← pombus.com

Terms of Service

Effective date: September 25, 2026 Last updated: September 25, 2026

These Terms of Service (the "Terms") are a binding agreement between Willian Clayton de Almeida, an individual (natural person) domiciled in the Federative Republic of Brazil, enrolled with the Brazilian Individual Taxpayer Registry (Cadastro de Pessoas Físicas, CPF) under No. 277.866.058-51, with correspondence address provided upon request to dpo@pombus.com, who operates the Service under the trade name "Pombus" ("Pombus", "we", "us"), and the person or entity that accepts them (the "Customer", "you"). Pombus is not a company: the contracting party is the individual named above. These Terms govern access to and use of the Pombus service operated at pombus.com (the "Service").

These Terms apply both to Customers that use the Service in the course of a business ("Business Customers") and to Customers that use it as consumers ("Consumers"), as defined in Section 2. Section 4A contains the provisions that apply specifically to Consumers and prevails over any conflicting provision of these Terms where you are a Consumer.

In plain terms. Pombus gives you, your applications, and your AI agents real mailboxes, either on our shared domain pombus.com or on a domain you own. You can try it free for 14 days (never more than 30). To start the trial you add a payment method and, in a separate step, expressly agree to the paid plan, seeing its price and the exact date of the first charge. When the trial ends, the plan starts and your payment method is charged, unless you cancel before that. We remind you by email the day before the charge (and, for trials longer than a week, a week before as well), and you can cancel online in one click at any time up to the moment of the charge: cancel before it and you pay nothing. You own your content and are responsible for what you and your agents send. This is not a bulk-mail tool. The product is in early access, so there is no formal SLA yet. If you break the Acceptable Use Policy we can throttle, suspend, or stop your sending, using the least disruptive measure that fits the situation. Mailboxes on pombus.com use a name we lend you, not one you own. If you are a consumer, the Brazilian Consumer Defense Code protects you: you can withdraw within 7 days of your first payment for a full refund, you can sue in your home court, and our liability limits do not apply to you (Section 4A). Pombus is operated by an individual developer, Willian Clayton de Almeida, not by a company. This box is a summary for convenience; the numbered sections below govern.

1. Acceptance and Contract Structure

1.1. Acceptance. You accept these Terms by the first of the following to occur: (a) checking the acceptance box or clicking the acceptance button when creating an account; (b) signing an Order Form that references these Terms; or (c) creating an API Key or sending or receiving mail through the Service. If you do not agree, do not use the Service.

1.2. Authority and capacity. If you accept these Terms on behalf of a legal entity, you represent that you are authorized to bind that entity; anyone without that authority must not accept these Terms. If you accept these Terms as an individual, you represent that you are at least 18 years old and legally capable of contracting.

1.3. The Agreement. The following documents form a single agreement between you and Pombus (the "Agreement"):

The DPA applies only to Business Customers (Section 2.5 of the DPA). The Privacy Policy at privacy.html explains how Pombus processes personal data as controller, including the mailbox content of Consumers (Section 1.3 of the Privacy Policy). It is provided for transparency and is not part of the Agreement except where the Agreement expressly refers to it.

1.4. Order of precedence. If documents conflict, they prevail in this order: (i) the DPA, solely regarding the processing of Customer Personal Data; (ii) an Order Form, solely regarding the commercial terms it specifies (price, plan, term, quantities); (iii) the AUP, regarding permitted and prohibited use of the Service; (iv) these Terms, in all other respects.

1.5. Electronic acceptance and records. The parties agree that acceptance by electronic means is valid and binding, pursuant to Article 107 of the Brazilian Civil Code and Article 10, §2, of Provisional Measure No. 2,200-2/2001. Pombus keeps a record of the version accepted, the date and time of acceptance, and the account that accepted it.

2. Definitions

Capitalized terms used in the AUP and the DPA have the meanings given below.

3. The Service and Early Access

3.1. What the Service is. Pombus is a mailbox provider for people and for the applications and AI Agents that work for them, in the same Mailbox. The Customer operates Mailboxes either as Pombus Addresses on the shared domain pombus.com or on its own Verified Domains, and uses them through the web application, the API, and webhooks to receive messages, reply within existing conversations, and compose individual messages to individual recipients. Mail is sent, and may be received, through Amazon Simple Email Service (Amazon SES) in the us-east-1 region (United States); inbound mail may also be received at the edge through Cloudflare Email Routing. Message content and attachments are stored, encrypted at rest, on a server operated by Pombus at Hostinger in Brazil, as described in Sections 5, 6, and 9 of the Privacy Policy and, for Business Customers, Annexes A to C of the DPA.

3.2. What the Service is not. Pombus is not a bulk-email, mass-marketing, newsletter, or campaign-delivery platform. Sections 1.2 and 1.3 of the AUP apply.

3.3. Early access. You acknowledge that the Service is under active development and is offered on an early-access basis until Pombus announces general availability (the "Early Access Period"). During the Early Access Period:

3.4. Changes to the Service. Pombus may modify the Service. If a change materially reduces the core functionality of a paid plan, Pombus will give at least 30 days' notice where practicable. If you object, you may terminate before the change takes effect and receive a pro-rata refund of prepaid, unused Fees under Section 5.7.

3.5. Preview features. Features labeled "beta", "preview", "experimental", or similar are provided as-is, may be changed or withdrawn at any time, and are excluded from any commitment Pombus makes about the Service.

3.6. Third-party infrastructure. The Service runs on third-party infrastructure, including Amazon Web Services, Cloudflare, and the hosting provider of the server on which message content is stored, Hostinger (all listed in Annex C of the DPA and in the public sub-processor list at subprocessors.html). The Service's availability depends partly on those providers. Pombus is not responsible for their acts or failures beyond its reasonable control. This does not affect Pombus's obligations regarding sub-operators under the DPA or, for Consumers, Pombus's liability under the CDC.

4. Eligibility and Accounts

4.1. Who may use the Service. The Service is offered to Business Customers and to Consumers. When you create an Account, you indicate whether you are acquiring the Service for business use or for personal use. You must answer truthfully, because the answer determines which provisions of these Terms apply to you; a Customer that declares business use but in fact acquires the Service as a final recipient remains protected by the CDC to the extent the law so provides (Section 4.2).

