Effective 17 October 2026. Last updated 17 October 2026.

Terms of Service

Purpose

These Terms of Service govern the use of the mintfax service by any customer who registers an account, purchases credits, or sends a fax through the service.

Scope

These terms form a contract between:

• The customer, meaning the legal person that registers an account and, where applicable, the individuals authorised to use it on that person’s behalf; and
• mintfax, meaning Ediblesites Ltd, a company registered in England and Wales, company number 12109195, with its registered office at 71-75 Shelton Street, London WC2H 9JQ, United Kingdom.

The service is a business-to-business developer service. Customers are expected to be organisations integrating the mintfax API or dashboard into their own products, operations, or clinical workflows.

Business customers. These terms are directed at business customers acting for purposes relating to their trade, business, or profession. The service is not available to consumers. Nothing in these terms affects any statutory right that cannot be excluded or limited by contract.

These terms apply together with any Business Associate Agreement (BAA) or Data Processing Addendum (DPA) executed between the customer and mintfax through the dashboard. The BAA, the DPA, and these terms operate as separate documents; see §20 (Miscellaneous) for the order of precedence.

Definitions

Account means the top-level record that owns credits, API keys, environments, and executed compliance contracts (BAA, DPA).

Credits means the prepaid units held on the account and consumed at the per-page price in §7 when a fax is delivered.

Environment means a mintfax API environment. Every account has a sandbox environment and, once activated, a live environment. Settings such as retention windows and zero-footprint mode are configured per environment.

PHI means Protected Health Information as that term is used in the HIPAA Privacy Rule; where the customer has executed the BAA, PHI is the subset of customer content that the BAA governs.

Service means the mintfax fax service described in §5, including the API, the dashboard, the webhook delivery mechanism, the sandbox and live environments, and the compliance documents mintfax makes available in the dashboard.

1. Legal entity and operating identity

The service is provided by Ediblesites Ltd, a company registered in England and Wales, company number 12109195, with registered office at 71-75 Shelton Street, London WC2H 9JQ, United Kingdom. “mintfax” is the trading name for the service. Legal notices to mintfax are given as stated in §20.

2. Interpretation

References to a numbered section are references to a section of these terms. References to the BAA or the DPA are to the current versions of those documents as accepted by the customer through the dashboard. References to the Data Retention Policy, the Privacy Policy, the sub-processor list, and the compliance overview are to those pages on mintfax.com as updated from time to time.

3. Acceptance and account eligibility

The customer accepts these terms by registering an account, by purchasing credits, or by using the service. Only a person with authority to bind the customer organisation may register an account or accept the BAA or DPA on the customer’s behalf.

4. Effective date

These terms take effect for a customer on the effective date shown at the top of this page or on the customer’s first use of the service, whichever is later. The most recent version is always the version published at /legal/terms.

Versioning. These terms are versioned by date. The effective date and the last-updated date shown at the top of this page identify the version in force. Prior versions are available on request to [email protected]. The BAA and the DPA carry their own versions, as stated in those documents.

5. The service

mintfax is a developer-first fax service. The service sends outbound faxes over the public switched telephone network. Faxes are submitted to mintfax over an HTTPS API and available for management through a browser-based dashboard.

The service sends faxes only. It does not receive inbound faxes, deliver faxes to email, provision dedicated numbers, or port numbers. The service is available globally wherever destination coverage exists; specific country coverage is not enumerated in these terms and may change over time.

Faxes are submitted through the POST /faxes endpoint as a multipart upload up to 10 MB per request. Destination fax numbers must include a leading + and the country code; see the international reference.

The authoritative API contract, including the endpoint list, request and response schemas, error codes, and pagination conventions, is the OpenAPI specification published under the mintfax developer documentation; see the errors reference and the authentication reference for entry points. mintfax uses cursor-based pagination for all list endpoints.

6. Account, activation, and authentication

Registration. Accounts are created through POST /account/register followed by POST /account/register/verify, where the customer supplies a six-digit verification code sent to the registration email address.

