Merge pull request #291 from useplunk/release-please--branches--next--components--plunk

chore(next): release 0.6.0

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.5.0"
+  ".": "0.6.0"
 }

CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## [0.6.0](https://github.com/useplunk/plunk/compare/v0.5.0...v0.6.0) (2026-02-19)
+
+
+### Features
+
+* Ability to change workflow trigger ([eec37ec](https://github.com/useplunk/plunk/commit/eec37ecb31c63888879a1933dba4fd0c6243018b))
+* Add billing for inbound ([3330d83](https://github.com/useplunk/plunk/commit/3330d83d08904bc547740bfc9fdcbc5ff214d977))
+* Add billing for inbound ([de7ed84](https://github.com/useplunk/plunk/commit/de7ed84fcfddde16a9297c947048e9876712f6fa))
+* Add dedicated received type ([f947ee6](https://github.com/useplunk/plunk/commit/f947ee6f22371055801fa9cfc62e15df7851986c))
+* **i18n:** Add Spanish language ([9c69c7a](https://github.com/useplunk/plunk/commit/9c69c7a36edd86fdc02b8d0d3e3f8d64ed8ecfa6))
+
+
+### Bug Fixes
+
+* Enhance email bounce notification with latest bounce details ([e639c72](https://github.com/useplunk/plunk/commit/e639c72e8b940ba1da472d355f930359da7c868b))
+
+
+### Documentation
+
+* Add receiving emails functionality and update DNS records documentation ([b426986](https://github.com/useplunk/plunk/commit/b42698616a3f7bb079a092375ac886f2a9d7405d))
+
 ## [0.5.0](https://github.com/useplunk/plunk/compare/v0.4.0...v0.5.0) (2026-02-17)
 
 

apps/api/src/controllers/Contacts.ts

@@ -315,6 +315,7 @@ export class Contacts {
   @Middleware([requireAuth, requireEmailVerified])
   @CatchAsync
   public async getImportStatus(req: Request, res: Response, _next: NextFunction) {
+    const auth = res.locals.auth;
     const jobId = req.params.jobId;
 
     if (!jobId) {
@@ -322,7 +323,7 @@ export class Contacts {
     }
 
     try {
-      const status = await QueueService.getImportJobStatus(jobId);
+      const status = await QueueService.getImportJobStatus(jobId, auth.projectId!);
 
       if (!status) {
         return res.status(404).json({error: 'Import job not found'});
@@ -502,6 +503,7 @@ export class Contacts {
   @Middleware([requireAuth, requireEmailVerified])
   @CatchAsync
   public async getBulkActionStatus(req: Request, res: Response, _next: NextFunction) {
+    const auth = res.locals.auth;
     const jobId = req.params.jobId;
 
     if (!jobId) {
@@ -509,7 +511,7 @@ export class Contacts {
     }
 
     try {
-      const status = await QueueService.getBulkActionJobStatus(jobId);
+      const status = await QueueService.getBulkActionJobStatus(jobId, auth.projectId!);
 
       if (!status) {
         return res.status(404).json({error: 'Bulk action job not found'});

apps/api/src/controllers/Users.ts

@@ -330,6 +330,7 @@ export class Users {
         billingLimitWorkflows: true,
         billingLimitCampaigns: true,
         billingLimitTransactional: true,
+        billingLimitInbound: true,
       },
     });
 
@@ -349,6 +350,7 @@ export class Users {
         billingLimitWorkflows: data.workflows,
         billingLimitCampaigns: data.campaigns,
         billingLimitTransactional: data.transactional,
+        billingLimitInbound: data.inbound,
       },
     });
 
@@ -360,6 +362,7 @@ export class Users {
         workflows: project.billingLimitWorkflows,
         campaigns: project.billingLimitCampaigns,
         transactional: project.billingLimitTransactional,
+        inbound: project.billingLimitInbound,
       },
       data,
     );

apps/api/src/controllers/Webhooks.ts

@@ -1,6 +1,6 @@
 import {Controller, Post} from '@overnightjs/core';
 import type {Prisma} from '@plunk/db';
-import {EmailStatus} from '@plunk/db';
+import {EmailSourceType, EmailStatus} from '@plunk/db';
 import type {Request, Response} from 'express';
 import signale from 'signale';
 import type Stripe from 'stripe';
@@ -8,8 +8,10 @@ import type Stripe from 'stripe';
 import {STRIPE_ENABLED, STRIPE_WEBHOOK_SECRET} from '../app/constants.js';
 import {stripe} from '../app/stripe.js';
 import {prisma} from '../database/prisma.js';
+import {BillingLimitService} from '../services/BillingLimitService.js';
 import {ContactService} from '../services/ContactService.js';
 import {EventService} from '../services/EventService.js';
+import {MeterService} from '../services/MeterService.js';
 import {NtfyService} from '../services/NtfyService.js';
 import {SecurityService} from '../services/SecurityService.js';
 import {CatchAsync} from '../utils/asyncHandler.js';
@@ -122,6 +124,16 @@ export class Webhooks {
             for (const domainRecord of domainRecords) {
               signale.info(`[WEBHOOK] Processing inbound email for project: ${domainRecord.project.name}`);
 
