Legal notice ============ The operator of AgentsMail, contact details and hosting. Version 1.0 · 2026-10-12 AgentsMail is operated by MIKE MC FORMATIONS LLC. 1704 Llano St Ste B-1433, Santa Fe, NM 87505, USA support@agentsmail.io https://www.agentsmail.io/en/legal 1. Service operator AgentsMail is an email marketing service operated by MIKE MC FORMATIONS LLC, a US limited liability company. AgentsMail is the service’s trading name. Operator’s address: 1704 Llano St Ste B-1433, Santa Fe, NM 87505, USA. 2. Contact General enquiries, support, complaints and data protection: support@agentsmail.io. You can also use the website’s contact form or write to the operator’s postal address. Identify your account or organisation and the purpose of your request; do not send passwords, API keys or unnecessary contact files. 3. Hosting The website is hosted by Vercel. Vercel Inc. publishes the following address: 440 N Barranca Avenue #4133, Covina, CA 91723, United States. Its website and contact options are linked below. Supabase provides the database and Amazon Web Services, through Amazon SES, provides email delivery. Their roles and the limits of available location information are explained on the Subprocessors page. Website hosting, data storage and email delivery are separate operations. Vercel — address and privacy notice : https://vercel.com/legal/privacy-notice Contact Vercel : https://vercel.com/contact 4. Content and intellectual property Rights in AgentsMail software, text, trademarks and graphics belong to their respective holders. Viewing them grants no reproduction or exploitation rights beyond statutory or contractual permissions. Users retain rights in their lists, messages and other content. The terms describe the permission needed to process and distribute it at their request. Report disputed content to the contact above, identifying the content and the grounds of the complaint. Legal documents: Legal notice : https://www.agentsmail.io/en/legal Terms of use and sale : https://www.agentsmail.io/en/terms Privacy : https://www.agentsmail.io/en/privacy DPA : https://www.agentsmail.io/en/dpa Subprocessors : https://www.agentsmail.io/en/subprocessors Cookies and tracking : https://www.agentsmail.io/en/cookies Contact form : https://www.agentsmail.io/en/contact Terms of use and sale ===================== Service terms for business customers and consumers. Version 1.0 · 2026-10-12 AgentsMail is operated by MIKE MC FORMATIONS LLC. 1704 Llano St Ste B-1433, Santa Fe, NM 87505, USA support@agentsmail.io https://www.agentsmail.io/en/terms 1. Parties and contractual documents These terms concern AgentsMail, operated by MIKE MC FORMATIONS LLC, and the person or organisation using or purchasing the service. Both businesses and consumers with legal capacity to contract may use the service. Anyone acting for an organisation must be authorised to bind it. The features, prices and limits of the selected offer presented before ordering supplement these terms. The DPA sets out the obligations for processing data entrusted by the customer and must form part of an agreement accepted by the parties. Merely viewing these pages or the DPA does not prove contractual acceptance. The privacy policy provides information; it is not blanket consent to processing or marketing. 2. Service, account and agent access AgentsMail provides contact and list management, templates and campaigns, automated sequences and statistics, according to the offer and available features. API and MCP connections allow you to authorise tools or agents to act for your organisation. Provide accurate information, protect access credentials and limit member and tool permissions. Check your agents’ instructions, particularly before imports or sends. Revoke unnecessary access and report unauthorised use. No subscription guarantees message receipt, inbox placement or commercial results. 3. Prices, payments, subscriptions and credits The total price, currency, applicable taxes, billing period and recurring or one-off nature of the purchase are presented before payment. Public prices appear on the Pricing page. Payments are processed through Stripe; the offer purchased is specified at checkout. Subscriptions renew at the frequency stated at purchase until cancelled. Credits and quotas limit sends or available features. Validity, allocation renewal and rollover rules depend on the displayed offer; do not assume indefinite retention. Purchasing credits does not authorise sending to contacts without a lawful basis. The financial consequences of a plan change are those displayed before confirmation. A new price does not retroactively change an already paid period. A payment problem may lead to restricted access after notice and an opportunity to remedy it, subject to mandatory rights. 4. Cancellation and data recovery The account billing area provides subscription management and cancellation. The effective date is displayed in the cancellation flow and confirmation. Contact support@agentsmail.io if you encounter difficulties. Cancelling renewal does not delete the account, organisations or their data. Retrieve contacts and content before requesting deletion or closing an organisation. Use available exports or contact support for other data. Export options and access limits depend on available features. The DPA governs return and deletion of entrusted data. Records legally required or necessary for a dispute may be retained for that limited purpose. Immediate erasure of all backups is not promised. Statutory refund rights remain applicable, particularly for withdrawal or lack of conformity. No blanket no-refund rule overrides them; any additional commercial refund requires express agreement. 