4.2. Non-waivable rights. Nothing in these Terms excludes or limits any right that cannot be waived under applicable law. If a court characterizes a Customer as a consumer, Section 4A applies to that Customer regardless of the use declared at registration.

4.3. Not directed to minors. The Service is not directed to children or adolescents. Customers who are natural persons and all Authorized Users must be at least 18 years old and legally capable of contracting. You must not use the Service or your Agents to direct communications specifically at children or adolescents unless you have complied with Article 14 of the LGPD and all other applicable child-protection laws, and Pombus has agreed to that use in writing.

4.4. Registration information. You must provide accurate, complete, and current information and keep it up to date: for a Business Customer, its legal name, CNPJ or foreign tax identifier, and billing address; for a Customer who is a natural person, full name, CPF or foreign tax or identity number, a valid email address, and billing address. Pombus may perform reasonable verification checks, including of domain ownership and identity, and may refuse or cancel a registration that fails those checks or presents an abuse risk, or that is used to obtain more than one Trial (Section 5.9.1).

4.5. Account security. You are responsible for your Authorized Users, for keeping Account credentials confidential, and for all activity in your Account. You must notify Pombus without undue delay at abuse@pombus.com if you suspect unauthorized access to your Account.

4.6. Sanctions and export controls. You represent that neither you nor your Authorized Users are subject to sanctions administered by the United Nations, Brazil, the United States, the European Union, or the United Kingdom, and that you will not use the Service in violation of applicable export-control or sanctions laws.

4A. Provisions for Consumers

4A.1. Application and precedence. This Section applies if you are a Consumer. Where it conflicts with any other provision of the Agreement, this Section prevails. Where a provision of the Agreement is described as applying "to the maximum extent permitted by applicable law", the CDC is the applicable law that sets that limit for you.

4A.2. Right of withdrawal (Article 49 of the CDC). Because you contract the Service online, outside a commercial establishment, you may withdraw from the paid subscription, for any reason, within 7 (seven) days after the date of the first charge for a paid plan (and, if you later contract a different paid plan at a higher price, within 7 days after the first charge for that plan). Pombus will refund in full every amount paid for that plan, monetarily updated, to the same payment method, and will send you immediate confirmation of the withdrawal (Article 5 of Decree No. 7,962/2013). You may exercise this right in the console at Account > Settings or by writing to hello@pombus.com. Use of the Service during the 7 days does not reduce the refund. Automatic renewals of the same plan are not new contracts and do not restart this period, but you may cancel at any time under Section 4A.4.

4A.3. Trial and first charge. Section 5.9 applies to you in full. In particular: your Account converts to the paid plan at the end of the Trial only because you expressly agreed to that conversion, in a separate step, when you started the Trial, after being shown the price and the exact date and amount of the first charge (Section 5.9.2); Pombus will remind you by email before the first charge (Section 5.9.3); you may cancel online, in one click, at any time up to the moment of the first charge, and if you do so nothing is charged (Section 5.9.4); and Pombus will never treat a pre-selected option, your silence, or your continued use of the Service as consent. The information shown to you when you started the Trial binds Pombus under Article 30 of the CDC (Section 1.3(e)).

4A.4. Cancellation. You may cancel at any time, without penalty and without having to give a reason, using the same channel and with the same ease as you subscribed, in the console at Account > Settings or by writing to hello@pombus.com. Pombus will not condition cancellation on retention offers, phone calls, or additional steps, and will confirm the cancellation by email immediately. Cancellation takes effect at the end of the current Billing Period, and you keep access until then. If you are on an annual plan and cancel early, Pombus will refund the prepaid Fees for the unused full months of the plan, pro rata.

4A.5. Warranties. The statutory warranty of adequacy of the Service (Articles 20 and 24 of the CDC) applies to you and is not excluded or reduced by Section 14. Pombus informs you, as part of its offer, that the Service is in early access (Section 3.3) and that email delivery depends on third parties (Section 11.3); this information describes the Service you are contracting and does not waive your rights regarding defects in it.

4A.6. Liability. Sections 15.1, 15.2, 15.4, and 15.6 do not apply to you if you are a natural person: Pombus is liable for the damage it causes you in accordance with Articles 6, VI, 14, and 20 of the CDC, and Section 15.3 applies only to the extent it benefits you. If you are a legal entity that qualifies as a Consumer, Sections 15.1 and 15.2 apply only in justifiable situations, as permitted by Article 51, I, of the CDC, and Pombus bears the burden of showing the justification.

4A.7. Indemnification. Section 16.1 applies to you only to the extent that you are liable, under Articles 186 and 927 of the Brazilian Civil Code and the CDC, for the losses concerned; it does not extend your liability beyond what the law provides. Pombus is reciprocally liable to you for losses caused by its own breach or unlawful act, and nothing in the Agreement imposes on you a collection cost or charge that Pombus could not recover from you under law (Article 51, XII, of the CDC).

4A.8. Forum. You may bring any proceeding against Pombus in the courts of your own domicile (Article 101, I, of the CDC), and Pombus will bring any proceeding against you only in the courts of your domicile. The choice of forum in Section 17.3 does not apply to you. Nothing in the Agreement requires you to submit to arbitration (Article 51, VII, of the CDC).

4A.9. Interpretation and form. These Terms are a contract of adhesion. They are interpreted in the manner most favorable to you (Article 47 of the CDC), and provisions that limit your rights are highlighted in bold so that they are immediately and easily understood (Article 54, §4, of the CDC). Any change to these Terms is subject to Section 18, and Pombus will not change the price, the plan, or the Billing Period of a subscription in force without notice and without your right to cancel before the change takes effect (Article 51, X and XIII, of the CDC).

4A.10. Language. Pombus intends to make a Portuguese version available; where it does, the Portuguese version prevails for Consumers domiciled in Brazil.

4A.11. Consumers outside Brazil. If you are a consumer domiciled outside Brazil, you also keep the rights that the mandatory consumer-protection law of your country of residence gives you and that cannot be waived by contract, including, for residents of the European Union and the United Kingdom, a 14-day right of withdrawal under Directive 2011/83/EU and the Consumer Contracts Regulations 2013, and any rules on subscription reminders and cancellation. Where those rights are broader than this Section, they apply.

