Terms & Conditions

1Accepting these Terms

You accept these Terms by ticking the acceptance box when you create your account. We record the date, time and version of the Terms you accepted. If you do not agree to these Terms, do not create an account.

2The Service

Garden provides a permission, identity and audit layer for inboxes:

• Single-linked inboxes, each bound to a Sender Registry of up to three known sender addresses (more may be possible in future), with the garden gate deciding what reaches you (Section 4).
• Grants and scopes that authorise a sponsor — an AI agent you connect — to act on your inboxes within defined bounds, at one of four autonomy levels, L1 to L4 (Section 5).
• Receipts and an activity ledger recording what your sponsor did and what you approved, rejected or instructed.
• Your choice of data residency in India or the European Union.

You can use the Service through the Garden web app, our browser extension, and our MCP server, which is how your AI agent connects (Section 6).

Early access. Garden is an early-access service that is still in development. You should expect downtime, bugs and features that change, and there will be occasions when the Service, including the garden gate, does not work as intended — a message may be wrongly held or removed, a malicious message may get through, or an agent action may not be recorded or undone as expected.

What Garden is not. Garden is a standalone product. It does not connect to an existing Gmail, Outlook or other third-party mailbox, and it is not a general-purpose email client; the web app is for viewing and managing Garden-issued inboxes. Garden is not an end-to-end encrypted email service: message data is encrypted in transit (including TLS-required inbound delivery) and at rest using our infrastructure providers' controls, but specifically approved Garden personnel and our infrastructure provider can access content where necessary to operate the Service, as the Privacy Policy explains.

3Eligibility and your account

By creating an account you confirm that you are at least 18 years old and able to enter into a binding contract. If we learn that an account holder is under 18 we will close the account and delete its data.

Keep your sign-in credentials confidential, use a strong password, and tell us at security@mysecure.garden as soon as you suspect anyone else has access to your account. You are responsible for what is done through your account with your credentials and for the grants you issue; Section 5 explains how responsibility for agent actions is divided.

The Service is not currently offered to people in the United Kingdom. You may not use the Service if you are subject to sanctions that prohibit us from dealing with you, or if the law of your country prohibits your use of it.

4Inboxes, the Sender Registry and the garden gate

Each inbox you create has a Sender Registry of up to three sender addresses. Every inbound message passes through the garden gate. Mail from a registered address is delivered, except that a registered sender whose mail has previously passed SPF, DKIM and DMARC authentication and now fails it is treated as phishing and deleted immediately. Mail from an unregistered address at the same domain as a registered sender is quarantined and visible to you for 14 days; you can approve the sender from the quarantine view, which adds the address to the Sender Registry and moves the message into your inbox; otherwise the message is deleted when the 14 days end. Mail from any other unregistered address, and anything our inbound mail provider identifies as spam or malware, is deleted immediately. Full detail is in Section 1 of the Privacy Policy.

What this means for you. The single-linked inbox is designed to keep out mail that does not come from a registered, authenticated sender. That means legitimate mail will be held or removed when a service you use sends from an address you have not registered, or when a registered sender that used to pass email authentication stops passing it. The gate cannot detect a forged message from a registered sender that has never used email authentication; if you register such a sender, you accept that risk. Messages that you have not preserved are also deleted automatically 30 days after receipt. You are responsible for keeping your Sender Registry current, for checking your quarantine view, and for preserving messages you need to keep. Garden inboxes should not be your only channel for time-critical or legally significant messages unless the sender's addresses are registered and you monitor quarantine.

Inbox addresses. A Garden inbox address is issued to you alone. When you delete an inbox or close your account, the address is retired and will never be issued to anyone else. Mail sent to a retired address is rejected at the gate.

5Grants, scopes and autonomy levels

A sponsor is an AI agent that you connect to your Garden inboxes through our MCP server. A sponsor can act only under a grant you have issued. Each grant has a scope — the inboxes and actions it covers — and one of four autonomy levels:

L1 — Observer. The agent can read what is in scope. It cannot change anything.

L2 — Assistant. The agent can propose new inboxes and senders and draft messages for you to send, and can act on its own only for low-stakes housekeeping such as quarantine triage. Everything it does is receipted.

L3 — Operator. The agent can send messages, but only to senders already verified in the inbox's Sender Registry, and can create inboxes within the budget you set (reversible for 7 days). Nothing goes to a recipient you have not approved.

L4 — Autonomous. The agent can send to any recipient, including people you have never approved. L4 must be switched on for each inbox separately and is subject to the hard caps shown in the product. At this level there is no structural safeguard left between the agent and the outside world; you are choosing to rely on your agent's judgement.

You can narrow, pause or revoke a grant at any time; revocation takes effect immediately for new actions. Undo reverses an action inside Garden where the product shows it as reversible — for example restoring an archived message, deleting an agent's draft, or removing an inbox the agent created within its 7-day window. A message that has already been delivered to another mail system cannot be recalled, and an action the agent has taken outside Garden cannot be undone by Garden. The set of reversible actions will grow as the product develops; the product shows you what is reversible at the time.

