Terms of Service — CinnaReach

1. Agreement

These Terms of Service ("Terms") constitute a legally binding agreement between you ("you", "your", "Customer") and CinnaReach, operated by Cinnamon Consulting ("we", "us", "our"), governing your access to and use of the CinnaReach platform, including all associated features, tools, APIs, and documentation (collectively, the "Service").

By creating an account, accessing, or using CinnaReach, you confirm that you have read, understood, and agree to be bound by these Terms, including the Data Processing Agreement set out in Schedule 1. If you are using the Service on behalf of an organisation, you represent and warrant that you have the authority to bind that organisation to these Terms. If you do not agree, you must not access or use the Service.

These Terms incorporate by reference our Privacy Policy, which forms part of this agreement.

2. Service Description

CinnaReach is a SaaS platform for automated B2B webinar outreach. The Service provides:

Sending personalised Google Calendar invitations at scale via Google Workspace integration
Real-time RSVP tracking (accepted, maybe, declined, awaiting)
Automatic registration of accepted attendees into Zoom webinars
Integration with MailerLite for post-webinar email sequence automation
Multi-sender rotation, contact cooldown management, and deliverability safeguards
Campaign scheduling, priority-based send queues, and occurrence-scoped analytics
Contact pool management with CSV import, suppression lists, and unsubscribe enforcement

We reserve the right to modify, update, or discontinue any feature at any time with reasonable advance notice of material changes.

3. Account Registration

To use CinnaReach, you must register with accurate, complete, and current information. You agree to provide truthful information and keep it current; maintain the confidentiality of your credentials; accept responsibility for all activity under your account; and notify us immediately at [email protected] of any suspected unauthorised access or security breach. Accounts are non-transferable.

4. Acceptable Use

You agree to use CinnaReach only for lawful B2B outreach and in compliance with all applicable laws. You must not:

Send to unlawfully obtained contacts: You must not upload contact lists obtained without an adequate legal basis — for example, scraped lists without consent, purchased lists without documented compliance, or lists that do not meet the standards in Section 5.
Send irrelevant or misleading communications: All outreach must be relevant to the recipient's professional role and your genuine business purpose. Deceptive subject lines, sender spoofing, or impersonation are strictly prohibited.
Violate electronic communications laws: You must comply with all applicable anti-spam and electronic communications laws in every jurisdiction where your contacts are located, including GDPR, CASL, CAN-SPAM, PECR, and any other applicable regulation.
Circumvent safeguards: You must not attempt to bypass sending limits, cooldown periods, suppression lists, or any other deliverability or legal protection built into the platform.
Misuse integrations: You must not use connected third-party services (Google, Zoom, MailerLite) in a manner that violates their terms of service.
Engage in illegal activity: Including fraud, impersonation, phishing, or distributing malware.
Interfere with the platform: Including denial-of-service attacks, unauthorised access attempts, or reverse engineering.

Violations may result in immediate account suspension or termination without refund. We reserve the right to report suspected illegal activity to relevant authorities.

5. Customer Obligations — Lawful Data Processing

This section is legally critical — please read carefully. CinnaReach processes contact data solely on your instructions as your data processor. You, as the data controller, bear primary legal responsibility for the lawfulness of processing the personal data you upload.

5.1 Lawful Basis Requirement

Before uploading any personal data to CinnaReach, you must ensure you have a valid lawful basis under Art. 6 GDPR (or equivalent applicable law) for storing and processing the contact's personal data, and for sending unsolicited commercial communications to that contact.

For B2B outreach to professional email addresses, legitimate interests (Art. 6(1)(f)) is the standard industry basis, provided: (a) you have a genuine business interest, (b) processing is necessary to achieve it, and (c) the contact's privacy interests do not override yours. This typically requires that your outreach is relevant to the recipient's professional role, you have obtained their data from a lawful source, and you provide a clear opt-out.

You represent and warrant that you have conducted or will conduct an appropriate Legitimate Interests Assessment (LIA) before sending campaigns, and that documentation is available on request from any supervisory authority.

