This summary is provided for orientation only. The numbered sections below govern the contract between you and black.com GmbH.

black.com is an encrypted email service operated by an Austrian company. There is a free plan and there are paid plans. Messages are encrypted in storage and we hold no copy of the key, so we cannot read the content of stored messages.

Encryption is a property of the service. It is not a promise of impunity. We comply with lawful requests from authorities with jurisdiction over us, and we terminate accounts used for unlawful purposes.

black.com GmbH, Am Belvedere 8, 1100 Vienna, Austria, registered with the Commercial Court of Vienna under FN 448732 a.

These terms govern your use of black.com in all its forms: the website at https://black.com and our Apps, APIs and Tools.

Certain provisions depend on your status. Provisions marked consumers apply if you are a consumer within the meaning of the Austrian Consumer Protection Act (KSchG). Provisions marked business customers apply if you contract in the course of your business. All other provisions apply to both.

black.com provides an email address at black.com, a system for sending and receiving email, and a system for storing and managing it.

There is a free plan and there are paid plans. The features and prices of each are set out at https://black.com/pricing, which forms part of these terms.

The free plan is provided at no charge and requires no payment details. It uses the same encryption as the paid plans, and we do not sell customer data. Payment increases storage and limits; it does not change what we are able to see.

Free accounts require yearly phone number verification, subject to the grace period in section 11. Once an account is deleted, its email address may be issued to another customer as described in section 10.

We may modify the service, extend it, or discontinue parts of it. Where a modification is material and you hold a paid plan, we will notify you in advance.

Each stored email counts for a minimum of 64 KB (64,000 bytes) against your plan's storage allowance, even if its visible message is shorter. An email uses storage beyond its body: we store headers, sender and recipient information, content, previews, search data, conversation and label records, and database indexes and other structures. The 64 KB minimum is a storage accounting rule, not a statement that every email occupies exactly 64 KB on a disk. If an email's counted message data exceeds 64 KB, the greater amount applies.

Attachments and embedded files count in addition to the email's 64 KB minimum, according to their stored size.

You must be at least 14 years of age. If you are under 18, you also require the consent of your parent or legal guardian.

You must be a natural person or represent an entity. Accounts created by automated means are deleted.

Registration requires your name, an available email address, a passkey and a mobile phone number. Paid plans additionally require payment details. You must keep this information accurate and notify us of any change.

Free accounts are subject to eligibility requirements intended to prevent misuse and ensure fair allocation. A customer who is not eligible for a free account may select an available paid plan.

Your passkey is the key to your email and we retain no copy of it. Configure account recovery when you register. If you lose both your passkey and your recovery method, the contents of your mailbox cannot be restored, by you or by us.

You must not disclose your passkey or your recovery codes, or grant any other person access to your mailbox. Acts performed through your account are attributed to you, including any charges arising from them. If you have reason to believe that a third party has obtained access, notify us without delay and change your credentials.

This section applies to paid plans.

Payment is processed by a licensed payment service provider. The methods currently supported are credit and debit cards (Visa, Mastercard, UnionPay and others), PayPal, Google Pay and Apple Pay. We may change the methods we support.

Plans purchased in our iOS or Android App are billed by Apple through the App Store or by Google through Google Play, under their respective terms. For those purchases, renewal, cancellation and refunds are handled through the store in which the plan was purchased.

Paid plans renew automatically each month until canceled. Fees fall due on invoice and are collected from the payment method you have provided. You must keep that method valid and current. We may also use it for other amounts owed to us under these terms.

On an upgrade or a downgrade, the revised fee is charged to the same payment method. A downgrade may reduce storage or aliases currently in use; please review what you are relinquishing before proceeding. We accept no liability for the consequences of a downgrade.

We reserve the right to change the prices of our paid plans, subject to applicable law. For an existing paid plan, a price increase takes effect no earlier than the start of a new billing period. We will give you at least 30 days' notice, or any longer period required by law. The notice will state the current and new price, the reason for the change, the effective date and how to cancel. For plans purchased through the App Store or Google Play, notice may be provided through the store.

You may cancel before a price increase takes effect. If you do, you will not be charged the new price, and your plan ends as described in section 10. A price increase applies only where all requirements of applicable law are met, including any requirement for your agreement.

This section applies to consumers.