Responsibility. You are responsible for the grants you issue and for what a sponsor does within the scope and autonomy level you set. We are responsible for enforcing your grants as you configured them and for recording agent actions accurately in your activity ledger, subject to Section 11.

6The AI tier and the MCP server

Garden does not run, select or contract with AI model providers. If you use the AI tier, you connect your own AI agent, running on the model provider of your choice, to your Garden inboxes through our MCP server. Garden stores your content and transmits it to the agent you connect, within the scope you authorise; Garden does not read, analyse or generate from it. You are responsible for choosing your model provider, for complying with its terms, and for where it processes your content, which may be outside the data residency you chose for Garden. Your agent and its model provider are not our sub-processors; their terms, not ours, govern what they do with your content.

Your MCP token. Our MCP server is the interface through which your agent connects to Garden, using your account's MCP token. Anyone holding that token can act as your agent within your grants, so treat it like a password and rotate it if you suspect it has been exposed. We may apply rate limits, and we may suspend an MCP connection that we reasonably believe is compromised, abusive or harming the Service; we will tell you when we do.

AI output can be wrong. At higher autonomy levels you are choosing to let your agent act without your review, and you accept that it may act on a mistaken understanding of a message.

Telling recipients. When your agent sends a message on your behalf, the recipient may not know that an AI system wrote it. Some laws, including the EU AI Act, require that people be told when they are dealing with an AI system. It is your responsibility to make sure that any such notice is given where the law that applies to you or your recipients requires it.

7Tiers, billing, trials and renewal

Garden offers a Free tier and paid Privacy and AI tiers. What each includes, and its price, is set out on our pricing section at mysecure.garden at the time you subscribe. We may change what the Free tier includes, or withdraw it, on 30 days' notice.

Trials. We may give new accounts a trial of a paid tier. The tier and the length of the trial are shown when you sign up and may differ over time. We do not take payment details for a trial and we do not charge you when it ends; unless you subscribe to a paid tier before the trial ends, your account moves to the Free tier and any features that are not part of the Free tier stop working. If we ever offer a trial that converts into a paid subscription, we will tell you before you start it and remind you before the first charge.

Renewal. Paid tiers are subscriptions. They are billed monthly in advance and renew automatically each month at the then-current price until you cancel. We will show you the price, the renewal period and how to cancel before you subscribe. We will tell you before we introduce other billing periods.

Cancelling. You can cancel at any time from your account settings. Cancellation takes effect at the end of the current month; you keep access until then and we do not charge you again.

Refunds and the right to withdraw. If you live in the European Union, you have the right to withdraw from a paid subscription within 14 days of subscribing without giving a reason; if you have used the Service in that time we may deduct a proportionate amount for the period used. Elsewhere, and after the 14-day period, we do not refund part-used periods except where the law requires or these Terms say otherwise.

Prices, taxes and currency. Prices are shown in the currency of your billing country where we support it, and otherwise in US dollars. Prices include applicable taxes, including GST and VAT, unless stated otherwise at checkout. We may change prices with at least 30 days' notice; a change applies from your next renewal, and if you do not want to pay the new price you can cancel before it applies.

Payment. Payments are processed by Stripe or Razorpay. If a payment fails we will let you know and retry; if it still fails after 14 days your account moves to the Free tier.

8Acceptable use

You may not, and may not let your agent:

• send unsolicited bulk mail, phishing, malware, or messages that impersonate another person or organisation;
• harass, threaten or defraud anyone, or send content that is unlawful where you or the recipient are;
• try to get around the garden gate, the Sender Registry, or the grant and autonomy-level model — for yourself or anyone else — or probe them for weaknesses other than under the responsible-disclosure process below;
• use the Service in a way that breaches another service's terms, including the terms of your model provider;
• share your MCP token or sign-in credentials with anyone else;
• copy, decompile or reverse-engineer the Service's software, or scrape it, except where the law gives you a right we cannot exclude;
• use the Service if doing so would breach sanctions or export-control law that applies to you or to us.

Protecting deliverability. Because messages from all Garden inboxes leave through shared infrastructure, one account's behaviour affects everyone's mail. Sending limits are shown in the product and may change. We may hold or delay outbound messages that look like abuse and suspend outbound sending from an account whose messages are generating complaints or bounces, and we will tell you when we do. We may suspend or close accounts that breach this Section; where practicable we will warn you first.

Responsible disclosure. If you find a security weakness in Garden, please tell us at security@mysecure.garden before telling anyone else, give us a reasonable time to fix it, and do not access or change other people's data while investigating. We will not take action against you for good-faith research conducted this way.