4A.12. Your mailbox content. If you use a Mailbox for personal purposes, the DPA does not apply to you, because the LGPD does not treat you as a controller (Article 4, I, of the LGPD). Pombus processes the content of your Mailbox solely to provide, secure, and support the Service on your instructions, as described in Section 1.3 of the Privacy Policy, under the confidentiality of communications protected by Article 5, XII, of the Federal Constitution and Article 7 of the Marco Civil da Internet. Sections 8.1 to 8.3 and 8.7 apply to you.

4A.13. Support and complaints. Support is available at hello@pombus.com. You may also register a complaint with the consumer-protection body (Procon) of your state and, where Pombus is registered there, at consumidor.gov.br.

5. Fees, Billing, Renewal, Taxes, and Refunds

5.1. Fees. After the Trial (Section 5.9), you will pay the Fees for your plan as stated on the pricing page at https://pombus.com or in your Order Form: the price, currency and any usage charges shown on the checkout page at the time of purchase. Plans may include usage allowances (for example, number of Mailboxes or messages). Usage above the allowance is charged at the usage charges shown on the checkout page at the time of purchase, if applicable, and the allowance and the overage price are shown to you before you subscribe.

5.2. Billing, payment method, and who sells to you. Fees are charged in advance for each Billing Period, in the currency shown on the checkout page at the time of purchase, by card, Pix, or the other payment methods offered at checkout, through the Payment Processor. You authorize Pombus, through the Payment Processor, to charge the payment method on file on a recurring basis, starting with the first charge at the end of the Trial under Section 5.9.2. Pombus, that is, the individual named in the preamble, is the supplier of the Service and the person that sells it to you and issues the receipt for the Fees. The Payment Processor only collects the payment on Pombus's behalf, is not the seller, does not resell the Service, and does not issue receipts for the Fees; its own terms may apply to the payment transaction itself (for example, to the card authorization and to the protection of your payment data).

5.3. Automatic renewal and cancellation. Once you have subscribed to a paid plan under Section 5.9, your subscription renews automatically for successive Billing Periods of the same length unless you cancel before the end of the current Billing Period. Automatic renewal is disclosed to you before you subscribe, and you expressly accept it when you subscribe. For annual plans, Pombus will send a renewal reminder at least 15 days before renewal. You may cancel at any time, without penalty, in the console at Account > Settings or by writing to hello@pombus.com, with the same ease as you subscribed, and Pombus will confirm the cancellation by email. Cancellation takes effect at the end of the current Billing Period, and you keep access until then. Section 4A.4 applies to Consumers.

5.4. Failed or late payment. If a charge fails, Pombus will notify you and may retry the charge. Amounts not paid within 10 days after that notice are overdue and bear a late fee of 2% plus interest as permitted by applicable law (Article 406 of the Brazilian Civil Code). Suspension for non-payment is governed by Section 12.3.

5.5. Price changes. Pombus may change Fees by giving at least 30 days' notice before the start of the next Billing Period. New Fees apply from the next renewal. If you do not accept them, you may cancel before renewal under Section 5.3. Pricing during the Early Access Period may differ from pricing at general availability, and any change is subject to this Section.

5.6. Taxes, withholding, and receipts.

5.6.1. Taxes borne by each party. Fees do not include the taxes that the law places on you as purchaser unless expressly stated. Pombus bears the taxes that the law places on it as licensor, including the municipal tax on services (ISS) applicable to software licensing (item 1.05 of the list annexed to Complementary Law No. 116/2003) and, where applicable, the CBS and IBS introduced by Brazil's consumption-tax reform, in the regime applicable to an individual. You bear any tax, duty, or levy that the law places on the purchaser, including IOF and any tax due in your own country on the purchase of a software licence from abroad.

5.6.2. Business Customers established in Brazil. The Fees are consideration for a software licence and for the hosted infrastructure through which the licensed software runs, as stated in Section 5.10; they are not remuneration for personal services, and Pombus does not perform work under your direction. Accordingly, as between the parties, no amount is due from you as employer social-security contribution, and no social-security contribution is to be deducted from the Fees, because those contributions apply to remuneration for services rendered by an individual contributor (Articles 22, III, of Law No. 8,212/1991 and 4 of Law No. 10,666/2003) and amounts received for copyright rights are excluded from the contribution base (Article 214, §9, XXI, of Decree No. 3,048/1999). Income tax withholding at source, where the law requires it on payments by a legal entity to an individual (Article 7, II, of Law No. 7,713/1988; Articles 685 and 688 of Decree No. 9,580/2018), is calculated by you on the progressive monthly table, with the reduction introduced by Law No. 15,270/2025, on the Fees you pay in the month; where the result is zero, nothing is withheld. You are responsible for determining your own withholding obligations. If you withhold any Brazilian tax or contribution from the Fees, you must remit it in Pombus's name and CPF and send the withholding statement (comprovante de retenção) to hello@pombus.com within 30 days of the payment; the amount withheld and evidenced in that way is treated as paid to Pombus, and Pombus does not require you to gross up domestic withholdings. Pombus will provide, on request, proof of its municipal taxpayer registration (inscrição municipal) and any declaration your accounting requires about the nature of the Fees.

5.6.3. Customers outside Brazil. If the law of your country requires you to withhold tax on the Fees (for example, withholding on royalties paid to a non-resident), you will withhold and remit it, send Pombus the official withholding certificate within 30 days; the amount withheld and evidenced in that way is treated as paid to Pombus. Where a tax treaty between Brazil and your country reduces the withholding, the parties will cooperate to apply it.

5.6.4. Receipts. Pombus issues, for each charge, a receipt bearing Pombus's name, CPF, correspondence address, the plan, the Billing Period, and the amount, stating that the amount is a licence fee under Section 5.10 and, where applicable, a municipal service invoice (nota fiscal de serviço avulsa). Pombus is an individual and does not issue invoices as a legal entity (nota fiscal de serviço eletrônica under a CNPJ) until the assignment described in Section 19.2 takes place. Receipts are available in the console at Account > Settings and are sent to the billing email address on the Account.