Environments. Every account has a sandbox environment, which is active from the moment the account is verified. Access to the live environment is gated on the first successful purchase of live credits; the account is marked activated when that first purchase completes.

API keys. Authentication uses opaque bearer API keys carried in the Authorization header. Keys use three self-identifying prefixes:

• mfx_test_ for sandbox environment keys;
• mfx_live_ for live environment keys;
• mfx_acct_ for account-scoped keys used for account-administration operations.

API keys do not automatically expire and do not carry per-resource permission scopes. Rotation and revocation are actions the customer takes through the dashboard.

Key security. The customer is responsible for the security of API keys issued to it, including limiting their distribution inside the customer organisation, storing them in appropriate secret-management systems, rotating them on personnel changes, and revoking them if compromise is suspected. A key is presumed authorised until it is revoked in the dashboard. The customer will notify mintfax at [email protected] on suspected compromise of any API key.

7. Charges and payment

Prepaid credit model. The service is prepaid. The customer purchases credits before use. When a fax is submitted, credits are held against the account balance; when the fax is delivered, the hold is captured; when the fax fails permanently, the hold is released and no charge is taken.

Credit pooling. Credits pool at the account level. Each account carries one sandbox credit pool and one live credit pool. Credits are not transferable between accounts.

Per-page pricing. Charges are per page, at one price per page for every destination. The current price per page and the current credit packages are published at mintfax.com/pricing and may change on notice.

Failed faxes. Where a fax is not accepted by the receiving carrier, the credit hold is released. No charge is taken in that case.

Payment processing. Payments are processed by Stripe. The service accepts Visa, Mastercard, American Express, and Discover cards.

Auto top-up. Auto top-up is an opt-in setting configured per credit pool. When enabled, and when the balance in that pool falls below mintfax’s 20 per cent depletion threshold, mintfax charges the customer’s saved payment method for the top-up package amount and adds those credits to the pool. Auto top-up can be disabled at any time in the dashboard.

No subscription or minimums. There is no monthly subscription, no seat licensing, no minimum monthly commitment, no setup fee, and no long-term contractual commitment tied to the service. Every feature of the service is available on every mintfax account regardless of volume. There is no feature-tier gating and no separate enterprise tier.

8. Customer responsibilities and acceptable use

The customer is responsible for the content it submits to the service, for compliance with laws applicable to that content (including telecommunications, junk-fax, marketing-communication, healthcare-privacy, financial-privacy, and export-control laws), and for obtaining any consents required from recipients before sending a fax through the service.

Acceptable use. The customer will not use the service, and will not permit any person to use the service, to:

• send unsolicited fax advertisements, or any fax that breaches the US Telephone Consumer Protection Act or any comparable law of another jurisdiction governing fax or electronic marketing;
• send content that is unlawful, fraudulent, or defamatory, or that infringes the rights of any person;
• send content that the rules of an upstream telecommunications carrier prohibit;
• interfere with or disrupt the service, or the networks and systems used to provide it;
• circumvent authentication, rate limits, or any other technical limit or control of the service; or
• send malware, phishing content, or any content designed to obtain credentials or information by deception.

The customer is responsible for every fax sent with its API keys or through its dashboard account, whether or not the customer authorised the individual fax.

Export controls and sanctions. The customer warrants that neither it nor any person who owns or controls it is the subject of sanctions administered by the US Office of Foreign Assets Control (OFAC), HM Treasury and the UK Office of Financial Sanctions Implementation (OFSI), or the European Union. The customer will not use the service to send content to any person or destination where the sanctions status of that person or destination would make sending it unlawful. The customer will notify mintfax promptly if either statement ceases to be true.

9. Data protection, security, and compliance

Encryption at rest. Fax content is encrypted at rest using AES-256, implemented as SSE-KMS with mintfax-managed AWS KMS customer master keys. One customer master key is used per environment, with KMS automatic rotation enabled.

Encryption in transit. All customer traffic to and from the service uses TLS 1.2 as a minimum. Webhook endpoints registered with the http:// scheme are rejected at registration.