+              // Check billing limits before processing inbound email
+              const limitCheck = await BillingLimitService.checkLimit(domainRecord.projectId, EmailSourceType.INBOUND);
+
+              if (!limitCheck.allowed) {
+                signale.warn(
+                  `[WEBHOOK] Inbound email blocked for project ${domainRecord.project.name}: ${limitCheck.message}`,
+                );
+                continue; // Skip this project but continue processing for other projects
+              }
+
               // Find or create a contact for the sender in this project
               let contact;
               if (senderEmail) {
@@ -133,6 +145,32 @@ export class Webhooks {
                 );
               }
 
+              // Create an Email record for tracking (no actual email content since it's inbound)
+              const inboundEmail = await prisma.email.create({
+                data: {
+                  projectId: domainRecord.projectId,
+                  contactId: contact!.id,
+                  subject: body.mail?.commonHeaders?.subject || '(No subject)',
+                  body: '', // Inbound emails don't have body content in our system
+                  from: recipientEmail, // The recipient address that received the email
+                  sourceType: EmailSourceType.INBOUND,
+                  status: EmailStatus.RECEIVED, // Inbound emails use RECEIVED status
+                  deliveredAt: new Date(body.mail?.timestamp || new Date()),
+                },
+              });
+
+              // Increment usage counter in cache
+              await BillingLimitService.incrementUsage(domainRecord.projectId, EmailSourceType.INBOUND);
+
+              // Record Stripe metering if project has customer
+              if (domainRecord.project.customer) {
+                await MeterService.recordEmailSent(
+                  domainRecord.project.customer,
+                  1, // Inbound emails count as 1 credit
+                  `email_${inboundEmail.id}`,
+                );
+              }
+
               // Prepare event data with all inbound email details
               const eventData = {
                 messageId: body.mail?.messageId,
@@ -158,7 +196,7 @@ export class Webhooks {
                 domainRecord.projectId,
                 'email.received',
                 contact?.id,
-                undefined, // No emailId for inbound emails (they're not sent by us)
+                inboundEmail.id, // Link the event to the inbound email record
                 eventData,
               );
 

apps/api/src/services/ActivityService.ts

@@ -376,6 +376,9 @@ export class ActivityService {
     if (!types || types.includes(ActivityType.EMAIL_DELIVERED)) {
       orConditions.push({deliveredAt: {not: null, ...dateFilter}});
     }
+    if (!types || types.includes(ActivityType.EMAIL_RECEIVED)) {
+      orConditions.push({deliveredAt: {not: null, ...dateFilter}, sourceType: 'INBOUND'});
+    }
     if (!types || types.includes(ActivityType.EMAIL_OPENED)) {
       orConditions.push({openedAt: {not: null, ...dateFilter}});
     }
@@ -485,6 +488,22 @@ export class ActivityService {
         });
       }
 
+      if (
+        email.deliveredAt &&
+        email.sourceType === 'INBOUND' &&
+        (!types || types.includes(ActivityType.EMAIL_RECEIVED)) &&
+        isInDateRange(email.deliveredAt)
+      ) {
+        activities.push({
+          id: `${email.id}_received`,
+          type: ActivityType.EMAIL_RECEIVED,
+          timestamp: email.deliveredAt,
+          contactEmail: email.contact.email,
+          contactId: email.contactId,
+          metadata: baseMetadata,
+        });
+      }
+
       if (email.openedAt && (!types || types.includes(ActivityType.EMAIL_OPENED)) && isInDateRange(email.openedAt)) {
         activities.push({
           id: `${email.id}_opened`,

apps/api/src/services/BillingLimitService.ts

@@ -157,6 +157,7 @@ export class BillingLimitService {
           billingLimitWorkflows: true,
           billingLimitCampaigns: true,
           billingLimitTransactional: true,
+          billingLimitInbound: true,
         },
       });
 
@@ -183,6 +184,9 @@ export class BillingLimitService {
         case EmailSourceType.TRANSACTIONAL:
           limit = project.billingLimitTransactional;
           break;
+        case EmailSourceType.INBOUND:
+          limit = project.billingLimitInbound;
+          break;
         default:
           limit = null;
       }
@@ -191,7 +195,8 @@ export class BillingLimitService {
       const hasCustomLimits =
         project.billingLimitWorkflows !== null ||
         project.billingLimitCampaigns !== null ||
-        project.billingLimitTransactional !== null;
+        project.billingLimitTransactional !== null ||
+        project.billingLimitInbound !== null;
 
       // Free tier projects (no subscription and no custom limits): enforce total 1000 email/month limit
       // Only enforce free tier limits if billing is enabled
@@ -368,6 +373,7 @@ export class BillingLimitService {
           billingLimitWorkflows: true,
           billingLimitCampaigns: true,
           billingLimitTransactional: true,
+          billingLimitInbound: true,
         },
       });
 
@@ -390,10 +396,11 @@ export class BillingLimitService {
       }
 
       // Get usage for all categories in parallel
-      const [workflowUsage, campaignUsage, transactionalUsage] = await Promise.all([
+      const [workflowUsage, campaignUsage, transactionalUsage, inboundUsage] = await Promise.all([
         this.getUsage(projectId, EmailSourceType.WORKFLOW),
         this.getUsage(projectId, EmailSourceType.CAMPAIGN),
         this.getUsage(projectId, EmailSourceType.TRANSACTIONAL),
+        this.getUsage(projectId, EmailSourceType.INBOUND),
       ]);
 