Right of withdrawal. You have the right to withdraw from this contract within 14 days without giving any reason. The withdrawal period expires 14 days from the day of the conclusion of the contract. It runs separately for each contract: from the opening of your account, and, where you later purchase a paid plan, from that purchase. A free account held for some time beforehand does not shorten the period applying to a subsequent purchase.

To exercise the right of withdrawal, you must inform us, black.com GmbH, Am Belvedere 8, 1100 Vienna, Austria, of your decision to withdraw from this contract by an unequivocal statement, for example an email or a letter sent by post. You can also use the model withdrawal form in section 6.1, but you are not obliged to.

To meet the withdrawal deadline, it is sufficient for you to send your communication concerning your exercise of the right of withdrawal before the withdrawal period has expired.

Effects of withdrawal. If you withdraw from this contract, we reimburse all payments received from you without undue delay and in any event not later than 14 days from the day on which we are informed about your decision to withdraw. We carry out such reimbursement using the same means of payment as you used for the initial transaction, unless you have expressly agreed otherwise; in any event, you will not incur any fees as a result of such reimbursement.

If you requested to begin the performance of the service during the withdrawal period, you pay us an amount which is in proportion to what has been provided until you have communicated to us your withdrawal from this contract, in comparison with the full coverage of the contract. When you purchase a paid plan, you can request that the service begin immediately, and we confirm that request to you by email.

Where you withdraw from a plan purchased through the App Store or Google Play, the refund is processed through the store concerned.

Complete and return this form only if you wish to withdraw from the contract.

• To black.com GmbH, Am Belvedere 8, 1100 Vienna, Austria:
• I/We (*) hereby give notice that I/We (*) withdraw from my/our (*) contract for the provision of the following service (*):
• Ordered on (*)/received on (*):
• Name of consumer(s):
• Address of consumer(s):
• Signature of consumer(s) (only if this form is notified on paper):
• Date:

(*) Delete as appropriate.

Encryption. Messages are encrypted in storage. The key is derived from your passkey and we retain no copy of it. We are therefore unable to read the content of your stored messages and files, and unable to restore them.

What is not encrypted. Operating an email service and invoicing for it requires us to hold certain information: your account details, your phone number, sign-in records, payment records, and the routing information that email carries in order to be delivered at all. Our privacy policy sets out what we hold and for how long.

Lawful access. We are an Austrian company and are subject to the law applicable to us. Where an authority with jurisdiction over us issues a lawful and properly founded request, we comply with it and disclose the information we hold. Given the encryption described above, that is generally account and routing information rather than the content of stored messages. Where the law prohibits us from informing you that a request has been made, we will not do so.

Unlawful use. Encryption is a property of this service. It is not a promise of impunity, and it is not offered as a means of evading the law. You are responsible for ensuring that your use of black.com complies with the laws that apply to you. Where an authority with jurisdiction over us lawfully requires us to restrict or close an account, we do so, and where we are obliged to report a matter, we report it. We also close accounts used for the conduct described in section 8.

You must not use black.com for any unlawful purpose, and you are responsible for complying with the laws that apply to you.

The following are prohibited in particular. This list is not exhaustive.

• Unsolicited commercial communications and bulk advertising of any kind.
• Defamation, insult, harassment, threats, stalking, and incitement to hatred or to violence.
• Material depicting or promoting the sexual exploitation or abuse of children.
• Terrorist content, and content that incites, facilitates or glorifies terrorism.
• Fraud, deception, identity theft, phishing, extortion, and the distribution of malware, viruses, spyware or trojans.
• Trafficking in persons, weapons, controlled substances, stolen data or stolen credentials.
• Money laundering, evasion of sanctions, and concealment of the proceeds of crime.
• Infringement of copyright, trademarks, patents, trade secrets, privacy or personality rights.
• Conduct contrary to the laws protecting minors.
• Probing, scanning, attacking or attempting unauthorized access to our systems, and interference with the operation of the service for others.
• Any attempt to circumvent these prohibitions, and any assistance rendered to another person in doing so.

All content of black.com, including the software, the design, the text, the graphics, the logos and the layout, belongs to us or is licensed to us. Use of the service confers no rights in it. You must not copy, modify or reverse engineer it, except where the law confers that right notwithstanding any agreement to the contrary.

Where content on our systems contravenes these terms or the law, we may remove it immediately, without prior notice, and take such further measures as are appropriate.

