Terms of Service

In force since 19 September 2026.

The short version

• Alcarta is early software. It may break, it may lose data, and it may stop existing.
• We provide it as is. We promise no uptime, no result, and no feature that does not exist yet.
• If something goes wrong, what we owe you is capped — see section 13. If you are a consumer, the law gives you rights that this document cannot take away, and it does not try to.
• You are responsible for the mailboxes you connect and for what your agents do with them.

This summary helps you read the rest. Where it and a numbered section differ, the numbered section governs.

1. Who you are contracting with

These terms are an agreement between you and IUVIA Technologies, S.L. ("IUVIA", "we", "us"), NIF B16913006, registered office Lugar Cabezares, 5, 27614, registered at T 545, F 190, S 8, H LU 20807, I/A 1. Our email address is info@iuvia.io.

"You" means the person or the company using the Service. Where you accept these terms for a company, you confirm that you may bind it, and "you" then means that company.

2. What the Service is

Alcarta is a mail gateway. It gives an AI agent access to IMAP, SMTP and JMAP mailboxes that already exist somewhere else, over a REST API and an MCP server, without handing the agent the credentials to those mailboxes.

Its central mechanic is that an agent may declare an intention but may not carry it out. A request to send, delete or move mail returns an approval identifier and stops there. A person — or an approver you have explicitly authorised — commits it.

"Service" in these terms means the hosted version that we operate. The software you download and run yourself is covered by section 17 and by its own licence.

3. Accepting these terms

You accept them by creating an account, by using the Service, or by clicking to accept. If you do not accept them, do not use the Service.

You must be at least 18 years old.

4. What we do not promise

Read this section. It is the one that most changes what you can expect.

• The Service is provided as is and as available. We do not warrant that it will work, that it will keep working, that it will be free of errors or interruption, that it is fit for any particular purpose, or that it will meet your requirements.
• There is no service level. No uptime figure is promised and no credit is owed for downtime.
• We may change it, suspend it or shut it down at any time, including permanently, and including without notice where circumstances require it. We will try to give reasonable notice of a planned shutdown, and that effort is not a contractual commitment.
• Nothing we say about the future is a promise. Roadmaps, waiting-list messages, previews, documentation of planned features and anything said in conversation are statements of present intention, not commitments. No feature is owed to you until it exists and you are using it.
• Beta. The Service is pre-release. Expect defects, expect breaking changes, and do not rely on it for anything you cannot afford to have go wrong.
• We are not your mail provider. Whether a message arrives, arrives on time, is filtered, is marked as spam, is rejected, or is lost, is a matter for your provider and the receiving side. We do not control it and we do not warrant it.

To the fullest extent the law allows, we exclude all warranties, conditions and terms implied by statute, common law or otherwise. Where you are a consumer, see section 18: statutory rights that cannot be excluded are not excluded.

5. Your account

Keep your credentials secret, and tell us promptly at info@iuvia.io if you think somebody else has them. You are responsible for everything done through your account, except to the extent it results from our own failure.

We may refuse to create an account, and we may require you to verify your email address before the account does anything.

6. The mailboxes you connect

When you connect a mailbox you confirm that:

• you own it, or you have the permission of whoever does;
• you may lawfully give us access to it and to the mail in it;
• where that mail concerns other people, you have whatever legal basis is needed for us to process it on your behalf;
• and you will disconnect it when that stops being true.

We do not check any of this, and we cannot. It is yours to get right.

7. What your agents do is yours

Alcarta is built so that consequential actions wait for a person. That is a control, not a guarantee against every outcome.

You are responsible for the AI agents you connect, for the permissions you grant them, for the approvals you or your approvers commit, and for everything that follows. An approval you clicked is an instruction you gave.

8. Acceptable use

You will not use the Service to:

• break any law, or infringe anybody's rights;
• send unsolicited bulk or commercial email, in breach of Spanish Law 34/2002 (LSSI-CE), the GDPR, or the equivalent law where your recipients are;
• send or store malware, or anything designed to damage a system;
• reach a mailbox you are not authorised to reach;
• get around, disable or defeat the approval mechanism, the rate limits, or any other control in the Service;
• probe or attack the Service or its infrastructure, or anybody else's;
• resell or provide the Service to a third party, unless we have agreed in writing;
• place a load on the Service that interferes with other customers.

If you find a security problem, tell us at info@iuvia.io before telling anybody else. We will not take action against somebody who reports one in good faith and gives us a reasonable chance to fix it.

9. Fees

The Service is free during the pre-release period. Free does not mean forever.

If we start charging, we will tell you before it applies to you, and you will be able to stop using the Service rather than pay. Prices, when they exist, are exclusive of VAT and any other applicable tax.

