Communications and Email.

Effective date: 2026-10-27.

This Communications and Email Policy (this "Policy") explains how wrxstack ("wrxstack", "we", "us") communicates with you by email and through the products, which of those messages you can turn off, and the rules we follow before we send anything that promotes the Service. It applies to the wrxstack products, including Atlas at atlas.wrxstack.com and Folio, the portfolio and personal-site builder, at portfolio.wrxstack.com, and to the website at wrxstack.com (together, the "Service").

This Policy supplements our Privacy Policy, which explains how we handle personal data in general. If the two documents differ on a matter about messages we send, this Policy controls for that matter. Rules for messages that you send to other people using the Service are in our Acceptable Use Policy and summarized in section 15.

The short version

• Service messages, such as sign-in links, security alerts, account notices, and legal notices, are needed to run your account. You cannot turn them off while your account exists.
• Newsletter and marketing email is optional. We send it only where the law allows, and every marketing email has a one-click unsubscribe link.
• Unsubscribing does not affect your account. We aim to act on it promptly, and in any case within the period the law requires, which is 10 business days under the CAN-SPAM Act and CASL.
• We do not buy, rent, sell, or share email lists, and we do not send marketing text messages or make marketing calls.
• We do not ask you for your password or a one-time code. Treat any message that does as suspicious.

1. Scope and who sends messages

This Policy covers every message that wrxstack sends, or has sent on its behalf, to account holders, newsletter subscribers, people who contact us, and people invited to the Service. It covers email and messages shown inside the products.

Who operates wrxstack. wrxstack is an independent, privately owned product run by a small team. Every message described in this Policy is sent by or for wrxstack. Questions about any message go to contact@wrxstack.com.

Delivery providers. We use email delivery services to send messages for us. They act on our instructions and are bound by their own data protection terms. Our sub-processor list describes the service providers we use.

2. Types of messages

We sort every message we send into one of the categories below. The category decides whether we need your consent and whether you can turn the message off.

If a message has both a service purpose and a promotional purpose, we treat it as marketing and apply the rules for marketing to it. We do not place promotional content inside a service message to avoid those rules.

3. Service messages

Service messages carry information you need to use the Service safely or that we are required to give you. They include:

• Sign-in and verification: email address confirmation, sign-in links, one-time sign-in codes, and password reset links that you request;
• Security: alerts about unusual activity, changes to your sign-in methods or account email, and notices about a security incident that affects you where the law requires them or where we decide to send them, as described in our incident response page;
• Account and billing: confirmation of changes you make, invitations to a workspace, subscription and payment notices, and confirmation that your account has been deleted;
• Legal: notice of changes to our Terms of Service, Privacy Policy, or other legal terms where we give such notice, and any other notice the law requires us to send;
• Responses: replies to support, privacy, and deletion requests you make.

Why you cannot turn them off. These messages are part of the service you signed up for. We send them to perform our agreement with you, to protect your account, and to meet legal duties. They are not marketing, so they do not contain an unsubscribe link. The only way to stop them entirely is to close your account, as described in our Data Deletion Policy. Some messages, such as a deletion confirmation or a reply to a request, may still reach you once at the end of that process.

No promotion inside service messages. Service messages may mention a feature only where that is needed to explain the notice, for example how to use a new security setting. They do not contain advertising.

4. Product updates

From time to time we may send account holders news about the products they use, such as new features or important changes. Where the law treats these messages as marketing, we send them only under the consent rules in section 6, and each one contains an unsubscribe link. A material change that affects your rights, such as a change to our legal terms, is a service message under section 3 where we send notice of it.

Unsubscribing from product updates does not stop service messages and does not change your account in any way.

5. Newsletter and marketing

Where the website offers a newsletter, it is an occasional roundup of what has changed in the wrxstack products, sent at our discretion. You join it by entering your email address and choosing to subscribe. We may ask you to confirm your subscription by clicking a link in a confirmation email before we send anything else.

• We use your address only to send the newsletter and other wrxstack marketing you agreed to receive.
• We do not need, and do not ask for, any other information to send it.
• Subscribing is not a condition of using the Service, and you do not need an account to subscribe.
• You can unsubscribe at any time, as described in section 8.

We do not send marketing on behalf of any other company, and we do not include third-party advertising in our email.

6. Consent rules we follow

Before we send a marketing message, we take reasonable steps to check that the law of the place where you are allows it. The main laws, and how we apply each one, are set out below.