5. Consumer withdrawal If you are a consumer covered by European or French distance-selling rules, you generally have 14 days from conclusion of the service contract to withdraw without giving a reason. Send an unambiguous statement to support@agentsmail.io or MIKE MC FORMATIONS LLC’s postal address. The model form below is optional. The statutory refund is made within 14 days of receipt of your decision, using the original payment method unless you expressly agree to another method without fees. If you expressly requested performance before the withdrawal period expired, a proportionate amount for the service actually provided may be payable under the statutory conditions. Activating an ongoing subscription does not itself remove this right. For a fully performed service, loss of the right requires the consents and disclosures required by law; digital-content exceptions do not automatically apply to a SaaS subscription. Model withdrawal form — To MIKE MC FORMATIONS LLC, 1704 Llano St Ste B-1433, Santa Fe, NM 87505, USA; support@agentsmail.io. I/We hereby give notice that I/We withdraw from my/our contract for the following service. Consumer to supply: service and order reference; order date; consumer name(s); address; date; signature only if sent on paper. Delete as appropriate. 6. Statutory digital-service guarantees Consumers benefit from applicable statutory guarantees, including conformity of digital services, which these terms do not limit. For continuous supply, the trader is responsible for defects appearing during the contractual supply period. Updates needed to maintain conformity are due under the applicable statutory conditions. Conformity may be requested free of charge, without undue delay and without significant inconvenience. Where the law allows, a price reduction or termination is available. Latent-defect rights also apply where relevant. Send requests to support@agentsmail.io. French Consumer Code — digital services, Articles L224-25-12 onwards : https://www.legifrance.gouv.fr/codes/section_lc/LEGITEXT000006069565/LEGISCTA000044132865/ 7. Contacts, campaigns and prohibited uses You must be able to explain your contacts’ source, the lawful basis for processing and the right to send each category of message. Consumer marketing generally requires prior consent. The existing-customer exception requires, among other conditions, an actual sale or service, similar products or services from the same legal entity, and an opportunity to object at collection and in every message. Being a former customer or student is not enough. Business marketing has its own conditions, including relevance to the recipient’s profession and an opportunity to object. Clearly identify the sender and maintain simple, free unsubscribe options. Respect unsubscribes, complaints and blocks; do not circumvent an objection through a new import, list or tool. Unlawfully collected lists, impersonation, illegal content, fraud, malware and evasion of limits are prohibited. Permission to send an email is not permission to track opens or clicks. Inform recipients and obtain the required consent or establish an applicable exemption before tracking. If the available features cannot meet these obligations for a campaign, contact support before sending it. 8. Content, data and liability You retain rights in your content and authorise hosting, technical copying, transmission and display only as needed for the functions you request. You must hold the necessary rights and permissions. Entrusted data is processed under documented instructions and the applicable DPA. Each party is responsible for its obligations under applicable law. Technical limits, interruptions, third-party services and abuse controls may affect the service; no quantified availability is guaranteed unless expressly agreed. This does not exclude AgentsMail’s liability where it arises, nor mandatory consumer guarantees or remedies. 9. Suspension, changes and complaints Illegal use, security risks, complaints or exceeding limits may justify proportionate suspension. Users are informed of the reason and available remedies where possible and compatible with security and law. Urgent risks may require immediate action. Documents carry a version and date. A contractual change affecting an ongoing contract must be notified and meet applicable information and acceptance requirements; publishing a new page does not constitute retroactive acceptance. Send complaints first to support@agentsmail.io. Consumers retain remedies and, where applicable, access to consumer mediation. These terms do not designate a mediator. No clause imposes exclusive US jurisdiction or removes mandatory consumer protections or competent courts in the consumer’s country of residence. Legal documents: Legal notice : https://www.agentsmail.io/en/legal Terms of use and sale : https://www.agentsmail.io/en/terms Privacy : https://www.agentsmail.io/en/privacy DPA : https://www.agentsmail.io/en/dpa Subprocessors : https://www.agentsmail.io/en/subprocessors Cookies and tracking : https://www.agentsmail.io/en/cookies Contact form : https://www.agentsmail.io/en/contact Privacy