10. Your data

How we handle personal data is set out in our Privacy Policy.

For the mail the Service reaches, you are the controller and we are the processor. The terms required by Article 28 GDPR are in Annex A below, and they form the data processing agreement between us. You do not need to sign a separate one, and Annex A prevails over anything in these terms that conflicts with it.

You keep every right you have in your data. We claim none of it. We use it to run the Service for you and for nothing else.

11. Our intellectual property

We own the Service, the software behind it, the documentation and the brand. Nothing here transfers any of it to you. You get a limited, non-exclusive, non-transferable, revocable right to use the Service while these terms are in force, and nothing more.

If you send us feedback or a suggestion, we may use it freely and owe you nothing for it. You do not have to send us any.

12. Third parties

The Service depends on things we do not run: your mail provider, your AI model provider, your network, and our own suppliers. We are not responsible for them, for their availability, for their security, or for what they do with what passes through them. Your relationship with them is yours.

13. What we are liable for, and what we are not

Nothing in this section limits liability that cannot lawfully be limited. That includes death or personal injury caused by our negligence, fraud or fraudulent misrepresentation, wilful misconduct, gross negligence, and any liability that Spanish law, including consumer law, does not permit to be excluded or restricted.

Subject to that:

(a) We are not liable for indirect loss. We exclude liability for indirect, incidental, special, consequential, punitive or exemplary loss, however it arises and even if we were told it was possible.

(b) We are not liable for these things in particular, whether the loss is direct or indirect: loss of profit, revenue, business, contracts, goodwill or anticipated savings; loss or corruption of data; and any loss arising from mail that was sent, was not sent, was sent late, was sent to the wrong recipient, was deleted, was moved, was disclosed, or was not received.

(c) Our total liability is capped. Our aggregate liability under or in connection with these terms and the Service, for all claims taken together, will not exceed the greater of (i) the fees you paid us in the 12 months before the event that gave rise to the claim, and (ii) one hundred euros (€100).

(d) Time limit. Any claim must be brought within 12 months of the day you knew, or ought reasonably to have known, of the facts giving rise to it.

The cap and the exclusions above apply however the claim is framed — contract, tort, negligence, statutory duty, restitution or anything else. They reflect that the Service is provided free or at low cost, in a pre-release state, with the risks in section 4 stated openly. Without them we would not provide it at all.

14. You cover us for what you bring on

You will defend, indemnify and hold harmless IUVIA, its directors, employees and suppliers against any claim, demand, proceeding, loss, liability, damage, cost and expense (including reasonable legal fees) arising out of or connected with:

• your use of the Service;
• the mailboxes you connected and the mail in them;
• anything an agent or an approver did through your account;
• your breach of these terms, of any law, or of anybody else's rights.

We will tell you promptly about any claim we want covered, let you control the defence of it (except that you may not settle in a way that admits fault on our part or imposes an obligation on us without our consent), and give you reasonable help at your cost.

If you are a consumer, this section does not apply to you to the extent that Spanish consumer law prohibits it.

15. Suspending and ending it

You may stop at any time, and close your account.

We may suspend or end your access, with notice where it is reasonably possible and without it where it is not, if you breach these terms, if we are required to by law, if your use threatens the Service or another customer, or if we discontinue the Service.

When it ends: your right to use the Service stops immediately, and we delete your data in line with the Privacy Policy and Annex A. Sections 11, 13, 14, 16, 19 and 20 survive.

16. Confidentiality

Each of us will keep the other's non-public information confidential and use it only for the purposes of these terms. This does not apply to information that is already public, that was already known without a duty of confidence, that is developed independently, or that must be disclosed by law — and in that last case, the one disclosing will tell the other first where it is permitted to.

17. The self-hosted software

Alcarta can be run on your own infrastructure. When you do:

• it is governed by its own licence, which travels with the code, and not by these terms, except for this section;
• it is provided as is, with no warranty of any kind, express or implied;
• we owe you no support, no maintenance, no security fix and no update, and nothing obliges us to publish another release ever;
• we process nothing. We see no data, we receive no telemetry, and we can help with nothing that happens inside your deployment;
• everything in it — your users' data, your keys, your backups, your legal compliance — is yours.

18. If you are a consumer

Where you use the Service outside your trade, business, craft or profession, Spanish consumer law applies to you and these terms do not reduce it.