       // Helper to calculate category usage
@@ -412,18 +419,19 @@ export class BillingLimitService {
       const hasCustomLimits =
         project.billingLimitWorkflows !== null ||
         project.billingLimitCampaigns !== null ||
-        project.billingLimitTransactional !== null;
+        project.billingLimitTransactional !== null ||
+        project.billingLimitInbound !== null;
 
       // Free tier projects (no subscription and no custom limits): show total usage with shared limit
       // Only show free tier limits if billing is enabled
       if (STRIPE_ENABLED && !project.subscription && !hasCustomLimits) {
-        const totalUsage = workflowUsage + campaignUsage + transactionalUsage;
+        const totalUsage = workflowUsage + campaignUsage + transactionalUsage + inboundUsage;
         const limit = this.FREE_TIER_TOTAL_LIMIT;
         const percentage = (totalUsage / limit) * 100;
         const isWarning = percentage >= this.WARNING_THRESHOLD * 100;
         const isBlocked = totalUsage >= limit;
 
-        // For free tier, show the same limit and total usage for all three categories
+        // For free tier, show the same limit and total usage for all four categories
         // This makes it clear in the UI that it's a shared limit
         const sharedUsageInfo: CategoryUsage = {
           limit,
@@ -437,6 +445,7 @@ export class BillingLimitService {
           workflows: sharedUsageInfo,
           campaigns: sharedUsageInfo,
           transactional: sharedUsageInfo,
+          inbound: sharedUsageInfo,
           currency,
         };
       }
@@ -446,6 +455,7 @@ export class BillingLimitService {
         workflows: calculateCategoryUsage(workflowUsage, project.billingLimitWorkflows),
         campaigns: calculateCategoryUsage(campaignUsage, project.billingLimitCampaigns),
         transactional: calculateCategoryUsage(transactionalUsage, project.billingLimitTransactional),
+        inbound: calculateCategoryUsage(inboundUsage, project.billingLimitInbound),
         currency,
       };
     } catch (error) {
@@ -470,6 +480,7 @@ export class BillingLimitService {
         this.getCacheKey(projectId, EmailSourceType.WORKFLOW),
         this.getCacheKey(projectId, EmailSourceType.CAMPAIGN),
         this.getCacheKey(projectId, EmailSourceType.TRANSACTIONAL),
+        this.getCacheKey(projectId, EmailSourceType.INBOUND),
       ];
 
       await Promise.all(keys.map(key => redis.del(key)));
@@ -493,11 +504,13 @@ export class BillingLimitService {
       workflows: number | null;
       campaigns: number | null;
       transactional: number | null;
+      inbound: number | null;
     },
     newLimits: {
       workflows: number | null;
       campaigns: number | null;
       transactional: number | null;
+      inbound: number | null;
     },
   ): Promise<void> {
     try {
@@ -531,6 +544,14 @@ export class BillingLimitService {
         );
       }
 
+      // Check inbound limit
+      if (oldLimits.inbound !== newLimits.inbound) {
+        keysToDelete.push(
+          Keys.Billing.warningEmail(projectId, EmailSourceType.INBOUND, year, month),
+          Keys.Billing.limitEmail(projectId, EmailSourceType.INBOUND, year, month),
+        );
+      }
+
       if (keysToDelete.length > 0) {
         await Promise.all(keysToDelete.map(key => redis.del(key)));
         signale.debug(

apps/api/src/services/EmailService.ts

@@ -585,10 +585,11 @@ export class EmailService {
         : {}),
     };
 
-    const [total, sent, delivered, opened, clicked, bounced, failed] = await Promise.all([
+    const [total, sent, delivered, received, opened, clicked, bounced, failed] = await Promise.all([
       prisma.email.count({where}),
       prisma.email.count({where: {...where, status: EmailStatus.SENT}}),
       prisma.email.count({where: {...where, status: EmailStatus.DELIVERED}}),
+      prisma.email.count({where: {...where, status: EmailStatus.RECEIVED}}),
       prisma.email.count({where: {...where, status: EmailStatus.OPENED}}),
       prisma.email.count({where: {...where, status: EmailStatus.CLICKED}}),
       prisma.email.count({where: {...where, status: EmailStatus.BOUNCED}}),
@@ -599,6 +600,7 @@ export class EmailService {
       total,
       sent,
       delivered,
+      received,
       opened,
       clicked,
       bounced,

apps/api/src/services/NtfyService.ts

@@ -229,7 +229,7 @@ export class NtfyService {
 
   /**
    * Notify about email bounce - LOW priority (high volume)
-   * Rate-limited to only send notification every 20 bounces with per-project breakdown
+   * Rate-limited to only send notification every 20 bounces with latest 20 bounce details
    */
   public static async notifyEmailBounce(
     projectName: string,
@@ -240,63 +240,51 @@ export class NtfyService {
     // Import redis at runtime to avoid circular dependencies
     const {redis} = await import('../database/redis.js');
 
-    // Use Redis counters to track bounce count globally and per-project
+    // Use Redis counters to track bounce count globally
     const globalCountKey = `ntfy:bounce:count`;
-    const projectCountKey = `ntfy:bounce:count:${projectId}`;
+    const bounceListKey = `ntfy:bounce:latest`;
-    const projectListKey = `ntfy:bounce:projects`;
 
     // Increment global counter
     const globalCount = await redis.incr(globalCountKey);
 