policy ============== How user information and data entrusted by customer organisations are used. Version 1.0 · 2026-10-12 AgentsMail is operated by MIKE MC FORMATIONS LLC. 1704 Llano St Ste B-1433, Santa Fe, NM 87505, USA support@agentsmail.io https://www.agentsmail.io/en/privacy 1. Who processes your data? MIKE MC FORMATIONS LLC is the controller for operating AgentsMail: accounts, commercial relationships, billing, support, security and its own communications. For contact lists, campaigns and processing determined by a customer organisation, that customer is normally the controller and the LLC acts as processor under the DPA. The LLC’s address and contact are shown at the top of this page. If you receive an email from an AgentsMail customer, first contact the sender identified in the message. We can forward or assist with the request without replacing the customer’s decisions. 2. Data, purposes and legal bases We receive information you provide, information supplied by your organisation’s members or authorised integrations, and technical data needed for your interactions. Required fields are needed for the requested service; without them we may be unable to provide it. Processing | Data and recipients | Basis and retention Account and access | Identity, email, organisation, roles, sessions; hosting and database providers. | Contract for the contracting user; legitimate interest in administering member access. During account use, then for closure and outstanding requests. Orders and billing | Billing details, payment references, subscriptions, invoices; Stripe and technical providers. | Contract and accounting/tax obligations. During the relationship, then for applicable statutory retention periods for the relevant records. Support and complaints | Contact details, messages and useful attachments; authorised staff and request-handling tools. | Contract or legitimate interest in responding and protecting rights. Until resolution, then only necessary records for an obligation or dispute during its applicable period. Security and diagnostics | Technical identifiers, IP addresses in request logs, errors and access events; infrastructure and diagnostics when enabled. | Legitimate interest in preventing abuse and maintaining the service; legal obligations where applicable. As needed for investigation and service protection, with restricted access. Our communications | Email and subscription or objection preferences. | Consent where required for marketing, or an applicable legal exception; until withdrawal or objection, then minimal evidence of the objection. Customer data | Contacts, supplied fields, sources, lists, content, events and objections; providers described on the dedicated page. | Instructions and lawful basis determined by the customer. During the service, then return/deletion under the DPA, subject to legal exceptions. 3. Retention and deletion These criteria do not mean that every category is automatically purged after a uniform period. Retention depends on purpose, the contractual relationship, applicable obligations and deletion requests. Technical log and backup retention also depends on the services used. Contact us for details of the data concerned. An objection may require retention of a minimal identifier to prevent another message. Backups may temporarily retain a copy until expiry; account deletion does not guarantee immediate backup erasure. Records needed for a legal obligation or defence of a right are restricted to that purpose. 4. Recipients and international transfers Access is limited to people authorised for their duties, necessary service providers, tools you connect and authorities where legally required. The Subprocessors page distinguishes infrastructure used from integrations dependent on enabled features. The operator is established in the United States. The database and sending region are in Ireland according to information from the operator; this does not exclude access, logs, support operations or transfers outside the European Economic Area. The EU customer–LLC relationship and onward supplier transfers require separate consideration. No supplier certification is presented as the LLC’s certification. Applicable safeguards must match the actual entities and processing: an adequacy decision covering the recipient or appropriate safeguards where needed. Request available information and safeguards from support@agentsmail.io before entrusting data. 5. Your rights Under the GDPR’s conditions, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. You may object to direct marketing at any time. Consent can be withdrawn without affecting prior lawful processing. French law also provides for instructions concerning data after death. Write to support@agentsmail.io with your request and the data concerned. Proportionate identity evidence may be requested if there is doubt; do not send identity documents unsolicited. GDPR requests are normally handled within one month; a reasoned extension of two months is possible under the statutory conditions. You may complain to the competent supervisory authority, including the CNIL in France, and seek a judicial remedy. CNIL — rights and complaints : https://www.cnil.fr/fr/plaintes 6. Emails, tracking and third-party tools Campaigns may contain individualised links and an open pixel. Events are linked to a contact, campaign, link and timestamp; email privacy protections can make statistics