5.7. Refunds. Fees are non-refundable, and partial Billing Periods are not refunded, except in the following cases, in which Pombus will refund, pro rata, prepaid Fees for the unused part of the Billing Period:

No refund is due for suspension or termination caused by your breach, as stated in Section 7.3 of the AUP. Where applicable law grants you a statutory right of withdrawal (including Article 49 of the CDC), nothing in this Section limits it.

5.8. Invoice disputes. You must raise any good-faith dispute about an invoice within 30 days of the charge, by writing to hello@pombus.com, and must pay any undisputed amount. Initiating a chargeback without first raising the dispute with Pombus may lead to suspension under Section 12.3. This Section does not limit a Consumer's right of withdrawal under Section 4A.2 or a Consumer's right to dispute a charge with the payment provider.

5.9. Free Trial and conversion to a paid plan.

5.9.1. Trial. New Customers receive a free Trial of 14 days (the Trial never lasts more than 30 days), starting when the Account is created. To start the Trial you select a paid plan, add a valid payment method, and give the express consent described in Section 5.9.2. No amount is charged when the payment method is added; the Payment Processor may run a zero-amount or small temporary authorization to validate it, which is not a charge and is released automatically. Pombus may limit the features, number of Mailboxes, and sending volume available during the Trial, as shown in the console. Each person, CPF, CNPJ, or Customer Domain is entitled to one Trial, and Pombus may refuse, shorten, or end a Trial that it reasonably believes is being used to evade this limit or the AUP.

5.9.2. Conversion to the paid plan at the end of the Trial; express consent. At the end of the Trial, your Account converts automatically to the paid plan you selected, and the first charge is made on the day the Trial ends, unless you cancel before that moment under Section 5.9.4. This conversion happens only because you expressly agreed to it when you started the Trial. Express consent means that, at sign-up, in a step separate from the creation of the Account and from the acceptance of these Terms, you (a) were shown the plan, its price, the Billing Period, the automatic renewal, the exact date and amount of the first charge, and how to cancel before it; and (b) confirmed the subscription by a separate, affirmative action, such as ticking a box that was not pre-ticked or pressing a button whose label makes clear that it starts a subscription that will be charged on the date shown. Silence, continued use of the Service, or a pre-selected option is not consent, and Pombus will not charge you at the end of the Trial without that consent. Pombus keeps a record of the consent (the information shown, the version, the date, the time, and the Account), as in Section 1.5, and will provide it to you on request.

5.9.3. Reminders before the first charge. Pombus will send you, at least 1 (one) day before the first charge, that is, no later than the day before the Trial ends, an email stating the plan, the date and amount of the charge, and a direct link to cancel before it. This one-day reminder is Pombus's contractual minimum. As a matter of practice, and to comply with the card-network rules that apply to trials, for Trials longer than 7 (seven) days Pombus also sends a first reminder at least 7 (seven) days before the first charge, with the same content. If the one-day reminder is not sent, the first charge is postponed until the day after it is sent, and the Trial continues free of charge until then; the earlier reminder does not by itself postpone the charge. Reminders are sent to the email address of the Account owner, and you are responsible for keeping it current.

5.9.4. Cancellation before the first charge. You may cancel the Trial, and with it the subscription, at any time up to the moment of the first charge, online, in the console at Account > Settings, in a single step (one click, followed by an immediate confirmation by email), or by writing to hello@pombus.com. If you cancel before the first charge, nothing is charged and no amount is owed. Pombus will not condition cancellation on retention offers, calls, waiting periods, or additional steps, and the cancellation link in the reminders under Section 5.9.3 leads directly to that single step. After the first charge, Section 5.3 (and, for Consumers, Sections 4A.2 and 4A.4) applies.

5.9.5. End of the Trial without conversion. If you cancel before the first charge, or if the first charge cannot be completed within 10 days after the Trial ends, despite the retries under Section 5.4, the Account moves to read-only access with sending disabled. Customer Content remains available for export for 30 days, after which Section 13.5 applies as if the Account had been terminated. Pombus will tell you this before the Trial ends and in the confirmation of cancellation.

5.9.6. Terms apply during the Trial. The Trial is part of the Service, and the Agreement, including the AUP, applies to it. Pombus may end the Trial early under Section 12 or Section 13.3; if it does so for a reason other than your breach, no charge is made.

5.10. Nature of the Fees and of the relationship. The Fees are the consideration for (a) the licence to access and use the Service granted in Section 9.2, which is a licence of a computer program within the meaning of Article 9 of Law No. 9,609/1998, the program being protected as a literary work under Article 2 of that Law and Article 7, XII, of Law No. 9,610/1998, and (b) the hosted infrastructure, storage, and mail transport through which the licensed software operates, which Pombus provides as an integral part of the licensed software and not as a separate service. The Fees do not remunerate personal services. Pombus does not undertake, in exchange for the Fees, any consulting, custom development, integration, configuration, training, or other work performed by an individual for you, does not work under your direction, hours, or supervision, and provides support under Section 11.4 as an incidental feature of the licence, without separate charge. Any personal service that you and Pombus may agree on in the future will be described and priced separately in an Order Form and will be subject to its own tax treatment. Section 19.4 applies. Nothing in this Section limits the warranties and the liability that the Agreement or the law gives you regarding the Service, including under Section 4A.

6. Acceptable Use

6.1. AUP. You must comply, and ensure that your Authorized Users and Agents comply, with the AUP, which is incorporated into these Terms by reference. A breach of the AUP is a breach of these Terms.

6.2. Key obligations. Without limiting the AUP, you must: (a) send only from Pombus Addresses or Verified Domains and, for Verified Domains, keep DKIM, SPF, and DMARC in place (AUP Section 4); (b) have a lawful basis for contacting every recipient (AUP Section 3); (c) not send unsolicited or bulk mail (AUP Sections 1.2 and 2.1); (d) respect the Suppression List and all sending limits (AUP Section 5), and not evade those limits by spreading sending across multiple Accounts, Mailboxes, or domains, as further set out in the AUP; (e) not use the Service to send content designed to manipulate, hijack, or extract data from AI agents operated by third parties (for example, prompt injection), as further set out in the AUP; and (f) comply with the anti-spam, privacy, consumer-protection, and AI laws that apply to your messages and to the jurisdictions of your recipients.