6.1 European Union, European Economic Area, and United Kingdom

• Electronic marketing rules. The EU ePrivacy Directive, as implemented in each member state, and the UK Privacy and Electronic Communications Regulations 2003 ("PECR") require consent before an organization sends marketing email to an individual. We therefore send marketing email to individuals in these regions only with their prior consent, given by a clear action such as subscribing to the newsletter.
• Existing account holders. These laws allow an organization to email its own customers about its own similar products, without separate consent, if the customer was given a simple way to refuse when their address was collected and in every message after that. Where we rely on this rule for product updates, we aim to meet each of those conditions. We do not pass this permission to anyone else.
• Data protection law. Under the EU General Data Protection Regulation and the UK General Data Protection Regulation, we rely on your consent, or on our legitimate interest in telling account holders about our own products where the electronic marketing rules allow it. You have an absolute right under Article 21 to object to direct marketing at any time, and when you do, we stop using your data for direct marketing, as the law requires. More detail is in our GDPR Statement.
• Consent standards. Consent must be freely given, specific, informed, and unambiguous. We do not use pre-ticked boxes, and we do not treat silence or inactivity as consent. Withdrawing consent is as easy as giving it.

6.2 United States

• CAN-SPAM Act. The federal Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 sets rules for commercial email. We aim to follow it: accurate sender and routing information, subject lines that are not misleading, a clear statement that a message is promotional where required, a valid postal address where required, a working opt-out in every commercial email, and honoring opt-outs within the 10 business days the Act allows. Our practice is to send newsletter and marketing email only to people who asked for it or who hold an account with us.
• State privacy laws. We do not sell or share personal information for cross-context behavioral advertising, as those terms are used in the California Consumer Privacy Act as amended by the California Privacy Rights Act. We do not disclose personal information to third parties for their own direct marketing. See our California Notice.

6.3 Canada

Canada's Anti-Spam Legislation ("CASL") requires consent before a commercial electronic message is sent. We send marketing to people in Canada only with express consent, such as a newsletter subscription, or with implied consent where CASL allows it, for example for a limited period after you open an account or make an inquiry. As CASL requires, each such message is meant to identify us, give contact details that remain valid for at least 60 days after it is sent, and contain an unsubscribe mechanism. We act on unsubscribe requests within the 10 business days CASL allows, without charge.

6.4 Other places

Many other countries, including Australia, Switzerland, Brazil, India, and Singapore, have their own rules on electronic marketing and personal data. Where those rules apply to us and require consent or other steps that this Policy does not describe, we aim to follow them.

7. What every marketing email contains

Each newsletter, product update, or other marketing email we send is designed so that it:

• names wrxstack as the sender in the "From" line, and has a subject line that reflects what the message is about;
• comes from a sending address that we control, with accurate routing information;
• says why you are receiving it, for example because you subscribed to the newsletter;
• contains a clear unsubscribe link that works without signing in, and that stays active for at least the period the law requires, which is 60 days under CASL;
• gives a way to contact us, which is contact@wrxstack.com, and a valid postal address where the law requires one.

8. How to unsubscribe

You can stop newsletter, product update, and other marketing email in any of these ways. Each one is free and none of them requires a reason.

1. Use the unsubscribe link. Every marketing email has one. Select it and confirm. You do not need to sign in or give any information other than the address the email was sent to. Where your email program shows its own "Unsubscribe" button for our messages, that works too.
2. Use your account settings. Where a product offers email preferences in its settings, you can change them there at any time.
3. Email us. Write to contact@wrxstack.com with the subject "Unsubscribe", from the address you want removed, or tell us that address in the message.

Unsubscribing removes you from marketing only. It does not close your account, does not affect your use of the Service, and does not stop service messages under section 3. You can subscribe again later if you choose.

9. How quickly unsubscribes take effect

• Automatic unsubscribes. Where an unsubscribe link or button is processed automatically, it takes effect as soon as you confirm it.
• Requests we handle ourselves. Where we have to act on a request, such as an email to us, we aim to complete it within two business days.
• The legal limit. We complete the request within the period the law allows, which is 10 business days under the CAN-SPAM Act and CASL.

A message that was already being sent when you unsubscribed may still arrive in the short period before your request is processed. If you receive marketing email from us after that, email contact@wrxstack.com and we aim to look into it.

10. Our do-not-email list

When you unsubscribe, or when you ask us to delete your newsletter subscription, we remove your address from our mailing list. We then keep your address, and the date you asked, on a short internal do-not-email list. This is what is often called a suppression list.