We welcome reports of vulnerabilities. We will not treat security research as a breach of this section, and will take no action against you on account of it, where all of the following are satisfied.

• You act in good faith to identify a vulnerability, and not for gain, disruption or the gratification of curiosity about other people.
• You confine your testing to accounts and data that are your own.
• You do not access, alter, copy, exfiltrate or retain the data of any other person. If you encounter such data, you stop at once and tell us.
• You cause no degradation, disruption or loss of data, and you do not attempt denial of service, brute forcing, spam, social engineering, or physical intrusion.
• You establish no persistence, install no backdoor, and remove any access you obtain as soon as it is no longer required to demonstrate the finding.
• You report your findings to us via email promptly and in full, disclose them to no one else, and allow us a reasonable period to remedy the issue before any publication.

Conduct that goes beyond these limits remains prohibited. A report made afterwards does not excuse it, and reporting does not of itself make otherwise prohibited access, interference or destruction permissible.

You understand and accept the following risks inherent in a service of this kind.

• Reuse of email addresses. Once your account has been deleted, your email address may be issued to another customer. Inform your contacts before you leave, and replace the email address wherever you have used it to sign in.
• Software vulnerabilities. Software contains defects: ours, your browser's, your device's, and the security certificates on which everyone relies. Some are known to neither developers nor users, and a fix may take time to become available. Keeping your devices and applications current is part of remaining secure.
• Attacks. No system is immune to attack, ours included.
• Forgery. Email and SMS can be forged, and fraudulent call centers imitate the customer service of legitimate companies. We will never request your passkey, your recovery codes or your payment details by email, message or phone. Any communication that does so is not from us.
• Availability. The service requires maintenance, both planned and unplanned, and will at times be restricted or unavailable.
• Loss of your key. We hold no copy of the key to your email. If you lose both your passkey and your recovery method, your mailbox cannot be restored, by you or by us.

Backups and redundancy. We protect stored messages through mirrored RAID storage and immutable backup snapshots kept separately from the live database. These measures reduce the risk of loss, but technical failures, corruption, or other events can still result in data loss. We cannot guarantee that stored data will always be recoverable. Attachments and embedded files are stored with an S3-compatible storage partner, and we rely on that partner's data protection and recovery practices for those files. If you cannot afford to lose a message or file, use the Export Emails function periodically and keep the downloaded exports in a safe place.

Termination by you. You may terminate at any time using the cancellation function in your account; plans purchased through the App Store or Google Play are canceled there. Termination takes effect at the end of the period already paid for, and no further amount is charged. Non-payment following a reminder is likewise treated as termination.

Resumption. Where amounts owed for the period before termination remain unpaid, your account can be resumed only once they have been paid. No amount is charged for the period after termination. This is possible only for as long as the account still exists under section 11.

Termination by us. We may suspend or close your account and terminate the relationship for good cause, with immediate effect and without prior notice. Good cause includes, in particular: breach of section 8; transfer of your account to a third party; payment by fraudulent or stolen means; the sending of spam, phishing or malware; harassment of another person; attempted unauthorized access to our systems; and reasonable grounds to believe that a third party has taken control of your account.

Withdrawal of an email address. We may withdraw an individual email address for good cause, in particular where:

• the email address may give the impression of being an official black.com email address;
• the email address is required for internal purposes;
• the email address contains or refers to an offensive, immoral, criminal or controversial word or topic;
• the email address is unlawful, or impersonates a real person or organization.

Reissue of email addresses. Your email address is not issued to anyone else while your account exists. Once your account has been deleted as set out in section 11, the email address may be issued to another customer immediately. There is no reservation or protection period after deletion. Before you leave, inform your contacts and replace the email address wherever you have used it to sign in.

Deletion on request. You may request deletion of everything held in your account. For your protection the deletion is carried out after a security hold of 14 days, during which it can be canceled. The hold exists so that a third party who has obtained access to your account cannot destroy your email before you are able to intervene.

A request for erasure under Article 17 GDPR is a separate matter and is dealt with without undue delay. The security hold above applies to the ordinary closure of an account, not to the exercise of that right.

Where you do not request deletion. Your account is not deleted automatically for as long as a paid subscription is active, or for as long as, on a free account, your phone number is re-verified once a year.

When a paid subscription ends, we downgrade the account to a free plan where that is possible. It is not possible where, for example, the data stored exceeds the free allocation. Where the account cannot be downgraded, the account and its contents are deleted 12 months after that condition arises.