6.3. Pombus's protective controls. Pombus automatically suppresses recipients that generate hard bounces or complaints. Pombus also applies, or may apply: (a) sending limits per Account, according to your plan; (b) a maximum number of recipients per message of up to 10 for messages sent through an API Key and up to 100 for messages sent through the web application; (c) automated pausing of a Mailbox or Account when its bounce rate reaches 3% or its complaint rate reaches 0.08%; and (d) an operator kill-switch that halts sending immediately (AUP Sections 5 and 7). These controls protect the Service. They do not shift to Pombus your responsibility for the lawfulness of your mail, and they do not certify that any particular use is lawful.

6.4. No general monitoring. Pombus has no general obligation to monitor Customer Content. Pombus may review metadata and audit logs and, where reasonably necessary to investigate a specific abuse report, security incident, or legal request, the relevant Customer Content, as set out in Section 5.3 of the DPA.

7. API Keys and Your AI Agents

7.1. Scopes. API Keys are issued with least-privilege scopes. You must choose the narrowest scope each application or Agent needs (AUP Section 6.1).

7.2. Key security. You are responsible for the security and confidentiality of your API Keys. Any activity performed with an API Key is attributed to you. You must rotate or revoke compromised keys immediately and notify Pombus at abuse@pombus.com without undue delay (AUP Section 6.2).

7.3. Responsibility for Agents. You are solely responsible for the design, configuration, prompts, models, tools, level of autonomy, and outputs of your Agents, and for every message they read, reply to, or send. An Agent acting under your API Key acts as you (AUP Section 3.3). Pombus does not provide, train, host, or control your AI models, and does not review Agent output before it is sent.

7.4. Safeguards. You must implement safeguards proportionate to the risk of your use case, which may include restricting Agent scopes, requiring human review for sensitive communications, applying your own rate limits, and logging Agent activity. Inbound email is untrusted input and may contain instructions designed to manipulate your Agents ("prompt injection"). You are responsible for protecting your Agents against such content, and Pombus is not liable for actions your Agents take in response to it.

7.5. AI transparency and automated decisions. You are responsible for complying with laws on AI-generated or automated communications, including any duty to disclose that a message was generated or sent by an automated system (for example, Article 50 of the EU AI Act, where applicable, and consumer-protection transparency rules). You must not use Agents to impersonate a specific natural person or to misrepresent the automated nature of a communication where doing so would be deceptive. If your Agents make decisions based solely on automated processing that affect individuals, you are responsible for the rights those individuals have under Article 20 of the LGPD and Article 22 of the GDPR, where applicable.

8. Customer Content and Data

8.1. Your content. As between the parties, you retain all rights in Customer Content, including Agent output. Pombus claims no ownership of Customer Content.

8.2. License to Pombus. You grant Pombus a worldwide, non-exclusive, royalty-free license, for the duration of the Agreement and any post-termination period under Section 13.5, to host, store, transmit, copy, process, and display Customer Content to you, solely as needed to provide, secure, and support the Service, to comply with law, and to enforce the Agreement, in accordance with the DPA. Pombus may sublicense these rights only to its sub-operators, and only for those purposes.

8.3. No sale and no model training. Pombus does not sell Customer Content and does not use Customer Content to train or fine-tune artificial intelligence or machine learning models.

8.4. Your warranties. You represent and warrant that you have all rights, licenses, and lawful bases needed for Pombus to process Customer Content under the Agreement, and that Customer Content does not infringe third-party rights or violate applicable law.

8.5. Data protection. If you are a Business Customer, you are the controller of Customer Personal Data, Pombus acts as operator (processor), and the DPA governs; where the law requires it, you must tell your own data subjects that you use Pombus as an email service provider. If you are a Consumer using a Mailbox for personal purposes, the DPA does not apply, and Section 1.3 of the Privacy Policy describes how Pombus processes the content of your Mailbox (Section 4A.12). For Pombus Operational Data, Pombus is the controller, and the Privacy Policy describes that processing.

8.6. Operational and aggregated data. Pombus may process Pombus Operational Data, including audit logs and Suppression List entries that may contain recipient addresses, as an independent controller for security, abuse prevention, deliverability, billing, legal compliance, and the establishment or defense of legal claims, as described in Sections 1.2 and 3.1 of the Privacy Policy and Section 15 of the DPA. Pombus may also create aggregated, anonymized statistics (for example, send volumes and bounce rates) that do not identify you or any individual, within the meaning of Article 12 of the LGPD, and may use them to operate and improve the Service.

8.7. Your copies. The Service is not a backup or archiving service unless Pombus expressly agrees otherwise. You are responsible for keeping copies of any Customer Content you need. You may export Customer Content through the API or console during the term and during the period set out in Section 13.5.

8.8. Legal requests. Pombus may disclose Customer Content or Pombus Operational Data when legally required, for example under a court order, including the orders required by Articles 10 and 22 of the Brazilian Civil Rights Framework for the Internet (Law No. 12,965/2014 — "Marco Civil da Internet"). Pombus will handle such requests as set out in Section 14 of the DPA.

9. Intellectual Property

9.1. Pombus property. The Service, its software, APIs, Documentation, interfaces, designs, and brand, and all related intellectual property rights, belong to Pombus or its licensors and are protected by, among other laws, Law No. 9,609/1998 (Software), Law No. 9,610/1998 (Copyright), and Law No. 9,279/1996 (Industrial Property).

9.2. Licence to use. Subject to the Agreement and payment of Fees, Pombus grants you a limited, non-exclusive, non-transferable, non-sublicensable licence, during the term, to access and use the Service and Documentation for your business purposes (or, if you are a Consumer, for your personal purposes), including to operate your applications and Agents. This licence is the licence of use of a computer program referred to in Article 9 of Law No. 9,609/1998, granted by Pombus as the author and holder of the rights in the software that constitutes the Service, and the Fees are its consideration (Section 5.10). Client libraries or SDKs that Pombus distributes under an open-source license are governed by that license.