inaccurate. Customers determine campaign purposes and must inform recipients. Marketing consent and consent required for tracking are distinct. See Cookies and tracking for details. Tools and agents you connect through API/MCP access data within your permissions; their own processing is also subject to their terms. Share only necessary data. Browsing the website is not treated as consent to AI, trackers or marketing. Legal documents: Legal notice : https://www.agentsmail.io/en/legal Terms of use and sale : https://www.agentsmail.io/en/terms Privacy : https://www.agentsmail.io/en/privacy DPA : https://www.agentsmail.io/en/dpa Subprocessors : https://www.agentsmail.io/en/subprocessors Cookies and tracking : https://www.agentsmail.io/en/cookies Contact form : https://www.agentsmail.io/en/contact Data Processing Agreement (DPA) =============================== Personal data processing agreement for the AgentsMail.io service. Version 1.0 · 2026-10-12 AgentsMail is operated by MIKE MC FORMATIONS LLC. 1704 Llano St Ste B-1433, Santa Fe, NM 87505, USA support@agentsmail.io https://www.agentsmail.io/en/dpa 1. Parties and purpose The “Customer”, as controller, is the individual or legal entity identified in the customer contract record in Annex 1. Anyone binding the Customer must have the necessary authority. The “Provider”, as processor, is MIKE MC FORMATIONS LLC, operator of AgentsMail.io, 1704 Llano St Ste B-1433, Santa Fe, NM 87505, USA. Its authorised representative is identified in the applicable contract record. Data protection and incident contact: support@agentsmail.io. This agreement (“DPA”) supplements the AgentsMail.io service contract identified in Annex 1 (“Main Agreement”). It applies exclusively to personal data processed by the Provider on the Customer’s behalf under that agreement (“Customer Data”). “Processing”, “personal data breach” and “data subject” have their GDPR meanings. The Customer determines the purposes and essential means. The Provider acts on its behalf for contacts, imports, campaigns, email delivery and statistics only to the extent those features are actually provided and configured. Annex 1 specifies the subject matter, nature, purposes, duration, data and data subjects. Processing for which the Provider determines its own purposes, including its billing or legal obligations, is identified separately in appropriate information. This does not authorise reuse of the Customer’s lists, content or statistics for the Provider’s campaigns, their sale or disclosure for independent use. 2. Documented instructions The Provider processes Customer Data only on documented Customer instructions, including for international transfers. This DPA, agreed annexes, service settings and written requests from authorised persons constitute instructions within the Main Agreement’s scope. A new instruction changing the scope requires prior written agreement on implementation. If processing is required by Union or Member State law binding the Provider, it informs the Customer before processing unless that law prohibits disclosure on important public-interest grounds. Requests under third-country law are assessed under the GDPR, including Article 48, and the applicable transfer mechanism; they do not by themselves constitute Customer instructions. The Provider immediately informs the Customer if an instruction appears to infringe the GDPR or other Union or Member State data-protection rules. It suspends that instruction pending clarification without unnecessarily suspending lawful processing. It does not determine new purposes in the Customer’s place. 3. Customer obligations The Customer establishes a valid legal basis, provides required information, minimises data, maintains accuracy and defines appropriate retention periods. It ensures instructions and imported or sent content are lawful and arranges handling of rights requests and objections. This DPA is neither marketing consent nor approval of a contact list. Being a former student or customer does not by itself authorise every commercial email. Before a campaign, the Customer checks applicable rules, evidence of consent or all conditions of the existing-customer exception. It respects unsubscribes, objections, exclusions and retention limits and does not reimport excluded contacts to circumvent their choices. The Customer assesses the Provider’s safeguards before entrusting data. This allocation of tasks does not reduce the Provider’s own GDPR obligations. 4. Confidentiality and security The Provider limits access to persons who need it for authorised operations and ensures they are bound by suitable contractual or statutory confidentiality obligations and know the instructions and their duties. Confidentiality continues after their involvement ends. The Provider implements and maintains technical and organisational measures appropriate to risk under GDPR Article 32. As appropriate, these cover confidentiality, integrity, availability, resilience, restoration and regular evaluation of effectiveness. Annex 2 describes service mechanisms and responsibilities; specific measures and evidence of controls are recorded in the security record agreed by the parties. Specific encryption, backup, restoration and availability commitments are those in the applicable contractual security record. They do not reduce the Provider’s statutory duty to provide appropriate security. Material changes are documented and must not reduce the agreed level of protection. 