Data residency. All customer PHI content and operational metadata is stored in a single US AWS region. The specific region is named in the sub-processor list. The DPA commits mintfax to advance notice of any regional change and to customer region selection when additional regions become available.

BAA availability. A Business Associate Agreement is available to every mintfax customer through a self-serve click-through workflow in the dashboard. Acceptance writes a durable evidence record on the account and produces an executed PDF that the customer can download immediately.

DPA availability. A Data Processing Addendum covering obligations under the EU General Data Protection Regulation, UK General Data Protection Regulation, and Brazilian Lei Geral de Proteção de Dados is available to every mintfax customer through the same self-serve path. The BAA and the DPA are separate documents and are independently accepted.

HIPAA compliance. mintfax operates under a BAA with customers who accept it and offers a DPA covering GDPR, UK GDPR, and LGPD obligations. HIPAA compliance is a shared responsibility of the customer and mintfax and is governed by the BAA between them.

Certifications. mintfax is not certified under SOC 2, ISO 27001, HITRUST, FedRAMP, or PCI DSS Level 1.

Retention. PHI retention defaults to the period stated in the Data Retention Policy, counted from the time a fax is delivered or fails permanently. The customer may set the retention period for each environment to any number of days between 7 and 365. Each environment also has a zero-footprint toggle. When it is on, PHI content is scrubbed as soon as a fax is delivered or fails permanently; operational metadata is preserved so that the fax record remains queryable. Full retention detail is in the Data Retention Policy.

On-demand deletion. A customer may purge any individual fax that has reached a terminal state (delivered or failed) by calling DELETE /v1/faxes/{fax}. The purge scrubs the content of that fax immediately, independent of the environment-wide retention window. The fax record is retained, in scrubbed form, so that billing and audit history stay intact.

Audit stream. mintfax retains the customer-visible audit stream, which records PHI access events and mintfax personnel access to customer content in support tooling, for six years from row creation, per HIPAA Privacy Rule 45 CFR 164.530(j)(2). This retention period is fixed and is not customer-configurable.

Billing records. Billing records are retained permanently regardless of the environment’s retention mode.

Compliance boundary. The security, encryption, retention, and audit commitments in this section cover mintfax’s own systems: the API, content storage, operational databases, and application logs. They do not cover upstream telecommunications carriers, recipient fax infrastructure, developer-owned webhook endpoints, or third-party payment processors.

The DPA as the operative data-processing contract. Where the customer has accepted the DPA, the DPA is the operative contract for the processing of personal data under the EU General Data Protection Regulation, the UK General Data Protection Regulation, and the Lei Geral de Proteção de Dados. These terms do not restate the DPA. Where the customer has accepted the BAA, the BAA governs PHI.

10. Subprocessors

The current list of subprocessors mintfax uses to provide the service is published on the sub-processor page, which is the canonical source for that list.

Change notice. Changes to the primary subprocessor list are announced with at least 14 days advance notice through email to the account admin address on file, through a banner in the dashboard, through an Atom feed, and by updating the public page.

Standby subprocessors. The subprocessor page carries a “standby” section pre-disclosing candidates that may be activated on short notice, for example to maintain service continuity in the event of a primary subprocessor incident. Activation of a standby subprocessor already listed on the page does not require additional notice.

Right to object. A right to object to a new primary subprocessor, exercisable within the 14-day notice window, is encoded in the DPA under GDPR Article 28(2).

The DPA as the operative sub-processing contract. This section is a summary. The substantive sub-processor mechanism, including the scope of sub-processing, the restrictions that apply to sub-processors, and the remedy where an objection cannot be resolved, is set out in the DPA, and the DPA controls.

11. Webhooks and event delivery

mintfax emits events (for example fax.delivered, fax.failed) to HTTPS endpoints the customer registers in the dashboard. Delivery uses the Standard Webhooks specification, published at standardwebhooks.com.

Each event is signed with HMAC-SHA256 using a per-endpoint signing secret. Delivery carries three headers used to verify the signature: webhook-id, webhook-timestamp, and webhook-signature. The signing procedure and verification procedure are described in the Standard Webhooks specification and in the mintfax webhook documentation.