• Your statutory rights are unaffected. Nothing in sections 4, 13 or 14 removes or limits a right that Royal Legislative Decree 1/2007 or any other consumer legislation gives you.
• Withdrawal. For a distance contract you normally have 14 days to withdraw without giving a reason. If you ask us to begin supplying the Service inside that period and acknowledge that you lose the right to withdraw once it has been fully performed, the right ends at that point, as Article 103 of Royal Legislative Decree 1/2007 provides.
• Unfair terms. If any term here is found unfair under consumer law, it does not bind you, and the rest continues to apply.
• Complaints. Write to info@iuvia.io first. You may also go to the consumer authority where you live, or to a consumer arbitration board (Junta Arbitral de Consumo). We are not currently signed up to any arbitration scheme, so a board can only hear a complaint against us if we agree to it in that case.
• Your courts. Section 20 does not take away your right to bring proceedings where you live.

19. Changes to these terms

We may change these terms. The date at the top changes with them.

If a change materially affects your rights or obligations, we will tell you at least 30 days beforehand by email or in the product, and continuing to use the Service after that date means you accept it. If you do not accept it, stop using the Service and close your account before the date; that is your remedy.

20. Law and courts

These terms, and any dispute arising out of them or out of the Service, are governed by Spanish law.

The courts of Sarria, Spain have exclusive jurisdiction, and each of us gives up any objection to that. This does not apply where you are a consumer: you may bring proceedings in the courts your law entitles you to, and this clause does not deprive you of the protection of the mandatory rules of the country where you live.

21. Everything else

• Whole agreement. These terms, the Privacy Policy and Annex A are the whole agreement between us about the Service, and replace anything said or written beforehand.
• Severability. If a court finds a provision unenforceable, the rest stands, and the provision is read down to the least extent that makes it enforceable.
• No waiver. Not enforcing something once does not give it up.
• Assignment. You may not transfer these terms without our written consent. We may transfer them to a company that acquires our business, on written notice to you.
• No partnership. Nothing here makes either of us the other's agent, partner or employee.
• Force majeure. Neither of us is liable for a failure caused by something outside our reasonable control — including network and provider outages, power failures, attacks, acts of a public authority, industrial action, and natural events — for as long as it lasts.
• Notices. To us: info@iuvia.io. To you: the email address on your account.
• Language. These terms are written in English. If we publish a translation and the two disagree, the English governs, except where the law of a consumer's country says otherwise.

Annex A — Data Processing Terms

These terms apply where we process personal data on your behalf, and they are the agreement required by Article 28(3) GDPR. You are the controller; we are the processor. Where this annex and the main terms disagree, this annex wins.

A1. What is processed

A2. Our obligations

We will:

1. Process only on your documented instructions, including for transfers outside the EEA, unless EU or Member State law requires otherwise — and in that case we will tell you first unless the law forbids it. Your use of the Service, and its configuration, are your instructions. We will tell you if we think an instruction breaches data protection law.
2. Keep it confidential. Everybody we authorise to process the data is bound to confidentiality.
3. Secure it with measures appropriate under Article 32, including those described in section 12 of the Privacy Policy. Those measures are the agreed baseline and we will not reduce them below it.
4. Use sub-processors only under A3.
5. Help you answer requests from data subjects, using the features of the Service where they do the job, and otherwise on reasonable request.
6. Help you with Articles 32 to 36 — security, breach notification, impact assessments and prior consultation — taking into account what we know and what the processing involves.
7. Tell you without undue delay when we become aware of a personal data breach affecting your data, with what we know at the time and updates as we learn more.
8. Delete or return the data at the end of the service, at your choice, and delete existing copies unless the law requires us to keep them. Our erasure job deletes every row belonging to an organisation in order, overwrites stored credentials with random bytes before removing them, and removes the audit log last.
9. Give you the information you need to show compliance with Article 28, and allow and contribute to an audit or inspection conducted by you or an auditor you appoint — on reasonable notice, no more than once a year unless a supervisory authority or a breach requires otherwise, at your cost, and subject to confidentiality.

A3. Sub-processors

You give us general authorisation to use sub-processors. The current ones are listed in section 9 of the Privacy Policy.

Each one is bound by written terms that impose the same obligations as this annex, and we remain fully liable to you for what they do. Before we add or replace one we will give you at least 30 days' notice. You may object on reasonable data protection grounds inside that period; if we cannot resolve it, you may terminate the affected part of the Service without penalty, and that is your remedy.

A4. International transfers

Where personal data leaves the EEA, the transfer is covered by an adequacy decision, by the European Commission's Standard Contractual Clauses, or by another lawful mechanism under Chapter V GDPR. On request we will tell you which applies to a given sub-processor.

A5. Liability

Liability under this annex is subject to the limits in section 13 of the main terms, except where the GDPR provides otherwise or where the law does not allow the limit.