terms in any 12-month period is limited to the greater of the fees you paid for Waymail in the 12 months before the event that gave rise to the claim, and EUR 1,000.

14.3 These limits do not apply to liability that cannot be limited by law, to loss caused by gross negligence or wilful misconduct, or to your obligations under sections 3 and 15.

15. Indemnity

You will compensate Gundhus AS for losses, fines and reasonable costs arising from third-party claims or regulatory action brought about by email you send through Waymail, by your Customer Data, or by your breach of these terms, the Acceptable Use Policy or the law — including claims by recipients, mailbox providers and authorities. We will tell you promptly about any such claim and let you take part in its defence.

16. Changes to these terms

We may update these terms. We will tell workspace owners by email at least 30 days before a change that materially affects your rights takes effect; if you do not accept it, you can close your workspace before then. Changes needed to comply with the law, or to deal with abuse or a security problem, may take effect sooner. The version in force is always the one at waymail.app/legal/terms.

17. General

17.1 These terms are governed by the laws of Norway, without regard to its conflict-of-laws rules. The courts of Norway, with Oslo tingrett as the court of first instance, have exclusive jurisdiction.

17.2 You may not transfer these terms without our written consent. We may transfer them to an affiliate, or to a successor to the business, by telling you.

17.3 Neither of us is responsible for a failure to perform caused by events beyond its reasonable control.

17.4 These terms, with the Acceptable Use Policy and the Privacy Policy, are the whole agreement between us about Waymail, and replace any earlier one. If part of them is unenforceable, the rest remains in force. Not enforcing a right is not a waiver of it.

17.5 Notices to us go to hello@waymail.app; notices to you go to the email addresses of your workspace's owners.

17.6 If these terms are translated, the English version prevails.