5. Subprocessors The Customer gives general written authorisation for the subprocessors named in the applicable contractual Annex 3. Authorisation covers the agreed entities and processing, not every available integration indiscriminately. Before adding or replacing a subprocessor, the Provider gives written notice of the entity, role, data, processing and access countries, safeguards and intended date. It allows reasonable advance notice enabling an effective objection, as specified in the contract record before the change takes effect. The Customer may object on documented data-protection grounds. The parties seek a suitable solution: additional safeguards, an alternative provider or no use for the affected data. The new provider does not receive those data while the objection remains unresolved. If no solution is found, the Customer may terminate the affected service and request return or deletion under Article 10. Financial consequences follow the Main Agreement without defeating mandatory rights. The Provider checks sufficient guarantees and imposes in writing the relevant equivalent data-protection obligations, including security and assistance. It remains fully responsible to the Customer for subprocessor performance. It supplies relevant contractual information with only strictly necessary redaction of information unrelated to the review. 6. Data-subject rights and assistance Taking account of the nature of processing, the Provider assists through appropriate technical and organisational measures, insofar as possible, with information, access, rectification, erasure, restriction, portability, objection and applicable automated-decision requests. It forwards requests received directly concerning Customer Data to the Annex 1 contact without undue delay and does not answer their substance unless instructed or legally required. It preserves useful evidence, helps locate data and performs lawful requested actions. The Customer leads identity checks, decisions and replies within statutory deadlines. Taking account of the processing and information available, the Provider assists with GDPR Articles 32–36: security, breaches, impact assessments and prior consultation. It supplies useful documentation and technical information. Practical arrangements or assistance fees may be agreed in the Main Agreement but must not obstruct a legal duty, urgent action or effective exercise of rights. 7. Personal data breaches The Provider notifies the Customer of a breach affecting Customer Data without undue delay after becoming aware of it. It does not wait for the investigation to finish before initial notification. Contacts and operational escalation arrangements are those in the contractual security record; an agreed period does not permit unjustified delay. As information becomes available, notification includes the incident’s nature, approximate categories and numbers of affected people and records, follow-up contact, likely consequences and measures taken or proposed to remedy and mitigate it. Further information is supplied progressively without undue delay. The Provider contains the incident, preserves necessary evidence, documents facts and cooperates in analysis and remediation. The Customer decides notifications to authorities and data subjects under its legal obligations. The Provider makes them on the Customer’s behalf only on instruction, unless independently required by law. 8. Evidence and audits The Provider supplies information needed to demonstrate compliance with GDPR Article 28 and this DPA. It allows and contributes to audits, including inspections, by the Customer or its mandated independent auditor. The parties reasonably organise scope, confidentiality, access and timing to protect other customers and service security. Recent documents may be a first step but do not replace a necessary inspection. No frequency limit, notice period or fee may prevent a review justified by an incident, serious compliance concern or authority request. The Provider remedies non-compliance for which it is responsible and documents agreed action. Each party keeps records and cooperates with competent authorities to the extent required by the rules applicable to it. 9. Location and international transfers Annex 3 and contractual transfer records identify hosting, backup and remote-access countries, including those of the US operator and support teams where relevant. Choosing a European provider region alone does not establish that no transfer occurs outside the European Economic Area (“EEA”). The Provider makes transfers subject to GDPR Chapter V only on documented Customer instructions and after identifying a valid mechanism for the flow. Annex 3 specifies exporters, importers, countries, data, access, transfer basis and necessary checks. An adequacy decision may be relied on only when it actually covers the recipient entity and processing. Data Privacy Framework participation is not presumed. Where Article 46 safeguards are needed, the parties establish the appropriate instrument, transfer assessment and necessary supplementary measures before transfer. Decision (EU) 2021/914 standard clauses are not automatically incorporated by this DPA. Their scope, including GDPR Article 3 as it applies to the importer’s processing, and the relevant module, options and annexes are determined for the flow concerned. Another valid mechanism is used where those clauses do not apply. The Provider reports without undue delay if it can no longer comply with applicable safeguards and suspends the affected flow until resolved. Subject to legal prohibitions, it informs the Customer of authority access requests, assesses their lawfulness and limits disclosure to what is legally required. 