-    // Increment project-specific counter
+    // Store this bounce event in a list (keep latest 20)
-    await redis.incr(projectCountKey);
+    const bounceEvent = JSON.stringify({
-
+      projectName,
-    // Add project to the set of projects with bounces (for tracking)
+      projectId,
-    await redis.sadd(projectListKey, projectId);
+      recipientEmail,
+      bounceType: bounceType || 'Unknown',
+      timestamp: new Date().toISOString(),
+    });
+    await redis.lpush(bounceListKey, bounceEvent);
+    await redis.ltrim(bounceListKey, 0, 19); // Keep only latest 20
 
     // Set expiry on first increment (24 hour rolling window)
     if (globalCount === 1) {
       await redis.expire(globalCountKey, 86400);
-      await redis.expire(projectListKey, 86400);
+      await redis.expire(bounceListKey, 86400);
     }
-    // Always refresh project counter expiry to match global window
-    await redis.expire(projectCountKey, 86400);
 
     // Only send notification every 20 bounces
     if (globalCount % 20 === 0) {
-      // Get all projects with bounces
+      // Get the latest 20 bounces
-      const projectIds = await redis.smembers(projectListKey);
+      const latestBounces = await redis.lrange(bounceListKey, 0, 19);
 
-      // Get bounce counts for each project
+      // Parse and format the bounce events
-      const projectCounts: Array<{projectId: string; count: number; name: string}> = [];
+      const bounceDetails = latestBounces
-      for (const pid of projectIds) {
+        .map(bounce => {
-        const count = await redis.get(`ntfy:bounce:count:${pid}`);
+          try {
-        if (count) {
+            const parsed = JSON.parse(bounce);
-          // Fetch project name from database
+            return `  • ${parsed.recipientEmail} (${parsed.bounceType}) - ${parsed.projectName}`;
-          const {prisma} = await import('../database/prisma.js');
+          } catch {
-          const project = await prisma.project.findUnique({
+            return null;
-            where: {id: pid},
+          }
-            select: {name: true},
+        })
-          });
+        .filter(Boolean)
+        .join('\n');
 
-          projectCounts.push({
-            projectId: pid,
-            count: parseInt(count, 10),
-            name: project?.name || 'Unknown',
-          });
-        }
-      }
-
-      // Sort by count descending
-      projectCounts.sort((a, b) => b.count - a.count);
-
-      // Build breakdown message
-      const breakdown = projectCounts.map(p => `  • ${p.name} (${p.projectId}): ${p.count}`).join('\n');
-
-      const bounceInfo = bounceType ? ` (${bounceType})` : '';
       await this.send({
         title: 'Email Bounces',
-        message: `20 email bounces detected (total: ${globalCount})\n\nBreakdown by project:\n${breakdown}\n\nLatest: ${recipientEmail}${bounceInfo} in "${projectName}"`,
+        message: `20 email bounces detected (total: ${globalCount})\n\nLatest 20 bounces:\n${bounceDetails}`,
         priority: NtfyPriority.LOW,
         tags: [NtfyTag.WARNING],
       });

apps/api/src/services/QueueService.ts

@@ -282,14 +282,22 @@ export class QueueService {
 
   /**
    * Get import job status and progress
+   * @param jobId - The job ID
+   * @param projectId - The project ID to verify authorization
+   * @returns Job status or null if not found or unauthorized
    */
-  public static async getImportJobStatus(jobId: string) {
+  public static async getImportJobStatus(jobId: string, projectId: string) {
     const job = await importQueue.getJob(jobId);
 
     if (!job) {
       return null;
     }
 
+    // Security: Verify that the job belongs to the requesting project
+    if (job.data.projectId !== projectId) {
+      return null;
+    }
+
     const state = await job.getState();
     const progress = job.progress;
     const returnValue = job.returnvalue;
@@ -324,14 +332,22 @@ export class QueueService {
 
   /**
    * Get bulk action job status and progress
+   * @param jobId - The job ID
+   * @param projectId - The project ID to verify authorization
+   * @returns Job status or null if not found or unauthorized
    */
-  public static async getBulkActionJobStatus(jobId: string) {
+  public static async getBulkActionJobStatus(jobId: string, projectId: string) {
     const job = await bulkContactQueue.getJob(jobId);
 
     if (!job) {
       return null;
     }
 
+    // Security: Verify that the job belongs to the requesting project
+    if (job.data.projectId !== projectId) {
+      return null;
+    }
+
     const state = await job.getState();
     const progress = job.progress;
     const returnValue = job.returnvalue;

apps/api/src/services/WorkflowService.ts

@@ -194,25 +194,57 @@ export class WorkflowService {
       }
     }
 
-    const updateData: Prisma.WorkflowUpdateInput = {};
+    // Use transaction to update workflow and TRIGGER step atomically
+    const updated = await prisma.$transaction(async tx => {
+      const updateData: Prisma.WorkflowUpdateInput = {};
 