9.3. Restrictions. You must not, and must not allow anyone else to:

9.4. Feedback. If you give Pombus suggestions or feedback about the Service, Pombus may use them freely, without obligation to you. Feedback does not include your Confidential Information or Customer Content.

9.5. Names and marks. Neither party may use the other's name, logo, or trademarks without prior written consent. Pombus may identify you as a customer only with your consent.

9.6. Reservation of rights. All rights not expressly granted in the Agreement are reserved.

9.7. Pombus Addresses: a license, not an assignment. The pombus.com domain, and every name on it, belong to Pombus. When Pombus provisions a Pombus Address to your Account, it grants you a limited, revocable, non-exclusive, non-transferable, non-sublicensable license to use that name on pombus.com during the term of the Agreement, for the purposes and subject to the restrictions in Sections 4.5 and 5.5 of the AUP. The name is not assigned or sold to you, does not become your property or part of your assets, cannot be transferred, sold, or licensed separately from the Account, and no trademark, trade name, domain-name, or other exclusive right in the name arises from its assignment or use. Pombus may rename, migrate, or reclaim a Pombus Address under Section 12.1 and Sections 4.5 and 5.5 of the AUP, and the name reverts to Pombus on termination or closure under Section 13.7. Pombus does not guarantee that any particular name is or will remain available.

Reclaim for inactivity. Pombus may reclaim a Pombus Address for inactivity only if both of the following apply: (a) the Account has no active paid subscription (for example, a free Account or an Account whose subscription has ended); and (b) the Pombus Address has been inactive for 180 consecutive days, meaning that during that period there was no sign-in to the Mailbox through the web application, no API request made with an API Key bound to it, and no message sent from it. Pombus will notify the Account owner by email at least 30 days and again at least 7 days before the reclaim date, and any activity in the Mailbox before that date cancels the reclaim. A Pombus Address on an Account with an active paid subscription is never reclaimed for inactivity. On reclaim, Section 13.7 applies. This paragraph prevails over any conflicting provision of the AUP on reclaim for inactivity.

10. Confidentiality

10.1. Definition. "Confidential Information" means non-public information that one party discloses to the other in connection with the Agreement and that is marked as confidential or would reasonably be understood to be confidential, including Pombus's non-public technical and security information and the non-public terms of any Order Form. Customer Content is governed by Section 8 and the DPA.

10.2. Obligations. The receiving party will use Confidential Information only to perform or exercise rights under the Agreement, will protect it with at least reasonable care, and will disclose it only to personnel, advisers, and sub-operators who need to know it and are bound by confidentiality obligations at least as protective as this Section.

10.3. Exceptions. These obligations do not apply to information that is or becomes public through no fault of the receiving party, was lawfully known to it before disclosure, is lawfully received from a third party without restriction, or is independently developed. If the law or a court or authority compels disclosure, the receiving party will give prior notice where legally permitted and disclose only what is required.

10.4. Duration. These obligations last during the Agreement and for 5 years after it ends, and, for trade secrets, for as long as they remain trade secrets.

11. Availability, Support, and No SLA

11.1. No SLA during early access. Pombus uses commercially reasonable efforts to keep the Service available. During the Early Access Period, Pombus offers no service level agreement, uptime commitment, or service credits, unless an Order Form expressly provides otherwise.

11.2. Maintenance. Pombus may perform maintenance that affects availability. Where practicable, Pombus will give advance notice of planned maintenance expected to cause significant disruption.

11.3. Deliverability and shared reputation. Pombus does not guarantee that any message will be delivered, placed in a recipient's inbox, or delivered within a particular time. Delivery depends on factors outside Pombus's control, including recipient mail servers and filters, your domain's reputation and DNS configuration, and upstream infrastructure providers. For Pombus Addresses, deliverability additionally depends on the reputation of the shared pombus.com domain, which your Pombus Address shares with every other Customer's Pombus Address. Pombus maintains that domain's authentication (DKIM, SPF, and DMARC) and applies the shared-domain controls in Sections 4.4 and 5.5 of the AUP to protect it, but cannot guarantee that the conduct of other Customers, or the measures Pombus takes in response to it, will never affect your deliverability. Where your volume or sending pattern is not suited to a shared domain, Pombus may require you to move that use to a Customer Domain (AUP Section 5.5). You accept this characteristic of the shared model in exchange for being able to use the Service without owning a domain. This Section does not limit Pombus's liability to Consumers under Section 4A.

11.4. Support. Support is available at hello@pombus.com during business days, 9:00–18:00 Brasília time (UTC−3), best effort, on a reasonable-efforts basis, without guaranteed response times.

11.5. Status. Pombus will communicate significant incidents affecting the Service through email to Account owners.

12. Suspension

12.1. Grounds. Pombus may take any of the measures listed in Section 7.1 of the AUP (throttling or rate-limiting sending; suspending a Mailbox, API Key, or Account; renaming, migrating, or reclaiming a Pombus Address under Sections 4.5 and 5.5 of the AUP; activating an operator kill-switch to halt sending immediately; adding recipients to the Suppression List; or terminating the Account) where Pombus reasonably determines that:

When Pombus renames or migrates a Pombus Address, it will, where practicable, keep the Mailbox's content and API Keys intact under the new address and tell you the new address in advance. Termination is governed by Section 13.

12.2. Proportionality and notice. Consistent with Section 7.2 of the AUP, Pombus will seek to apply the least disruptive measure appropriate to the circumstances and, where practicable, at the narrowest level (API Key, then Mailbox, then Account). Where practicable and lawful, Pombus will notify you in advance and give you an opportunity to remediate. Pombus may act immediately and without prior notice for serious violations (for example, phishing, malware, CSAM, high complaint rates, compromised keys, or legal orders). In that case, Pombus will notify you promptly after acting, describe the measure and, where lawful, the reason, and explain how to request review. Pombus will lift a measure once its cause has been resolved to Pombus's reasonable satisfaction.

12.3. Non-payment. If Fees remain overdue 10 days after Pombus's notice, Pombus may suspend outbound sending. If Fees remain overdue 30 days after that suspension, Pombus may suspend the Account entirely. Pombus will not delete Customer Content because of non-payment before the Account is terminated and the period in Section 13.5 ends.