• Why we keep it. Without it, we could not reliably avoid emailing you marketing again, for example if your address is entered on the newsletter form by someone else.
• What it holds. Only what is needed to recognize your address, and the date and reason it was added.
• How we use it. Only to stop marketing messages to you. We do not use it to send you anything, and we do not sell or share it, except with an email delivery provider that sends mail for us, so that it can block messages to you.

We also add an address to this list if messages to it fail permanently or if the recipient marks our email as spam. If you want to receive our newsletter again after unsubscribing, subscribe again and we can remove the block.

11. No bought lists and no sale of addresses

• We do not buy, rent, or borrow email lists, and we do not collect addresses from websites or directories to send marketing.
• We do not sell, rent, trade, or lend your email address to anyone.
• We do not share your email address with another organization for its own marketing.
• We do not send marketing to addresses that reached us only through a contact form, a support request, or a workspace invitation, unless the person also agreed to receive it.

12. Sender identity and how to verify a message

Genuine email from wrxstack comes from an address at wrxstack.com or one of its subdomains. Replies to our messages reach us, and our contact address is contact@wrxstack.com. We aim to publish email authentication records for our domain, such as SPF and DMARC, so that email services can check that mail claiming to come from wrxstack.com was sent with our permission.

If you are not sure a message is from us, check it this way:

1. Check the sender address, not only the display name. The part after the "@" should be wrxstack.com or end in ".wrxstack.com". Lookalike domains, such as extra letters, hyphens, or a different ending, are not ours.
2. Check the links before you select them. Our links point to wrxstack.com, atlas.wrxstack.com, or portfolio.wrxstack.com, or to a custom domain you connected to your own portfolio.
3. Do not use the links if in doubt. Type the address of the product into your browser yourself and sign in there. Anything that genuinely needs your attention will be visible in your account.
4. Ask us. Forward the message to contact@wrxstack.com and we aim to tell you whether we sent it.

13. Phishing and impersonation

Be cautious of any message that claims to be from wrxstack and:

• asks you to reply with a password, code, or other secret;
• says your account will be closed unless you act at once;
• asks you to install software, approve a sign-in you did not start, or make a payment through a link;
• comes from an address or links to a site that is not listed in section 12.

If you receive a suspicious message that uses our name, do not respond to it. Forward it to contact@wrxstack.com with the subject "Suspected phishing". If you think you entered your password or a code on a fake site, change your password at once from the product itself, sign out of other sessions where the product offers it, and tell us. Researchers who find a security issue in the Service can follow our Responsible Disclosure Policy.

14. Text messages, phone calls, and messaging apps

• Text messages. We do not send marketing text messages. If a product introduces a feature that sends text messages, such as a sign-in or security code, we intend that the product explains it before you turn it on. Before sending any marketing text message, we would first obtain the consent that the law requires, including prior express written consent under the US Telephone Consumer Protection Act where it applies.
• Phone calls. We do not make marketing calls, and we do not use automated or prerecorded calls. If you ask us to call you, we intend to call only about the matter you raised.
• Messaging apps and social media. We do not send marketing through messaging apps or social networks. Signing in with a provider such as Google, Apple, Microsoft, or Facebook does not let us message you on that provider. See our Data Deletion Policy.

Anyone who calls or texts you claiming to be from wrxstack and asks for a password, code, or payment is not acting for us. Treat it as described in section 13.

15. Messages our users send through the Service

Some features let account holders send messages to their own contacts. For example, a Folio owner may let visitors subscribe to updates from their portfolio and send email to those subscribers, and Atlas workspaces may send email or messages to their own contacts. In these cases, the account holder is the sender, decides who receives the message, and is responsible for meeting the law. wrxstack only delivers the message on the account holder's instructions.

• Account holders must follow our Acceptable Use Policy, including its anti-spam rules: a lawful basis to contact each recipient, accurate sender identification, a working unsubscribe in every commercial message, honoring unsubscribes within 10 business days, and keeping records that show compliance.
• Where the Service provides tools for this, such as confirmation emails for new subscribers and an unsubscribe link in each message, account holders must not remove or work around them.
• If you receive an unwanted message sent through the Service, use the unsubscribe link in it, or report it to contact@wrxstack.com with the subject "Abuse report". We may suspend sending, or take other action under our Terms of Service, against an account that sends spam.

Where an account holder's subscriber list contains personal data, the account holder controls that data and we process it for them under our Data Processing Addendum. Requests about that data are best sent to the account holder first. We may help where we reasonably can, as the Data Processing Addendum provides.