-    if (data.name !== undefined) updateData.name = data.name;
+      if (data.name !== undefined) updateData.name = data.name;
-    if (data.description !== undefined) updateData.description = data.description;
+      if (data.description !== undefined) updateData.description = data.description;
-    if (data.triggerType !== undefined) updateData.triggerType = data.triggerType;
+      if (data.triggerType !== undefined) updateData.triggerType = data.triggerType;
-    if (data.triggerConfig !== undefined) {
+      if (data.triggerConfig !== undefined) {
-      updateData.triggerConfig = data.triggerConfig === null ? Prisma.JsonNull : data.triggerConfig;
+        updateData.triggerConfig = data.triggerConfig === null ? Prisma.JsonNull : data.triggerConfig;
-    }
+      }
-    if (data.enabled !== undefined) updateData.enabled = data.enabled;
+      if (data.enabled !== undefined) updateData.enabled = data.enabled;
-    if (data.allowReentry !== undefined) updateData.allowReentry = data.allowReentry;
+      if (data.allowReentry !== undefined) updateData.allowReentry = data.allowReentry;
 
-    const updated = await prisma.workflow.update({
+      const updatedWorkflow = await tx.workflow.update({
-      where: {id: workflowId},
+        where: {id: workflowId},
-      data: updateData,
+        data: updateData,
-      include: {
+        include: {
-        project: {
+          project: {
-          select: {name: true},
+            select: {name: true},
+          },
         },
-      },
+      });
+
+      // If triggerConfig changed and it's an EVENT trigger, update the TRIGGER step
+      if (data.triggerConfig !== undefined && updatedWorkflow.triggerType === 'EVENT') {
+        const newTriggerConfig = data.triggerConfig as {eventName?: string} | null;
+        const eventName = newTriggerConfig?.eventName;
+
+        if (eventName) {
+          // Find the TRIGGER step
+          const triggerStep = await tx.workflowStep.findFirst({
+            where: {
+              workflowId: workflowId,
+              type: 'TRIGGER',
+            },
+          });
+
+          if (triggerStep) {
+            // Update TRIGGER step config and name to match
+            await tx.workflowStep.update({
+              where: {id: triggerStep.id},
+              data: {
+                name: `Trigger: ${eventName}`,
+                config: {eventName},
+              },
+            });
+          }
+        }
+      }
+
+      return updatedWorkflow;
     });
 
     // Invalidate workflow cache if enabled status changed or workflow is enabled
@@ -220,6 +252,11 @@ export class WorkflowService {
       await EventService.invalidateWorkflowCache(projectId);
     }
 
+    // Also invalidate cache if triggerConfig changed on an enabled workflow
+    if (data.triggerConfig !== undefined && updated.enabled) {
+      await EventService.invalidateWorkflowCache(projectId);
+    }
+
     // Send notification if enabled status changed
     if (data.enabled !== undefined && data.enabled !== workflow.enabled) {
       if (data.enabled) {

apps/landing/src/components/Footer/Footer.tsx

@@ -128,6 +128,11 @@ export default function Footer() {
                       Terms
                     </Link>
                   </li>
+                  <li>
+                    <Link href={'/dpa'} className="text-sm text-neutral-600 transition hover:text-neutral-900">
+                      DPA
+                    </Link>
+                  </li>
                 </ul>
               </div>
             </div>

