Updates to our terms

This page lists each change to the PageMax Service Agreement, the agreement law firms sign to use PageMax, from version 1.7 on, newest first. For each change, it says who it affects, when it takes effect and what changed. Firms that use PageMax receive the updated agreement from us with our notice. A firm that signs up reads the agreement in full before it signs.

A new email supplier, notice given 20 October 2026

Who it affects and when

For a firm that has signed the agreement, the change below takes effect on 21 November 2026. We give at least 30 days' written notice of a new supplier, under clause S1.6 of the agreement.

What changed

Lettermint B.V., in the Netherlands, replaces Resend (Plus Five Five, Inc.) as the supplier listed in Schedule 1, Annex B of the agreement for the emails PageMax sends. These include the alert about each new request from a firm's website, which carries the person's contact details and the brief, and the sign-in codes and alerts for a firm's PageMax accounts.

Personal data. Lettermint handles the personal data in those emails:

• The name, contact details and message of each person who sends a request through a firm's website, and the brief, which can include health details
• The email addresses of the firm's users
• The name and email address of each client a firm chooses to ask for a review, in an email sent from the firm's own email address
• Details about the delivery of each email

Where. Lettermint's data processing terms keep email data in the European Union, so no transfer outside the EEA is involved. Resend keeps its records in the United States. Each email is still delivered to the recipient's own mail server, wherever that is.

If you have a concern

If your firm has signed the agreement and has a concern about Lettermint, reply to our notice or write to legal@pagemax.co by 20 November 2026. We will not use Lettermint for your firm, and nothing else about its service changes. Your firm's rights under its agreement to object to a new supplier, and to end the agreement if an objection is not resolved (clause S1.6), are not affected.

Service Agreement version 1.7, published 14 October 2026

Who it affects and when

For a firm that signs the agreement from 14 October 2026, version 1.7 applies from the day it signs.

For a firm that signed an earlier version, the change below takes effect on 14 December 2026. We give at least 60 days' written notice of a change like this, under clause 11.5 of the agreement.

What changed

Twilio Ireland Limited joins the suppliers listed in Schedule 1, Annex B of the agreement. It provides telephone and text message services for recorded calls only, and recorded calls are optional. Twilio Ireland Limited is the Twilio company we contract with, and Twilio Inc., in the United States, works for it as its sub-processor. Twilio also uses sub-processors of its own, which it lists on its website, and it gives at least 30 days' notice of a new infrastructure provider and at least 10 days' notice of any other.

Where. We use Twilio's Ireland region, in Dublin. Twilio says that in this region it stores and processes call content, which in its terms includes recordings and call logs, in Ireland, except where it needs to investigate fraud and abuse, and that it processes all other data about our account and our use of its services in the United States. Twilio also says it does not yet guarantee that all data stays in the region chosen, so we treat the record of each call, with both phone numbers, as processed in the United States as well. A call made to a firm through PageMax may be handled in Twilio's United States region.

Personal data. Twilio handles:

• The mobile numbers of the firm's users who place calls, and the texts sent to verify those numbers
• The phone numbers of the people called
• The content of each call, and its recording until we delete it at Twilio, which can include anything said, including health details, details of a criminal matter and people's names
• The record of each call: both phone numbers, and its time, length and outcome
• Twilio's own logs about each call, which include phone numbers
• The phone numbers of people who call a firm through PageMax

How long. We delete each recording at Twilio soon after the call. A recording still there 7 days after the call is deleted by our daily job, unless an open data access request requires it to be kept. Any recording kept for a firm is held only in the EU. Twilio says a deleted recording may take up to 30 days to be removed from all its systems, and it keeps details about a deleted recording for 40 days. Twilio keeps call records, texts and its logs for its own retention periods, and we do not delete call records at Twilio.

Twilio's own uses, including AI training. Twilio's data protection addendum (last updated 9 April 2026; sections 3.3 and 3.4) makes Twilio an independent controller, for some purposes of its own, of call content, including recordings, and of the record of each call. These purposes include preventing, finding and investigating abuse of its services, including by training its own tools and models for that purpose; keeping its platform secure; helping telephone companies, regulators and law enforcement fight spam, fraud and illegal activity; meeting its legal obligations; developing and improving its products and services; and, for call content, business analytics, reporting and planning, and product strategy. Twilio says that, where reasonably necessary, it minimises, anonymises or aggregates the data it uses for these purposes. Its addendum also allows other uses, so this list is not complete. We have not obtained an exclusion of any of these uses for our account. So our promise that suppliers do not train AI on a firm's data now has Twilio as its one exception. These uses are also an exception to the agreement's confidentiality and privilege paragraph, and under the agreement a firm's authorisation of Twilio on these terms is its written instruction for them.

Transfers outside the EEA. Twilio's data protection addendum applies one safeguard, in this order: the EU-US Data Privacy Framework, under which Twilio says Twilio Inc. is self-certified; for any other Twilio company outside the EEA, or if that certification lapses, Twilio's binding corporate rules; and otherwise the EU's Standard Contractual Clauses.

Other changes. In version 1.7, clauses 8.3, S1.5(k) and S1.6(c), and the AI safeguards in Schedule 1, Annex C, name Twilio's entry as the one exception to the promise on AI training, and clause S1.7 and the opening of Annex B add binding corporate rules to the transfer safeguards. Version 1.7 also shortens the entry in Annex B for one other supplier. And Schedule 1, Annex A, which sets out the personal data we process, now also lists recordings of calls, meetings and dictation, the text, summaries and draft file notes and letters made from them, and how long they are kept; call records and the mobile numbers of users who place calls; and the people a firm's users call or record, and the people who call a firm, through PageMax. For a firm on an earlier version, Twilio's entry is the same exception to the matching parts of its agreement (the promise on AI training, the duty to bind suppliers to it, the confidentiality and privilege paragraph and the AI safeguards), and binding corporate rules join its list of transfer safeguards.

If you have a concern

If your firm signed an earlier version and has a concern about Twilio, reply to our notice or write to legal@pagemax.co before 14 December 2026. We will not use Twilio for your firm, so recorded calls stay off for it, and nothing else about its service changes. Your firm's rights under its agreement to object to a new supplier and to end the agreement over a change (clauses S1.6 and 11.5) are not affected.