5.2 Contact Data Source

You represent and warrant that all contact data you upload has been obtained from: your own CRM or customer records with an appropriate relationship basis; reputable B2B data providers who can demonstrate documented GDPR compliance; or publicly available professional directories where there is a reasonable expectation of professional contact. You must not upload data from scraping without consent, purchased lists without verified compliance documentation, or any source obtained in violation of applicable law.

5.3 Jurisdiction-Specific Requirements

In addition to GDPR, you acknowledge and agree to comply with the following jurisdiction-specific laws:

Jurisdiction	Law	Key requirement for CinnaReach-powered outreach
European Union / EEA	GDPR + ePrivacy Directive	Lawful basis (Art. 6) required. For B2B to corporate entities, legitimate interests applies in most member states. For individual professional addresses (sole traders, freelancers), legitimate interests applies but requires careful LIA documentation. Opt-out must be honoured immediately.
United Kingdom	UK GDPR + PECR	Same as EU GDPR post-Brexit. PECR applies to electronic marketing. Corporate subscribers can receive marketing without prior consent; individual subscribers require consent or soft opt-in. Clear opt-out required in every message.
Canada	CASL	CASL requires express or implied consent before sending commercial electronic messages. Implied consent applies where there is an existing business relationship. Every message must include your full legal name, mailing address, and a functioning unsubscribe mechanism. Opt-outs must be honoured within 10 business days. Penalties up to CAD $10M per violation. Do not send to Canadian contacts without confirming your consent basis.
United States	CAN-SPAM Act	No prior consent required, but every commercial message must include: accurate sender identification, no deceptive subject lines, a physical postal address, and a working opt-out mechanism. Opt-outs must be processed within 10 business days.
Australia	Spam Act 2003	Requires express or inferred consent. Inferred consent applies where the address was conspicuously published for business contact. Must include sender identification and functioning unsubscribe mechanism.

If you are unsure whether your outreach complies with applicable law in a particular jurisdiction, consult a qualified legal advisor before proceeding. CinnaReach's operational safeguards assist your compliance but do not substitute for your own legal obligations.

5.4 Indemnification for Non-Compliant Use

You agree to indemnify, defend, and hold harmless CinnaReach and Cinnamon Consulting from and against any claims, liabilities, damages, fines, penalties, and costs (including reasonable legal fees) arising out of your use of the Service in violation of applicable data protection or anti-spam law, including regulatory action by any supervisory authority or enforcement body.

6. Data Ownership

You retain full ownership of all data you upload to CinnaReach ("Your Data"), including contact lists, campaign configurations, and templates. We do not claim ownership rights over Your Data, nor do we sell, rent, or commercially exploit it. We access and process Your Data solely to operate the Service on your behalf, as set out in Schedule 1 (DPA). You grant us a limited, non-exclusive licence to process Your Data as necessary to operate the Service. This licence terminates upon account deletion.

7. Payment Terms

Access to CinnaReach requires a paid subscription as agreed during onboarding. All fees are exclusive of applicable taxes unless stated otherwise. Payment is due according to your agreed billing cycle. If payment is not received within 15 days of the due date, we may suspend access until the balance is settled. We will provide at least 30 days' written notice of any pricing changes, which take effect at the start of your next billing cycle.

8. Service Availability

We target 99.9% uptime but do not guarantee uninterrupted service. Scheduled maintenance will be communicated at least 48 hours in advance where practicable. We are not responsible for downtime caused by third-party providers (Google, Zoom, MailerLite, Heroku), internet connectivity issues, or force majeure events. In the event of a personal data breach, we will follow the notification procedure set out in Schedule 1, Section DPA 8.

9. Limitation of Liability

To the maximum extent permitted by applicable law, the Service is provided "AS IS" and "AS AVAILABLE" without warranties of any kind. We are not liable for any indirect, incidental, special, consequential, or punitive damages including loss of profits, revenue, data, or business opportunities. Our total aggregate liability for any claims arising under these Terms shall not exceed the total fees paid by you during the twelve (12) months preceding the event giving rise to the claim.

Nothing in these Terms limits liability for: (a) death or personal injury caused by negligence, (b) fraud or fraudulent misrepresentation, or (c) any liability that cannot be excluded by applicable law.