apps/landing/src/pages/dpa.tsx

@@ -0,0 +1,695 @@
+import {NextSeo} from 'next-seo';
+import React from 'react';
+import {Navbar} from '../components';
+
+export default function DataProcessingAgreement() {
+  return (
+    <>
+      <NextSeo
+        title="Plunk Data Processing Agreement (DPA) | GDPR Compliance"
+        description="Data Processing Agreement for Plunk customers. GDPR-compliant DPA covering data processing activities, sub-processors, security measures, and data subject rights."
+        openGraph={{
+          title: 'Plunk Data Processing Agreement (DPA) | GDPR Compliance',
+          description:
+            'Data Processing Agreement for Plunk customers. GDPR-compliant DPA covering data processing activities, sub-processors, security measures, and data subject rights.',
+        }}
+        additionalMetaTags={[
+          {
+            property: 'title',
+            content: 'Plunk Data Processing Agreement (DPA) | GDPR Compliance',
+          },
+        ]}
+      />
+
+      <div className="min-h-screen bg-white">
+        <div className="px-8 pb-32 sm:px-12 md:px-16 lg:px-20 xl:px-24 2xl:px-56">
+          <Navbar />
+
+          <div className="mx-auto max-w-4xl py-16">
+            {/* Hero */}
+            <div className="mb-12">
+              <h1 className="text-4xl font-bold text-neutral-900">Data Processing Agreement</h1>
+              <p className="mt-2 text-sm text-neutral-600">Last Updated: February 18, 2026</p>
+              <p className="mt-4 text-base leading-relaxed text-neutral-700">
+                This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Customer", "Data
+                Controller") and Plunk ("Processor", "we", "us") and governs the processing of Personal Data in
+                accordance with GDPR requirements.
+              </p>
+              <div className="mt-6 rounded-lg border border-blue-200 bg-blue-50 p-4">
+                <p className="text-sm leading-relaxed text-blue-900">
+                  <strong className="font-semibold">GDPR Requirement:</strong> This DPA is required under Article 28 of
+                  the GDPR. By using Plunk's hosted service, you accept and agree to the terms of this DPA.
+                </p>
+              </div>
+            </div>
+
+            {/* Table of Contents */}
+            <nav className="mb-12 rounded-lg border border-neutral-200 bg-neutral-50 p-6">
+              <h2 className="mb-4 text-lg font-semibold text-neutral-900">Contents</h2>
+              <ol className="space-y-2 text-sm text-neutral-700">
+                <li>
+                  <a href="#definitions" className="text-blue-600 hover:underline">
+                    1. Definitions
+                  </a>
+                </li>
+                <li>
+                  <a href="#scope" className="text-blue-600 hover:underline">
+                    2. Scope & Applicability
+                  </a>
+                </li>
+                <li>
+                  <a href="#processing-details" className="text-blue-600 hover:underline">
+                    3. Processing Details
+                  </a>
+                </li>
+                <li>
+                  <a href="#obligations" className="text-blue-600 hover:underline">
+                    4. Data Processor Obligations
+                  </a>
+                </li>
+                <li>
+                  <a href="#security" className="text-blue-600 hover:underline">
+                    5. Security Measures
+                  </a>
+                </li>
+                <li>
+                  <a href="#sub-processors" className="text-blue-600 hover:underline">
+                    6. Sub-Processors
+                  </a>
+                </li>
+                <li>
+                  <a href="#data-subject-rights" className="text-blue-600 hover:underline">
+                    7. Data Subject Rights
+                  </a>
+                </li>
+                <li>
+                  <a href="#data-breach" className="text-blue-600 hover:underline">
+                    8. Data Breach Notification
+                  </a>
+                </li>
+                <li>
+                  <a href="#international-transfers" className="text-blue-600 hover:underline">
+                    9. International Data Transfers
+                  </a>
+                </li>
+                <li>
+                  <a href="#audits" className="text-blue-600 hover:underline">
+                    10. Audits & Compliance
+                  </a>
+                </li>
+                <li>
+                  <a href="#deletion" className="text-blue-600 hover:underline">
+                    11. Data Deletion & Return
+                  </a>
+                </li>
+                <li>
+                  <a href="#liability" className="text-blue-600 hover:underline">
+                    12. Liability & Indemnification
+                  </a>
+                </li>
+                <li>
+                  <a href="#term" className="text-blue-600 hover:underline">
+                    13. Term & Termination
+                  </a>
+                </li>
+              </ol>
+            </nav>
+
+            {/* Content Sections */}
+            <div className="space-y-12">
+              {/* Section 1 */}
+              <section id="definitions" className="mb-12">
+                <h2 className="mb-4 text-2xl font-bold text-neutral-900">1. Definitions</h2>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  Terms used in this DPA have the meanings set forth in the GDPR. Specifically:
+                </p>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>
+                    <strong className="font-semibold text-neutral-900">"Personal Data"</strong> means any information
+                    relating to an identified or identifiable natural person processed via Plunk
+                  </li>
+                  <li>
+                    <strong className="font-semibold text-neutral-900">"Data Controller"</strong> means the Customer who
+                    determines the purposes and means of processing Personal Data
+                  </li>
+                  <li>
+                    <strong className="font-semibold text-neutral-900">"Data Processor"</strong> means Plunk, which
+                    processes Personal Data on behalf of the Data Controller
+                  </li>
+                  <li>
+                    <strong className="font-semibold text-neutral-900">"Sub-processor"</strong> means any third party
+                    engaged by Plunk to process Personal Data
+                  </li>
+                  <li>
+                    <strong className="font-semibold text-neutral-900">"Data Subject"</strong> means the individuals
+                    whose Personal Data is processed (your contacts/subscribers)
+                  </li>
+                  <li>
+                    <strong className="font-semibold text-neutral-900">"GDPR"</strong> means Regulation (EU) 2016/679
+                    (General Data Protection Regulation)
+                  </li>
+                </ul>
+              </section>
+
+              {/* Section 2 */}
+              <section id="scope" className="mb-12">
+                <h2 className="mb-4 text-2xl font-bold text-neutral-900">2. Scope & Applicability</h2>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Hosted Service Only</h3>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  This DPA applies ONLY to customers using Plunk's hosted service (useplunk.com). Self-hosted
+                  deployments are NOT covered by this DPA - you are solely responsible for GDPR compliance when
+                  self-hosting.
+                </p>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Agreement Hierarchy</h3>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  This DPA supplements the Plunk Terms of Service and Privacy Policy. In case of conflict regarding data
+                  processing:
+                </p>
+                <ol className="mb-4 ml-6 list-decimal space-y-2 text-neutral-700">
+                  <li>This DPA takes precedence</li>
+                  <li>Then the Terms of Service</li>
+                  <li>Then the Privacy Policy</li>