10. Term and disposal of data The DPA takes effect on its last valid acceptance with the applicable contractual annexes. It applies throughout processing for the Customer and until full return or deletion under this article. It does not retroactively legalise previous unlawful processing or transfers. At the end of services, at the Customer’s documented choice, the Provider returns Customer Data in an agreed format then deletes remaining copies, or deletes them directly, unless Union or Member State law requires retention. Arrangements and periods, including for backups and subprocessors, are set in Annex 1. It confirms completion in writing on request. Pending deletion, retained data remains protected, isolated from ordinary use and not reused. If a backup is restored, applicable deletion and objection instructions are reapplied. Exceptional legal retention is limited to the required data, purpose and period and communicated to the Customer unless legally prohibited. 11. Relationship with other terms Where provisions conflict concerning Customer Data protection, this DPA prevails over the Main Agreement. Mandatory GDPR provisions and, where applicable, validly concluded transfer clauses prevail over incompatible terms. The Main Agreement’s governing law, jurisdiction and liability terms apply only insofar as compatible with individuals’ mandatory rights, authorities’ powers and the parties’ legal duties. No contractual cap reduces data subjects’ rights or a supervisory authority’s powers. Material changes to this DPA or its annexes are documented and validly accepted; Article 5 governs subprocessor changes. Invalidity of one provision does not affect others insofar as they can lawfully remain in force. 12. Acceptance The reference contractual document is the AgentsMail.io DPA, version 1.0 dated 12 October 2026, with Annexes 1–3 and, where necessary, the separate transfer instrument identified in the contract record. For each Customer, the contract record and acceptance evidence identify the parties, authorised signatories and capacities, Main Agreement, annex versions, actual acceptance date and corresponding signature or electronic act. These details belong to the individual contractual relationship and are not published on this general page. The parties should retain the applicable version and acceptance evidence. The publication date above does not replace the individual acceptance date. Merely viewing this page, creating an account or selecting a plan does not by itself demonstrate acceptance of this DPA. Copies of applicable documents may be requested from support@agentsmail.io. Annex 1 — processing description and customer record The Customer’s contract record identifies its name or legal identity, address, authorised representative, instruction, rights and incident contacts, AgentsMail organisation and Main Agreement. It specifies authorised features and campaigns, purposes and service duration. Subject matter and operations: contact management and email delivery through selected features; import, recording, organisation, storage, consultation, selection, updating, delivery, handling of unsubscribes and delivery incidents, authorised statistics, export and deletion. Open or click tracking requires suitable instructions and a lawful basis; concluding this DPA alone does not authorise it. Data subjects: prospects, subscribers, customers and other contacts lawfully held by the Customer, and authorised organisation members. Particular categories, including minors where relevant, and necessary precautions are specified in the customer record. Data: first and last names, email addresses, lists, tags and relevant Customer-supplied attributes, source, consent or objection status and evidence, message content and delivery or interaction data needed for authorised features. Other fields and metadata are limited to the agreed scope. Excluded data: GDPR Article 9 or 10 data, identity documents, medical information, detailed financial information or detailed educational records, unless specifically agreed in writing following risk and safeguard assessment. The record specifies retention and its starting event for each category: contacts, campaigns and statistics, logs, minimal suppression list and backups. It specifies end-of-service choice, return format and channel, export and active-deletion periods, backup-deletion cycle and any legal exception, its purpose, access and duration. This general annex sets no uniform period or immediate erasure of all backups. Annex 2 — security and responsibilities Access and separation: the service includes accounts, distinct organisations, roles and server-side authorisation checks, plus API/MCP access permissions. The Customer allocates member and agent access, protects credentials and revokes unnecessary access. The Provider controls its personnel’s access and confidentiality. Data lifecycle: the service provides export and deletion mechanisms, unsubscribe and bounce/complaint management. The Customer defines instructions and supplies necessary