12.4. Effect of suspension. Suspension does not delete Customer Content. Fees continue to accrue during suspension caused by your breach or non-payment, and no refund is due for such suspension (AUP Section 7.3).

12.5. Review. You may request review of any suspension by writing to abuse@pombus.com. Pombus will consider the request in good faith and respond within 30 days, stating whether the measure is maintained, modified, or lifted and, where lawful, the reason.

12.6. Suppression entries. Pombus may keep Suppression List entries after a measure is lifted, because they protect recipients and the Service.

13. Term and Termination

13.1. Term. The Agreement starts when you accept these Terms and continues until terminated under this Section. Subscriptions run for successive Billing Periods under Section 5.3.

13.2. Termination by you. You may terminate: (a) at any time, by cancelling under Section 5.3, effective at the end of the current Billing Period; or (b) for cause, by notice, if Pombus materially breaches the Agreement and does not cure the breach within 30 days after receiving written notice, in which case Section 5.7 applies.

13.3. Termination by Pombus. Pombus may terminate: (a) for cause, by notice, if you materially breach the Agreement and do not cure the breach within 15 days after notice, or immediately for serious or repeated violations as described in Section 7.2 of the AUP; or (b) for convenience, including if Pombus discontinues the Service, by giving at least 60 days' notice, in which case Section 5.7 applies.

13.4. Effect of termination. On termination: access to the Service ends; API Keys are revoked; sending stops; and all Fees accrued up to the effective date become payable.

13.5. Data export and deletion. For 30 days after termination, you may export Customer Content through the API or console. If termination was for a serious AUP violation, Pombus may condition export on measures reasonably necessary to prevent further abuse or to comply with law. After that period, Pombus will delete Customer Content in accordance with Section 16 of the DPA (for Business Customers) or Section 7 of the Privacy Policy (for Consumers). Pombus Operational Data is retained as described in Section 7 of the Privacy Policy and as required by law. Pombus keeps application access logs for at least six months, following the standard of Article 15 of the Marco Civil da Internet (which binds providers organized as legal entities and may be extended to Pombus by court order under Article 15, §1) and to be able to respond to legal orders and security incidents.

13.6. Survival. Sections 4A (to the extent applicable), 5 (for amounts due), 8.6, 9, 10, 13.4 to 13.7, 14 to 17, and 19, and any other provision that by its nature should survive, survive termination.

13.7. Pombus Addresses on termination or closure. When the Agreement terminates, when the Account is closed, or when a Pombus Address is closed or reclaimed, the license in Section 9.7 ends and the name reverts to Pombus. From that moment:

A Customer to whom a previously used name is assigned must not read, use, or reply to messages that are evidently intended for a former holder of the name, and must report them to abuse@pombus.com (AUP Section 4.5).

14. Warranties and Disclaimers

14.1. Limited warranty. Pombus warrants that it will provide the Service with reasonable skill and care and substantially in accordance with the Documentation, and that it will comply with the DPA. If Pombus breaches this warranty, your remedy is for Pombus to correct the non-conformity within a reasonable time or, if it cannot, for you to terminate the affected Service and receive a refund under Section 5.7(c). This does not affect Section 15.3.

14.2. Disclaimer. Except as expressly stated in the Agreement, and to the maximum extent permitted by applicable law, the Service is provided "as is" and "as available", as an early-access product. Pombus makes no other warranty, express or implied, including as to merchantability, fitness for a particular purpose, or non-infringement. Pombus does not warrant that the Service will be uninterrupted or error-free, that any message will be delivered, that the output or behavior of your Agents will be accurate or appropriate, or that Pombus's protective controls will prevent all misuse.

14.3. Non-waivable warranties and Consumers. Nothing in this Section excludes any warranty or liability that cannot be excluded under applicable law. If you are a Consumer, Section 4A.5 applies: the statutory warranties of the CDC apply to you, and the "as is" language in Section 14.2 describes the early-access nature of the Service but does not exclude them.

15. Limitation of Liability

15.1. Excluded damages. To the maximum extent permitted by applicable law, neither party will be liable to the other for indirect, incidental, special, or consequential damages, loss of profits (lucros cessantes), loss of revenue or goodwill, business interruption, or the cost of substitute services, arising out of or in connection with the Agreement, even if advised of their possibility.

15.2. Cap. To the maximum extent permitted by applicable law, each party's total aggregate liability arising out of or in connection with the Agreement will not exceed the greater of (a) the Fees paid and payable by the Customer in the 12 months preceding the event giving rise to liability, and (b) the price, currency and any usage charges shown on the checkout page at the time of purchase for one Billing Period of your plan.

15.3. Exceptions. Sections 15.1 and 15.2 do not apply to: (a) liability for fraud, wilful misconduct (dolo), or gross negligence (culpa grave); (b) the Customer's obligation to pay Fees; (c) the Customer's indemnity obligations under Section 16.1 and liability for breach of the AUP; or (d) any liability that cannot be limited under applicable law.

15.4. Data protection cap. Pombus's aggregate liability for breach of the DPA will not exceed 2x the amount in Section 15.2.

15.5. Data subjects and authorities. Sections 15.1 to 15.4 allocate liability between the parties only. They do not limit either party's liability to data subjects or authorities where applicable law (including Articles 42 to 45 of the LGPD and Article 82 of the GDPR) does not permit such a limitation, and they do not affect the right of recourse under Article 42, §4, of the LGPD.

15.6. Allocation of risk (Business Customers). Where the Customer is a Business Customer, the parties acknowledge that the Agreement is a business contract between parties acting in the course of business, that the Fees reflect the allocation of risk in this Section and the early-access nature of the Service, and that this allocation is to be respected under Article 421-A of the Brazilian Civil Code.

15.7. Mitigation. Each party will take reasonable steps to mitigate any loss for which it seeks to hold the other party liable.

15.8. Consumers. If you are a Consumer who is a natural person, Sections 15.1, 15.2, 15.4, and 15.6 do not apply to you, and Pombus's liability to you is governed by the CDC (Section 4A.6). If you are a legal entity that qualifies as a Consumer, Sections 15.1 and 15.2 apply only in justifiable situations, as permitted by Article 51, I, of the CDC.