If the yearly verification of your phone number is not completed by its due date, we give you a grace period of at least 6 months from that date before deleting the account and its contents. Re-verifying your phone number during the grace period prevents deletion for this reason.

We notify you before either of these automatic deletions, and the deletion is canceled if in the meantime the account again satisfies the conditions in the preceding paragraphs.

Anything still held remains encrypted as before, and we are unable to read it.

Certain records must be retained for longer where the law so requires, principally accounting records for seven years. Our privacy policy identifies them.

We are under no obligation to retain or forward the contents of a closed account, nor to store messages once your storage allocation is exhausted.

We operate this service with care and take security seriously. Nobody, however, is able honestly to warrant the absence of the risks described in section 9, and we do not do so.

Consumers. We are liable for damage caused intentionally or by gross negligence, and for the culpable breach of an obligation essential to the purpose of this contract. Liability for personal injury, for expressly warranted characteristics, and under the Product Liability Act is not limited.

Business customers. We are liable only for damage caused intentionally or by gross negligence, and for personal injury.

For both consumers and business customers, cloud storage carries an inherent risk of data loss. Subject to the liability stated above and any liability that cannot be excluded by law, we are not liable for the loss or corruption of messages, attachments, embedded files or other account data, whether it occurs on systems we operate or those operated by our cloud storage partners. On the same basis, we are not liable for loss of profit or loss of use. We are not liable for services we do not operate, including payment providers, application stores, the networks over which email is carried, and any third-party service you connect. Those are used at your own risk.

black.com sends one-time security codes (OTCs) by SMS when you register, when you change your phone number, when the account recovery system is set up, and when an account recovery is initiated. These messages are sent solely to help protect your account against unauthorized access or malicious attackers. No marketing or promotional messages are sent through this program.

You can cancel the SMS service at any time by replying STOP to a text message sent by black.com. After you send STOP, we will send you a confirmation message that you have been unsubscribed. After this, you will no longer receive SMS messages from us. If you need to receive security codes again, reply START to the number that sent you our messages.

Carriers are not liable for delayed or undelivered messages.

Message and data rates may apply for any messages sent to you from us and to us from you. Message frequency varies based on user activity. For questions about your text or data plan, please contact your wireless provider.

For information on how we process your phone number and protect your personal data, please review our Privacy Policy.

Information and data that you receive from us in connection with the black.com system and that is not public is to be treated as confidential and not made accessible to third parties. This includes, in particular, non-public technical, security, operational and commercial information, and any vulnerability of which you become aware. This obligation continues after the contract has ended.

It does not apply to information that is public, or becomes public without a breach of this section; that you already lawfully held without an obligation of confidence; or whose disclosure is required by law or by a competent authority. Where disclosure is required, inform us beforehand if you are permitted to do so.

The reporting and publication of security findings is governed by section 8.1.

We may amend these terms where there is a valid reason for doing so, in particular where the law or its interpretation by the courts changes, where the service, its features or the providers we use to operate it change, where a security or payment requirement changes, or for a comparable reason. This provision may not be used to alter the substance of what you receive; that requires your agreement. Price changes are governed by section 5.1.

An amendment takes effect on your acceptance, or six weeks after notification, whichever occurs first. If you do not object in writing or electronically within those six weeks, your consent is deemed to have been given, and the notification will state this.

If you do not wish to accept an amendment, you may terminate before it takes effect, at no cost, and we refund the unused portion of any amount already paid. If you object to an amendment, we may terminate the contract with effect from the date on which the amendment would have taken effect.

These terms constitute the entire agreement between the parties. Conflicting terms do not apply. Previous agreements are superseded.

You may transfer your rights and obligations under this contract only with our written consent.

Notices are to be addressed to black.com GmbH, FN 448732 a, at the address in section 1.

Should a provision be or become invalid or unenforceable, the remaining provisions are unaffected. For business customers, the invalid provision is replaced by a valid provision approximating its legal and economic effect as closely as possible.

Austrian law applies, to the exclusion of its conflict-of-law rules. Where the law of the country in which you have your habitual residence grants you consumer protection that cannot be waived by agreement, this choice of law does not deprive you of it.

For disputes with business customers, the courts competent for 1010 Vienna have exclusive jurisdiction. Consumers retain the forum conferred by law.