Delivery retries a failed attempt three times with exponential backoff at 10 seconds, 60 seconds, and 300 seconds from the failed attempt, with a 30-second per-attempt request timeout. After the third failed retry, the attempt appears in the recent-attempts panel for the endpoint in the dashboard, where it can be manually retried.

12. Fax delivery and retries

The service attempts each fax and applies automatic retries with backoff on transient carrier errors. The default is three attempts per fax; the customer may set max_attempts per fax to any integer between one and five.

No uptime SLA or delivery-time guarantee. These terms do not carry an uptime service-level agreement and do not carry a delivery-time guarantee. Fax delivery timing depends on the receiving line, the destination carrier, and other factors outside mintfax’s compliance boundary as described in §9.

13. Support

Customer support and account questions are handled at [email protected].

Compliance, security-questionnaire, BAA, DPA, and subprocessor-objection questions are handled at [email protected], with a one-business-day response SLA.

14. Suspension, termination, and account closure

Suspension or termination by mintfax. mintfax may suspend or terminate an account for material breach of these terms, for use of the service in violation of the acceptable-use provisions in §8, or for non-payment.

Triggers. mintfax may suspend or terminate the customer’s account if:

• the customer commits a material breach of these terms;
• the customer fails to pay any amount when due;
• the customer uses the service in breach of the acceptable-use provisions in §8;
• the customer becomes insolvent, enters administration, liquidation, or any comparable procedure, or ceases to carry on business; or
• a court, regulator, or other competent authority orders or requires mintfax to do so.

Notice and cure. mintfax gives notice of suspension or termination by email to the account admin address on file. Where a material breach is capable of remedy, mintfax will not terminate for that breach unless the customer has failed to remedy it within 30 days of that notice.

Immediate suspension. mintfax may suspend the account immediately, with notice given as soon as practicable afterwards, where it reasonably believes that the customer is using the service in breach of the acceptable-use provisions in §8, that the account presents a security risk to the service or to other customers, or that a court, regulator, or other competent authority requires suspension. mintfax will lift a suspension once the cause has been resolved.

Effect on credits. During suspension, mintfax may refuse to accept new faxes from the account. Charges and credits continue to be handled as stated in §7: the hold is captured only when a fax is delivered, and the hold is released for a fax that fails permanently.

Effect on data. Suspension and termination do not change the retention windows in §9. On termination, the customer’s data is handled as stated below for account closure.

Closure by the customer. The customer may close its account at any time by writing to [email protected].

Effect of closure on data. On account closure, PHI content is scrubbed in accordance with the retention policy in effect for the account (see §9 and the Data Retention Policy). Billing records are retained per the billing-records paragraph in §9. Audit-stream retention is unchanged.

15. Warranties

Disclaimer. To the extent permitted by applicable law, and subject to any statutory warranty or condition that cannot lawfully be excluded, the service is provided as is. mintfax excludes all warranties, conditions, and terms implied by statute, common law, or otherwise, including any implied warranty or condition of merchantability, satisfactory quality, fitness for a particular purpose, or non-infringement.

16. Limitation of liability

Cap. Subject to the exclusions below, the total aggregate liability of each party to the other arising under or in connection with these terms, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, is limited to the fees paid to mintfax by the customer in the 12 months preceding the event giving rise to the claim.

Exclusions from the cap. The cap does not apply to:

• a party’s indemnification obligations under §17;
• a party’s breach of confidentiality;
• a party’s infringement of the other party’s intellectual property rights;
• a party’s gross negligence or wilful misconduct; or
• any liability that cannot lawfully be limited or excluded, including liability for death or personal injury caused by negligence, and liability for fraud or fraudulent misrepresentation.

17. Indemnification

By mintfax. mintfax will defend the customer against any claim by a third party alleging that the service, as delivered by mintfax, infringes that third party’s intellectual property rights, and will indemnify the customer against the damages and costs finally awarded, or agreed in a settlement mintfax has approved, in respect of that claim. This indemnity does not apply to any claim arising from customer content, from the customer’s modification of the service, or from the customer’s combination of the service with anything mintfax did not supply.