information. Assistance and incident requests go to support@agentsmail.io and the Customer contact in the contract record. The applicable security record describes each measure’s scope, responsible person, evidence reference and check date: administrative privileges and authentication; environment separation and secrets; protection in transit and storage; backup and restoration; logging and alerts; maintenance and vulnerabilities; rights and deletion propagation; incidents and escalation. Specific restoration, retention, availability and notification objectives are those expressly agreed in that record. Necessary checks and corrections are documented. Article 4 applies independently of particular objectives; this annex does not attribute SOC 2 or another certification to AgentsMail. Annex 3 — providers and transfers Vercel hosts and runs the website: requests, IP addresses, logs and data processed by requested functions may be involved. Vercel Inc. publishes the address 440 N Barranca Avenue #4133, Covina, CA 91723, United States. Delivery networks and access may be international. Supabase provides the database and associated storage as used: relevant accounts, organisations, contacts, content, events and files. The operator identifies Ireland for the database; this region does not describe all support access and backups. Amazon Web Services, through Amazon SES, delivers email: senders, recipients, content, metadata, bounces and complaints. The operator identifies Ireland for sending; other processing, logs and access require their own assessment. The Subprocessors page describes other providers by function, including payment, orchestration, diagnostics, application emails and optional integrations. The contract record identifies entities actually used, addresses, roles, data, storage and access countries, retention, applicable DPAs and versions. A tool connected directly by the Customer is distinguished from a Provider-selected supplier. Each transfer record specifies exporter and importer roles, countries and access, data and purposes, GDPR territorial scope, Chapter V mechanism and evidence, required assessment and supplementary measures, and validation date and owner. It separately covers the Customer–MIKE MC FORMATIONS LLC relationship and supplier flows. Article 9 applies before each relevant transfer. AgentsMail subprocessor list : https://www.agentsmail.io/en/subprocessors Vercel — DPA : https://vercel.com/legal/dpa Supabase — DPA : https://supabase.com/legal/customer-resources/data-processing-addendum AWS — subprocessors : https://aws.amazon.com/compliance/sub-processors/ Legal documents: Legal notice : https://www.agentsmail.io/en/legal Terms of use and sale : https://www.agentsmail.io/en/terms Privacy : https://www.agentsmail.io/en/privacy DPA : https://www.agentsmail.io/en/dpa Subprocessors : https://www.agentsmail.io/en/subprocessors Cookies and tracking : https://www.agentsmail.io/en/cookies Contact form : https://www.agentsmail.io/en/contact Subprocessors and providers =========================== Infrastructure, optional integrations and transfer information. Version 1.0 · 2026-10-12 AgentsMail is operated by MIKE MC FORMATIONS LLC. 1704 Llano St Ste B-1433, Santa Fe, NM 87505, USA support@agentsmail.io https://www.agentsmail.io/en/subprocessors 1. How to read this list This page distinguishes AgentsMail infrastructure providers from integrations that depend on the feature used. Listing a provider does not mean it receives all your data. Contracting entities, accepted agreements, support access and backup arrangements depend on the actual account and plan. Public links below do not themselves establish that those agreements have been concluded. The list applicable to a DPA must be confirmed for the relevant service. Request confirmation and transfer information from support@agentsmail.io before entrusting data requiring particular safeguards. 2. Infrastructure Provider and role | Data concerned | Location and established scope Vercel — website hosting and delivery | Requests, IP addresses and technical logs; data processed by requested pages and functions. | Vercel Inc. is identified in its public notice. International delivery networks and access are possible; no exclusive AgentsMail region is claimed. Supabase — database and associated storage as used | Accounts, organisations, contacts, content and events; files if storage is used. | Ireland is declared for the database. Supabase group entities, plan and applicable agreement must be distinguished; access and backup countries cannot be inferred from the database region. Amazon Web Services / Amazon SES — email delivery and feedback | Senders, recipients, message content, metadata, bounces and complaints. | Ireland is announced for sending. The AWS contracting entity depends on the account; Amazon Data Services Ireland Limited appears among infrastructure entities but is not necessarily the contracting party. 