16. Accounts managed by an organization

If your employer or another organization (the "Customer") manages your account, for example through an Atlas workspace with single sign-on, the Customer may cause certain service messages to be sent to you, such as an invitation to join its workspace. The Customer, not wrxstack, decides who is invited. Our marketing rules in this Policy apply to you as an individual in the same way as to anyone else. Questions about how a Customer communicates with its own people should go to that Customer.

17. Delivery records and email measurement

Our email delivery providers keep records of whether a message was accepted, delivered, or rejected, and of spam complaints. We use these records only to deliver messages, to keep our list accurate, and to honor complaints and unsubscribes.

Where a marketing email measures whether it was opened or whether a link was selected, we use that information only to understand, in general terms, whether our newsletter is useful, and to remove addresses that no longer receive mail. We do not use it to build advertising profiles, and we do not sell it. Most email programs let you block this measurement by turning off automatic loading of images. Website analytics are covered separately in our Cookie Policy, and load only with your consent.

18. Consent records and retention

• Consent records. When you subscribe, we keep a record of the address, the date, and where you subscribed, for as long as you remain subscribed and for a reasonable period afterwards so that we can show that we had permission, as the law expects.
• Mailing list. We keep your address on a mailing list only while you remain subscribed.
• Do-not-email list. We keep the record described in section 10 for as long as it is needed to help avoid emailing you marketing again. If you ask us to delete it, we may explain that doing so could allow your address to be added again by mistake, and we will act on your request as the law requires.
• Copies held by providers. Copies held by our email delivery providers are kept and deleted in line with their own data handling terms, which set their own periods.

General retention rules are in our Privacy Policy and on our Data handling page.

19. Your privacy rights

You may ask us at any time to tell you what communication data we hold about you, to correct it, to delete it, or to stop using it for marketing. Email contact@wrxstack.com. We respond within the period set by the law that applies to your request: under the GDPR, one month, extendable by two further months where a request is complex or we receive many requests; under the CCPA, 45 days, extendable by a further 45 days where reasonably necessary. Where we extend, we tell you within the first period, as the law requires. Unsubscribe requests are not delayed by this period, and follow section 9. Your full rights are described in our Privacy Policy, GDPR Statement, and California Notice.

20. Children

The Service is intended for people aged 16 and over, and we do not knowingly send marketing to anyone younger. If you believe a child under 16 has subscribed to our newsletter or given us an email address, email contact@wrxstack.com and we aim to remove the address promptly.

21. No fees and no compensation

Unsubscribing, changing your preferences, reporting a suspicious message, and every other request under this Policy are free. We do not charge a fee for them, and we aim not to ask for information beyond what is needed to act on them. Nothing in this Policy, including a report of phishing, spam, or a security concern, creates any right to a payment, credit, reimbursement, reward, or compensation of any kind, for you or for us. This Policy describes how we communicate. It does not change any other right or obligation under the Terms of Service.

22. Questions and complaints

If you think we sent you a message we should not have, email contact@wrxstack.com. Please include the message, or its date and subject line, so that we can find out what happened. We aim to look into it, and we stop further marketing messages to you where you ask us to, as the law requires. We may tell you what we found.

You also have the right to complain to a regulator, and you do not have to contact us first. Depending on where you are, this may be:

• a data protection supervisory authority in the European Economic Area, in particular in the country where you live or work;
• in the United Kingdom, the Information Commissioner's Office;
• in the United States, the Federal Trade Commission, and in California, the California Privacy Protection Agency;
• in Canada, the Spam Reporting Centre.

23. Changes to this Policy

We may update this Policy to reflect changes to the Service, to the messages we send, or to the law. The effective date at the top shows the current version. We will give notice of a change where the law or the Terms require it. A change does not treat an earlier unsubscribe as withdrawn: if you unsubscribed before a change, you stay unsubscribed after it.

24. Legal effect of this Policy

This Policy explains our practices. It is not a contract, and it does not create any contractual obligation, warranty, guarantee, or right for you or for any other person. The only agreements between you and wrxstack are the Terms of Service and, where it applies, the Data Processing Addendum.

Timelines and targets in this Policy are goals we aim to meet, not guarantees, except where a law that applies to us sets a deadline, in which case we follow that law. Nothing in this Policy increases wrxstack's liability. The disclaimers, the limitation of liability, and the other protections in the Terms of Service apply to everything this Policy describes. Nothing in this Policy limits a right you have under a law that cannot be limited by agreement.

25. Contact

For any question about this Policy, to unsubscribe, or to check whether a message is genuine, email contact@wrxstack.com. Related documents: Privacy Policy, Acceptable Use Policy, Cookie Policy, Data Deletion Policy, GDPR Statement, California Notice, and Sub-processor List.