10. Termination

By you: You may terminate with 30 days' written notice. Pre-paid fees for the current billing period are non-refundable.
By us (with notice): We may terminate with 30 days' written notice for any reason, including discontinuation of the Service, with a pro-rata refund for the unused portion of any pre-paid period.
By us (immediate): We may suspend or terminate immediately for material breach of these Terms, including violations of Sections 4 or 5, non-payment, or activity that threatens the security or integrity of the Service.

Upon termination, you have 30 days to export Your Data. After this grace period, all Your Data will be permanently deleted in accordance with Schedule 1 (DPA), Section DPA 7. Sections 5.4, 6, 9, and 11 survive termination.

11. Governing Law

These Terms are governed by the laws of the Principality of Andorra and applicable EU regulations. Any dispute that cannot be resolved amicably within 30 days shall be submitted to the exclusive jurisdiction of the courts of Andorra. Either party may seek injunctive or equitable relief in any court of competent jurisdiction to protect intellectual property rights or confidential information.

Schedule 1 — Data Processing Agreement (DPA)

Effective date: Incorporated into and effective from the date you accept these Terms of Service.

Parties: This DPA is between the Customer (data controller) and Cinnamon Consulting / CinnaReach (data processor), as required by Article 28 of the General Data Protection Regulation (EU) 2016/679.

DPA 1. Definitions

In this Schedule: "Controller" means the Customer; "Processor" means CinnaReach / Cinnamon Consulting; "Personal Data" means personal data (as defined in Art. 4(1) GDPR) that the Controller uploads to or processes through the Service; "Processing" has the meaning in Art. 4(2) GDPR; "Sub-Processor" means any third party engaged by the Processor to process Personal Data on the Controller's behalf; "Data Subject" means the individuals to whom the Personal Data relates.

DPA 2. Subject Matter, Nature, and Purpose of Processing

Subject matter	Operation of the CinnaReach B2B webinar outreach platform on behalf of the Controller
Nature of processing	Storing contact records; scheduling and sending Google Calendar invitations; tracking RSVP responses; registering contacts in Zoom; syncing contact segments to MailerLite; applying suppression and cooldown rules; generating campaign analytics
Purpose	To operate, maintain, and improve the Service as instructed by the Controller
Duration	For the duration of the Service agreement; Personal Data deleted within 30 days of account termination
Categories of data subjects	B2B prospect contacts uploaded by the Controller; primarily professionals at organisations targeted by the Controller's campaigns
Categories of personal data	First name, last name, professional email address, company name, job title, LinkedIn URL (optional), RSVP status, Zoom registration status, email engagement status, suppression flags
Special categories of data	None. The Service is not designed to process special categories of personal data (Art. 9 GDPR). Customers must not upload data that includes health, political, religious, or other special category information.

DPA 3. Processor Obligations

CinnaReach, as Processor, agrees to:

(a) Process only on instructions: Process Personal Data only on the documented instructions of the Controller, unless required to do so by applicable law (in which case we will notify the Controller before processing, unless prohibited by law).
(b) Confidentiality: Ensure that all personnel authorised to process the Personal Data are subject to binding confidentiality obligations.
(c) Security (Art. 32): Implement and maintain appropriate technical and organisational measures to protect Personal Data. See DPA 6 for details.
(d) Sub-processors (Art. 28(2)): Not engage any Sub-Processor without prior written authorisation of the Controller. General authorisation is granted by the Controller's acceptance of these Terms in respect of the Sub-Processors listed in DPA 4. The Processor will provide 30 days' advance notice of any proposed new or replacement Sub-Processors.
(e) Data subject rights assistance: Assist the Controller in fulfilling its obligations to respond to data subject rights requests by making available appropriate information and functionality. Where a data subject contacts CinnaReach directly, we will promptly redirect the request to the Controller and will honour confirmed suppression and erasure requests within the platform immediately.
(f) Compliance assistance: Assist the Controller in ensuring compliance with obligations regarding security (Art. 32), breach notification (Arts. 33–34), data protection impact assessments (Art. 35), and prior consultations (Art. 36).
(g) Deletion on termination: Delete all Personal Data within 30 days of account termination, and delete existing copies unless applicable law requires retention.
(h) Audit rights: Make available all information necessary to demonstrate compliance with this DPA, and allow for audits and inspections conducted by the Controller or a mandated auditor, subject to 30 days' notice and appropriate confidentiality obligations. Audit costs are borne by the Controller.