By the customer. The customer will defend mintfax against any claim by a third party arising from customer content, or from the customer’s use of the service in breach of these terms or of applicable law, and will indemnify mintfax against the damages and costs finally awarded, or agreed in a settlement the customer has approved, in respect of that claim.

Procedure. The party seeking indemnity will notify the indemnifying party of the claim in writing promptly after becoming aware of it, give the indemnifying party sole control of the defence and settlement of the claim, and provide reasonable cooperation at the indemnifying party’s expense. A delay in notice relieves the indemnifying party of its obligations only to the extent the delay prejudices the defence. The indemnifying party will not settle any claim in a way that admits fault on behalf of, or imposes any obligation on, the indemnified party without that party’s prior written consent, which will not be unreasonably withheld.

18. Governing law and dispute resolution

Governing law. These terms, and any dispute or claim (including any non-contractual dispute or claim) arising out of or in connection with them or their subject matter, are governed by the law of England and Wales.

Jurisdiction. The courts of England and Wales have exclusive jurisdiction to settle any such dispute or claim.

Dispute resolution. Any dispute or claim is resolved in the courts named above. These terms do not contain an arbitration agreement or a class-action waiver.

19. Changes to these terms

Notice of changes. mintfax may change these terms. mintfax gives notice of a material change through the dashboard and by email to the account admin address on file at least 30 days before the change takes effect. The notice states the date on which the change takes effect.

Acceptance. Continued use of the service after the date on which a change takes effect is acceptance of the changed terms. A customer that does not accept a change may close its account under §14 before that date.

The BAA and the DPA. Changes to the BAA and the DPA follow the terms of those documents.

20. Miscellaneous

Order of precedence. If these terms conflict with the BAA or the DPA, the BAA controls in respect of PHI, the DPA controls in respect of personal data within the scope of the EU General Data Protection Regulation, the UK General Data Protection Regulation, and the Lei Geral de Proteção de Dados, and these terms govern all other subject matter.

Notices. Legal notices to mintfax are given in writing to the registered office of Ediblesites Ltd stated in §1. The customer may also send a copy to [email protected]. Notices to the customer are given by email to the account admin address on file. A notice sent by email is treated as received on the business day after it is sent. The customer is responsible for keeping the account admin address current.

Force majeure. Neither party is liable for any failure or delay in performing its obligations under these terms (other than an obligation to pay) to the extent caused by an event beyond its reasonable control. Such events include outages, faults, or restrictions affecting upstream telecommunications carriers, the public switched telephone network, or recipient fax infrastructure, all of which sit outside the compliance boundary described in §9, as well as natural disaster, fire, flood, pandemic, war, terrorism, civil unrest, governmental action, and failure of public utilities or internet infrastructure. The affected party will notify the other party of the event and use reasonable efforts to limit its effect.

Entire agreement. These terms, together with the BAA and the DPA where the customer has accepted them, constitute the entire agreement between the customer and mintfax relating to the service, and supersede any prior order, statement of work, proposal, or understanding on that subject. Each party acknowledges that it has not relied on any statement, representation, or warranty not set out in these documents. Nothing in this section limits or excludes liability for fraud or fraudulent misrepresentation.

Third-party rights. A person who is not a party to these terms has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce any of these terms.

Assignment. The customer may not assign, transfer, or otherwise deal with any of its rights or obligations under these terms without mintfax’s prior written consent. mintfax may assign these terms to an affiliate, or to a successor in connection with a merger, acquisition, reorganisation, or sale of all or substantially all of its assets, on notice to the customer.

Related documents

• Data Retention Policy
• Privacy Policy
• Sub-processor list
• Compliance overview
• HIPAA overview
• GDPR overview
• Data Retention API reference
• HIPAA developer guide
• PCI DSS developer guide
• Authentication reference
• Errors reference

Contact

For questions about these terms, contact [email protected] for compliance, security-questionnaire, BAA, DPA, and subprocessor-objection matters, or [email protected] for account and billing matters.