3. Payments and feature-specific integrations Stripe processes payments, billing information and subscription references. For some operations, notably regulatory obligations, it may act for its own purposes; it is not automatically a processor of contact lists. Inngest is integrated for tasks and automations: organisation, campaign and contact identifiers, import references and information needed for tasks may be involved. Sentry may receive errors, traces and technical information when diagnostics are enabled. Resend remains a possible integration for application emails depending on configuration. Google Analytics and Cloudflare Turnstile are conditional integrations for audience measurement and form protection respectively. Actual activation and consent requirements must be distinguished from technical availability. Some features may call AI or content-assessment providers, including Typesafe/JEV for spam-risk advice, or OpenAI/Anthropic for chat depending on configuration. Activation, provider, transmitted content and safeguards must be specified for the relevant feature; this page does not authorise blanket disclosure of lists to those providers. 4. Customer-connected tools An agent, software tool or model you connect through API/MCP or webhooks receives information permitted by your authorisations. That connection alone does not make it a provider selected by AgentsMail. Review its terms, limit permissions and revoke access when no longer needed. 5. Countries, contracts and safeguards A storage region does not by itself describe administration, support, logging, replication or backup countries. Processing by MIKE MC FORMATIONS LLC in the United States must be considered separately from each provider’s processing. No guarantee of exclusive EU residency is given. Applicable agreements and transfer mechanisms must cover the correct entities and processing. The DPA describes advance notice and objections to subprocessor changes; updating this page does not replace that notice. 6. Public provider documents Vercel — DPA : https://vercel.com/legal/dpa Supabase — DPA : https://supabase.com/legal/dpa AWS — subprocessors : https://aws.amazon.com/compliance/sub-processors/ Stripe — privacy : https://stripe.com/privacy Inngest — privacy : https://www.inngest.com/privacy Sentry — privacy : https://sentry.io/privacy/ Resend — privacy : https://resend.com/legal/privacy-policy Legal documents: Legal notice : https://www.agentsmail.io/en/legal Terms of use and sale : https://www.agentsmail.io/en/terms Privacy : https://www.agentsmail.io/en/privacy DPA : https://www.agentsmail.io/en/dpa Subprocessors : https://www.agentsmail.io/en/subprocessors Cookies and tracking : https://www.agentsmail.io/en/cookies Contact form : https://www.agentsmail.io/en/contact Cookies and email tracking ========================== Browser storage, diagnostics and campaign measurement serve different purposes. Version 1.0 · 2026-10-12 AgentsMail is operated by MIKE MC FORMATIONS LLC. 1704 Llano St Ste B-1433, Santa Fe, NM 87505, USA support@agentsmail.io https://www.agentsmail.io/en/cookies 1. Sign-in cookie This cookie keeps you signed in to your account. Its duration may be shortened by the browser or signing out. Navigation also uses presentation preferences; the table below describes only the sign-in cookie. Name / provider | Purpose | Configured duration better-auth.session_token / AgentsMail | Authentication for the requested session. | 7 days, renewable with activity; browser session where the sign-in choice provides for it. 2. Audience measurement, security and external services The service includes optional Google Analytics audience measurement, Sentry diagnostics and Cloudflare Turnstile form protection integrations. Availability does not establish activation on every page. Describing a tool as security-related does not automatically settle the purposes or legal classification of its trackers. Where consent is required, a tracker must only be used after that consent, with effective refusal and withdrawal. Viewing this policy is not consent. 3. Your controls The language selector and theme controls change those preferences. Your browser lets you inspect and delete cookies and local storage and block some storage. Removing authentication cookies signs you out; removing preferences resets your choices. Browser blocking does not replace the service’s obligations where prior consent is required. For tracker questions or rights requests, write to support@agentsmail.io. Payment pages and third-party services opened from AgentsMail also provide their own information. 4. Email opens and clicks Campaign tracking is separate from website cookies. A pixel may report an email’s images loading; an individualised link may record a click before redirecting to the destination. Events are associated with the recipient, campaign, link and time. Automated email protections may trigger them; they do not prove a human read the message. Unsubscribe and topic opt-out links are excluded from click-tracking rewriting. This does not mean unsubscribing retroactively erases previously collected events. The sending customer must explain its purposes and obtain required consent or establish an applicable exemption. Consent to receive a newsletter does not automatically authorise pixels or click tracking. Recipients should contact the sender about tracking choices; blocking images may limit pixels but does not necessarily block tracked links. Contact support@agentsmail.io if you need help identifying the sender. Legal documents: Legal notice : https://www.agentsmail.io/en/legal Terms of use and sale : https://www.agentsmail.io/en/terms Privacy : https://www.agentsmail.io/en/privacy DPA : https://www.agentsmail.io/en/dpa Subprocessors : https://www.agentsmail.io/en/subprocessors Cookies and tracking : https://www.agentsmail.io/en/cookies Contact form : https://www.agentsmail.io/en/contact