DPA 4. Sub-Processors

The Controller grants general written authorisation for the following Sub-Processors. The Processor will provide at least 30 days' notice before adding or replacing Sub-Processors, giving the Controller an opportunity to object on reasonable grounds.

Sub-Processor	Role	Location	Transfer Safeguard
Heroku / Salesforce, Inc.	Cloud hosting, compute, storage, database	US / EU	EU Standard Contractual Clauses (2021)
Google LLC	Calendar API (invite sending & RSVP tracking)	US / EU	SCCs + EU-US Data Privacy Framework
Zoom Video Communications, Inc.	Webinar registration, attendance, webhook events	US	SCCs + EU-US Data Privacy Framework
MailerLite UAB	Post-webinar email sequences and subscriber management	EU (Lithuania)	GDPR (EU-based entity)
Redis (via Heroku infrastructure)	Background task queue and caching	US / EU	Covered by Heroku SCCs

DPA 5. Controller Obligations

The Controller agrees and warrants that it has a valid lawful basis for all Personal Data uploaded; will not upload special categories of personal data (Art. 9 GDPR) without prior written agreement; will provide clear and lawful processing instructions; will ensure data subject rights requests are handled within legally required timeframes; and will conduct and maintain LIAs before uploading contact data.

DPA 6. Security Measures (Art. 32 GDPR)

Encryption at rest: All databases encrypted at rest. OAuth credentials encrypted using Fernet symmetric encryption.
Encryption in transit: All data protected by TLS 1.2 or higher. Unencrypted connections are not permitted.
Access control: Role-based access controls. Production access limited to authorised personnel with a demonstrated need. Multi-tenant isolation enforced at every database query.
Password security: Passwords hashed with bcrypt. No plain-text passwords stored or transmitted.
Audit logging: Access logs, system event logs, and webhook event logs maintained for 90 days.
Infrastructure security: Background task queues (Redis) not externally accessible. Heroku platform-level security controls applied.
Incident response: Documented internal incident response procedure including breach detection, containment, investigation, and notification steps.

DPA 7. Data Retention and Deletion

Personal Data is retained only for the duration of the Service agreement and for the periods specified in the Privacy Policy's retention table. Upon account termination or a written deletion request, all Personal Data will be permanently deleted within 30 days. The Processor will provide written confirmation of deletion upon request. Billing reference data required for legal or accounting compliance is retained separately with restricted access for the legally required period.

DPA 8. Breach Notification

In the event the Processor becomes aware of a personal data breach affecting the Controller's Personal Data, the Processor will:

Notify the Controller without undue delay, and where feasible within 72 hours of becoming aware of the breach
Provide: the nature of the breach, categories and approximate number of data subjects affected, categories and approximate volume of records affected, likely consequences, and measures taken or proposed
Cooperate fully with the Controller to enable the Controller to fulfil its own notification obligations to supervisory authorities (Art. 33) and data subjects (Art. 34)

Breach notifications will be sent to the primary account email address. Customers are responsible for keeping this address current.

DPA 9. International Transfers

Where the Processor or its Sub-Processors transfer Personal Data outside the EEA, such transfers are protected by the mechanisms described in DPA 4. The Processor will not transfer Personal Data to any Sub-Processor in a country without an adequacy decision or appropriate safeguard, without prior written notice to and consent from the Controller. Andorra holds EU adequacy status; transfers from EU member states to Andorra require no additional mechanism.

DPA 10. Governing Law of This DPA

This DPA is governed by the laws of the Principality of Andorra, consistent with the governing law of the main Terms. Where GDPR or other EU law imposes requirements inconsistent with these Terms, GDPR/EU law prevails to the extent of the inconsistency.

13. Contact

Questions about these Terms or the DPA?

CinnaReach, operated by Cinnamon Consulting
Principality of Andorra
Email: [email protected]
Website: cinnamonconsulting.tech

For DPA-specific or data protection inquiries, please include "DPA / Data Protection" in the subject line. We aim to respond to all legal inquiries within 5 business days.