9Intellectual property and your content

Garden's software, documentation, website, name, logo and branding belong to Char Vagh (OPC) Private Limited or its licensors. These Terms give you a personal, non-transferable right to use the Service; they do not give you any other rights in it.

Your messages and other content are yours. You give us the permission we need to store, transmit and otherwise handle them in order to provide the Service as described in our Privacy Policy, and nothing more. You confirm that you have the right to send and receive the content that passes through your inboxes.

If you give us feedback or suggestions, we may use them without any obligation to you.

10Third-party services

We rely on infrastructure and payment providers, listed in the Privacy Policy, to run the Service. Your AI agent and its model provider are services you choose and contract with directly. We are not responsible for the practices or availability of third-party services outside our control.

11Our responsibility to you

We will provide the Service with reasonable skill and care. Beyond that, and to the extent the law allows, we make no other promises about it: as Section 2 says, Garden is an early-access service, and we do not promise that it will be uninterrupted or error-free, that the garden gate will stop every malicious message or deliver every legitimate one, or that every agent action can be undone.

Nothing in these Terms limits or excludes our liability for death or personal injury caused by our negligence, for fraud, for gross negligence or wilful misconduct, for breach of our obligations under data protection law, or for anything else that cannot be limited under the law that applies to you. If you are a consumer, you keep every right your local law gives you that cannot be excluded by contract.

Subject to the paragraph above and to the extent permitted by law: our total liability to you for all claims arising out of the Service is limited to the amount you paid us for the Service in the three months before the event giving rise to the claim; if you use the Service on the Free tier, you have paid us nothing and that amount is zero; and we are not liable for loss of profit, loss of business, loss of data that you have not preserved, or any indirect or consequential loss.

12Indemnity (business use only)

If you use the Service for a business, you will indemnify us against third-party claims arising from your unlawful use of the Service or your breach of Section 8. This Section does not apply to consumers.

13Ending your account

You may close your account at any time from account settings. Closing your account deletes your data as described in the Privacy Policy; before you do, you can ask us for a copy of your preserved messages and activity ledger.

We may suspend or close your account if you breach these Terms, if we are required to by law, or if your account has been on the Free tier and inactive for 12 months. Except where the breach is serious or the law prevents it, we will warn you by email and give you 14 days to respond first. If we close your account other than for breach, you may ask for an export in the same way.

Sections 5 (as to actions already taken), 9, 11, 12, 16 and 17 survive the end of your account.

14Changes to the Service, and discontinuation

Garden is an early-access service and will change. We may add, alter or remove features, and change or withdraw tiers, where we have a valid reason such as improving the Service, security, cost or a change in the law. Where a change materially reduces what a paid tier gives you, we will tell you at least 30 days in advance and you may cancel with a pro-rata refund for the unused period.

If we decide to discontinue the Service altogether, we will give you at least 30 days' notice by email, keep the Service available for exports during that period, and refund any fees for the period after the shutdown date.

15Changes to these Terms

We may change these Terms when we have a valid reason — for example a change in the law, a new feature or a security need. We will email active account holders at least 30 days before a material change takes effect and show a notice in the product. If you do not agree with a change you may close your account before it takes effect, and for paid tiers we will refund any fees for the period after closure. For material changes we will ask you to accept the new Terms in the product; for other changes, using the Service after the effective date means you accept them.

16Governing law and disputes

These Terms are governed by the laws of India. If you are a consumer, you also benefit from any mandatory consumer-protection rules of the country where you live, and nothing in this Section takes away your right to bring a claim in the courts of that country.

If you have a dispute with us, please contact legal@mysecure.garden first; we will try to resolve it with you within 30 days. Subject to the first paragraph, any dispute that we cannot resolve will be decided by the courts at Nagpur, Maharashtra, India, which will have exclusive jurisdiction. If you use the Service for a business, you agree to that jurisdiction without reservation.

17General

• Assignment. We may transfer these Terms to an affiliate or to a successor to our business, and will tell you if we do. You may not transfer your account or these Terms to anyone else.
• Events beyond our control. We are not responsible for delay or failure caused by events beyond our reasonable control, including failures of our infrastructure providers, the internet or the mail systems of others.
• Severability. If a court finds part of these Terms unenforceable, the rest still applies.
• No waiver. If we do not enforce a right under these Terms straight away, we can still enforce it later.
• Entire agreement. These Terms and the Privacy Policy are the whole agreement between you and us about the Service.
• Notices. We contact you at your account email address. You contact us at legal@mysecure.garden.
• Language. These Terms are written in English. If we provide a translation, the English version prevails where the law allows.

18Who we are

Char Vagh (OPC) Private Limited, CIN: U62099MH2026OPC468326, registered office: 11, First Floor, Kasturba Nagar, Nagpur, Maharashtra, India.

Legal: legal@mysecure.garden · Privacy: privacy@mysecure.garden · Security: security@mysecure.garden · Grievance Officer (India): Amogh Meshram, Co-founder, grievance@mysecure.garden.