+                </ol>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Acceptance</h3>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  By using Plunk's hosted service, you acknowledge that you have read, understood, and agree to be bound
+                  by this DPA. This constitutes a legally binding agreement between Customer and Plunk.
+                </p>
+              </section>
+
+              {/* Section 3 */}
+              <section id="processing-details" className="mb-12">
+                <h2 className="mb-4 text-2xl font-bold text-neutral-900">3. Processing Details</h2>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  As required by GDPR Article 28(3), the following details describe the processing activities:
+                </p>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Subject Matter</h3>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  Processing of Personal Data necessary to provide email automation, transactional email, marketing
+                  campaigns, and workflow automation services.
+                </p>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Duration</h3>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  Processing occurs for the duration of your Plunk subscription/account, plus 30 days for API logs
+                  (which are automatically deleted), and until you request account deletion.
+                </p>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Nature & Purpose</h3>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>Storing and managing contact databases</li>
+                  <li>Sending transactional, marketing, and workflow-triggered emails</li>
+                  <li>Tracking email delivery, opens, clicks, bounces, and complaints (per your settings)</li>
+                  <li>Managing email templates and automation workflows</li>
+                  <li>Processing email events and webhooks</li>
+                  <li>Providing analytics and reporting</li>
+                </ul>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Type of Personal Data</h3>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>Email addresses (required)</li>
+                  <li>Names and custom contact fields (optional, Customer-defined)</li>
+                  <li>Email content (subject lines, message bodies, attachments)</li>
+                  <li>Subscription status and preferences</li>
+                  <li>Email activity data (opens, clicks, bounces, complaints)</li>
+                  <li>Timestamps and metadata</li>
+                </ul>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Categories of Data Subjects</h3>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>Customer's email subscribers and contacts</li>
+                  <li>Recipients of transactional emails</li>
+                  <li>Marketing campaign recipients</li>
+                  <li>Workflow automation recipients</li>
+                </ul>
+              </section>
+
+              {/* Section 4 */}
+              <section id="obligations" className="mb-12">
+                <h2 className="mb-4 text-2xl font-bold text-neutral-900">4. Data Processor Obligations</h2>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  Plunk commits to the following obligations as Data Processor:
+                </p>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Processing Instructions</h3>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>
+                    Process Personal Data only on documented instructions from Customer (via API, dashboard, etc.)
+                  </li>
+                  <li>Not process Personal Data for any other purpose without Customer's prior written consent</li>
+                  <li>Immediately inform Customer if instructions violate GDPR or other EU data protection laws</li>
+                </ul>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Confidentiality</h3>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>Ensure persons authorized to process Personal Data are bound by confidentiality obligations</li>
+                  <li>Maintain confidentiality of all Personal Data processed via Plunk</li>
+                  <li>
+                    Not disclose Personal Data to third parties except as required by law or with Customer consent
+                  </li>
+                </ul>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Cooperation</h3>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>Assist Customer in responding to Data Subject rights requests (see Section 7)</li>
+                  <li>
+                    Assist Customer in ensuring compliance with GDPR security, breach notification, and impact
+                    assessment obligations
+                  </li>
+                  <li>Provide information necessary to demonstrate compliance with Article 28</li>
+                </ul>
+              </section>
+
+              {/* Section 5 */}
+              <section id="security" className="mb-12">
+                <h2 className="mb-4 text-2xl font-bold text-neutral-900">5. Security Measures</h2>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  As required by GDPR Article 32, Plunk implements appropriate technical and organizational measures to
+                  ensure a level of security appropriate to the risk:
+                </p>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Technical Safeguards</h3>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>Industry-standard password hashing (never stored in plaintext)</li>
+                  <li>HTTPS-only API access (TLS 1.2+)</li>
+                  <li>Database connections encrypted via TLS/SSL</li>
+                  <li>HttpOnly, secure cookies with appropriate SameSite settings</li>
+                  <li>Authentication tokens with limited expiration periods</li>
+                  <li>Rate limiting to prevent brute force attacks</li>
+                </ul>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Organizational Safeguards</h3>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>Access controls limiting personnel access to Personal Data</li>
+                  <li>Automated bounce and complaint rate monitoring</li>
+                  <li>Regular security updates and patching</li>
+                  <li>Data segregation by project (multi-tenancy with isolation)</li>
+                </ul>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Data Residency</h3>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>Primary data storage: EU/EEA (Hetzner infrastructure)</li>
+                  <li>Database and file storage remain within EU/EEA</li>
+                  <li>Email delivery may transit non-EU regions (see Section 9)</li>
+                </ul>
+              </section>
+
+              {/* Section 6 */}
+              <section id="sub-processors" className="mb-12">
+                <h2 className="mb-4 text-2xl font-bold text-neutral-900">6. Sub-Processors</h2>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  Customer authorizes Plunk to engage the following sub-processors to process Personal Data:
+                </p>
+
+                <div className="mb-6 overflow-x-auto">
+                  <table className="min-w-full border border-neutral-300">
+                    <thead className="bg-neutral-50">
+                      <tr>
+                        <th className="border border-neutral-300 px-4 py-2 text-left text-sm font-semibold text-neutral-900">
+                          Sub-Processor
+                        </th>
+                        <th className="border border-neutral-300 px-4 py-2 text-left text-sm font-semibold text-neutral-900">
+                          Service
+                        </th>
+                        <th className="border border-neutral-300 px-4 py-2 text-left text-sm font-semibold text-neutral-900">
+                          Location
+                        </th>
+                        <th className="border border-neutral-300 px-4 py-2 text-left text-sm font-semibold text-neutral-900">
+                          Purpose
+                        </th>
+                      </tr>
+                    </thead>
+                    <tbody className="bg-white">
+                      <tr>
+                        <td className="border border-neutral-300 px-4 py-2 text-sm text-neutral-700">