16. Indemnification

16.1. By the Customer. You will defend and indemnify Pombus, its personnel, contractors, successors, and assigns against third-party claims, administrative proceedings, and fines, and against resulting losses and reasonable legal fees, to the extent arising from:

16.2. By Pombus. Pombus will defend and indemnify you against third-party claims alleging that the Service, as provided by Pombus and used in accordance with the Agreement, infringes that third party's intellectual property rights, and against resulting losses and reasonable legal fees. This does not apply to claims arising from Customer Content, your Agents, modifications not made by Pombus, combinations with items not provided by Pombus, or open-source components. If such a claim arises, Pombus may modify the Service to be non-infringing, obtain a license, or terminate the affected Service and refund prepaid, unused Fees.

16.3. Procedure. The indemnified party must notify the indemnifying party promptly of the claim; a delay excuses the indemnifying party only to the extent it is prejudiced by it. The indemnifying party may control the defense, including through the forms of third-party intervention available under Articles 119 to 138 of the Brazilian Code of Civil Procedure. The indemnified party will cooperate reasonably, at the indemnifying party's expense. Neither party may settle a claim in a way that admits fault by, or imposes obligations on, the other party without that party's consent, which may not be unreasonably withheld.

16.4. Consumers. If you are a Consumer, Section 16.1 applies only to the extent stated in Section 4A.7, and Section 16.3 does not oblige you to fund or conduct the defense of a claim.

17. Governing Law and Jurisdiction

17.1. Governing law. The Agreement is governed by the laws of the Federative Republic of Brazil.

17.2. Amicable resolution. Before starting legal proceedings, the parties will try in good faith to resolve any dispute through negotiation for 30 days after written notice of the dispute. This does not prevent either party from seeking urgent relief (tutela de urgência) at any time.

17.3. Forum (Business Customers). For disputes with Business Customers, the courts of the judicial district (Comarca) of Sorocaba, State of São Paulo, Brazil, where Pombus is domiciled, have exclusive jurisdiction over any dispute arising out of or in connection with the Agreement, in accordance with Article 63 of the Brazilian Code of Civil Procedure. This does not apply where applicable law gives the Customer a non-waivable right to bring proceedings in another forum.

17.4. Customers outside Brazil. Nothing in this Section prevents Pombus from seeking urgent relief or collecting overdue Fees in the courts of the Customer's domicile.

17.5. Consumers. If you are a Consumer, Section 4A.8 applies: you may sue in the courts of your domicile, Pombus will sue you only there, and Section 17.3 does not apply to you.

18. Changes to These Terms

18.1. Updates. Pombus may update these Terms. For material changes, Pombus will notify you by email or through the console at least 30 days before they take effect, except for changes required by law or needed to address abuse or security risks, which may take effect sooner. Non-material changes take effect when published, and the "Last updated" date above will be revised.

18.2. Right to terminate. If you object to a material change, you may terminate before it takes effect, and Section 5.7 applies. Continued use of the Service after a change takes effect constitutes acceptance. Changes do not apply to disputes that arose before they took effect.

19. General

19.1. Notices. Pombus will send notices to the email address of the Account owner or through the console. You must send notices to dpo@pombus.com, with a copy to the correspondence address provided upon request to dpo@pombus.com for notices of breach or termination.

19.2. Assignment. You may not assign the Agreement without Pombus's prior written consent. Pombus may assign the Agreement, by notice, to a legal entity that the individual operating Pombus forms or controls to carry on the Service (for example, on incorporation of the business), or to a successor in a merger, acquisition, or sale of all or substantially all of the relevant assets. The assignee assumes all of Pombus's obligations under the Agreement, the DPA continues to apply (Section 18.6 of the DPA), and, if you are a Consumer, you may cancel under Section 4A.4 if you do not accept the assignment. The assignment notice will state the assignee's legal name, CNPJ, and address, and the date from which invoices or receipts are issued by the assignee; the assignment does not change your plan, price, Billing Period, or the date of your next charge, and Section 5.6 applies to the assignee's invoices from that date.

19.3. Force majeure. Neither party is liable for failure or delay caused by events beyond its reasonable control, within the meaning of Article 393 of the Brazilian Civil Code, including widespread internet or DNS failures, outages of upstream infrastructure providers, cyberattacks despite reasonable security measures, and acts of government. This Section does not excuse payment obligations.

19.4. Independent parties. The parties are independent. Nothing in the Agreement creates a partnership, joint venture, agency, or employment relationship, and the individual operating Pombus does not render personal services to you, does not work under your direction, and is not an individual contributor (contribuinte individual) at your service within the meaning of Brazilian social-security law: the relationship is that of licensor and licensee (Sections 5.10 and 9.2).

19.5. Entire agreement. The Agreement is the entire agreement between the parties on its subject matter and supersedes all prior agreements and understandings on that subject. Terms in a Customer purchase order or similar document have no effect.

19.6. Severability. If any provision is held invalid or unenforceable, the remaining provisions remain in effect, in accordance with Article 184 of the Brazilian Civil Code, and the invalid provision will be replaced by a valid one that comes closest to its intent.

19.7. No waiver. A party's failure or delay in enforcing a provision is not a waiver of it.

19.8. Language. These Terms are drafted in English. Pombus intends to make a Portuguese version available; where it does, the Portuguese version prevails for Consumers domiciled in Brazil.

19.9. Anti-corruption. Each party will comply with applicable anti-corruption laws, including Law No. 12,846/2013.

19.10. Operator and continuity. Pombus is operated by an individual, Willian Clayton de Almeida. The obligations of Pombus under the Agreement bind that individual and their successors and estate. Pombus intends to maintain a continuity arrangement so that, if the individual operating Pombus becomes unable to operate the Service, Customers are notified by a person designated by the operator and can export Customer Content under Section 13.5 before the Service is discontinued under Section 13.3(b).

20. Contact

Willian Clayton de Almeida, an individual, trading as Pombus — CPF 277.866.058-51 (supplier identification under Article 2, I, of Decree No. 7,962/2013; the same number appears on invoices and receipts) Correspondence address: provided upon request to dpo@pombus.com