+                          Amazon Web Services (AWS SES)
+                        </td>
+                        <td className="border border-neutral-300 px-4 py-2 text-sm text-neutral-700">Email Delivery</td>
+                        <td className="border border-neutral-300 px-4 py-2 text-sm text-neutral-700">
+                          Global (data in transit only)
+                        </td>
+                        <td className="border border-neutral-300 px-4 py-2 text-sm text-neutral-700">
+                          Sending emails to recipients
+                        </td>
+                      </tr>
+                      <tr>
+                        <td className="border border-neutral-300 px-4 py-2 text-sm text-neutral-700">Stripe, Inc.</td>
+                        <td className="border border-neutral-300 px-4 py-2 text-sm text-neutral-700">
+                          Payment Processing
+                        </td>
+                        <td className="border border-neutral-300 px-4 py-2 text-sm text-neutral-700">
+                          USA (PCI-DSS compliant)
+                        </td>
+                        <td className="border border-neutral-300 px-4 py-2 text-sm text-neutral-700">
+                          Billing for paid accounts
+                        </td>
+                      </tr>
+                      <tr>
+                        <td className="border border-neutral-300 px-4 py-2 text-sm text-neutral-700">
+                          Hetzner Online GmbH
+                        </td>
+                        <td className="border border-neutral-300 px-4 py-2 text-sm text-neutral-700">
+                          Infrastructure Hosting
+                        </td>
+                        <td className="border border-neutral-300 px-4 py-2 text-sm text-neutral-700">
+                          EU/EEA (Germany)
+                        </td>
+                        <td className="border border-neutral-300 px-4 py-2 text-sm text-neutral-700">
+                          Database and application hosting
+                        </td>
+                      </tr>
+                    </tbody>
+                  </table>
+                </div>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Sub-Processor Obligations</h3>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>All sub-processors are bound by data protection obligations equivalent to this DPA</li>
+                  <li>Plunk remains fully liable to Customer for sub-processor performance</li>
+                  <li>Sub-processors have executed Data Processing Agreements with Plunk</li>
+                </ul>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Changes to Sub-Processors</h3>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>Plunk will provide 30 days advance notice of new or replacement sub-processors via email</li>
+                  <li>Notice will be sent to the email address associated with your account</li>
+                  <li>
+                    If you object on reasonable grounds related to data protection, you may terminate your account
+                    within 30 days
+                  </li>
+                  <li>Updated sub-processor list will be maintained on this page (check "Last Updated" date)</li>
+                </ul>
+              </section>
+
+              {/* Section 7 */}
+              <section id="data-subject-rights" className="mb-12">
+                <h2 className="mb-4 text-2xl font-bold text-neutral-900">7. Data Subject Rights</h2>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  Plunk will assist Customer in fulfilling Data Subject rights requests under GDPR Articles 15-22:
+                </p>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Self-Service via API</h3>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  Customer can fulfill most Data Subject requests independently via API:
+                </p>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>
+                    <strong className="font-semibold text-neutral-900">Access (Art. 15):</strong> Retrieve contact data
+                    via GET /contacts/:id
+                  </li>
+                  <li>
+                    <strong className="font-semibold text-neutral-900">Rectification (Art. 16):</strong> Update contact
+                    data via PATCH /contacts/:id
+                  </li>
+                  <li>
+                    <strong className="font-semibold text-neutral-900">Erasure (Art. 17):</strong> Delete contact via
+                    DELETE /contacts/:id
+                  </li>
+                  <li>
+                    <strong className="font-semibold text-neutral-900">Restriction (Art. 18):</strong> Update
+                    subscription status to "unsubscribed"
+                  </li>
+                  <li>
+                    <strong className="font-semibold text-neutral-900">Portability (Art. 20):</strong> Use API to access
+                    data in JSON format
+                  </li>
+                </ul>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Assistance from Plunk</h3>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  If Customer cannot fulfill a request via API, contact [email protected]:
+                </p>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>Provide Data Subject's email address and nature of request</li>
+                  <li>Plunk will respond within 10 business days with requested information or assistance</li>
+                  <li>
+                    Customer remains responsible for verifying Data Subject identity before disclosing information
+                  </li>
+                </ul>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Email Activity Data</h3>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>Email opens, clicks, bounces, and complaints are linked to contact records</li>
+                  <li>Deleting a contact will cascade delete associated email activity</li>
+                  <li>API logs (non-Personal Data) are automatically deleted after 30 days</li>
+                </ul>
+              </section>
+
+              {/* Section 8 */}
+              <section id="data-breach" className="mb-12">
+                <h2 className="mb-4 text-2xl font-bold text-neutral-900">8. Data Breach Notification</h2>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Notification Obligation</h3>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  In the event of a Personal Data breach affecting Customer data, Plunk will:
+                </p>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>
+                    Notify Customer without undue delay and within 72 hours of becoming aware of the breach (per GDPR
+                    Art. 33)
+                  </li>
+                  <li>Send notification to the primary email address associated with Customer's account</li>
+                  <li>Provide information to enable Customer to meet any GDPR breach reporting obligations</li>
+                </ul>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Breach Information</h3>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  Notifications will include (to the extent known):
+                </p>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>Nature of the breach (what happened)</li>
+                  <li>Categories and approximate number of Data Subjects affected</li>
+                  <li>Categories and approximate number of Personal Data records affected</li>
+                  <li>Likely consequences of the breach</li>
+                  <li>Measures taken or proposed to address the breach and mitigate harm</li>
+                  <li>Contact point for more information ([email protected])</li>
+                </ul>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Customer Responsibility</h3>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>Customer is responsible for notifying their supervisory authority if required by GDPR Art. 33</li>
+                  <li>Customer is responsible for notifying affected Data Subjects if required by GDPR Art. 34</li>
+                  <li>Plunk's breach notification to Customer does NOT constitute legal or compliance advice</li>
+                </ul>
+              </section>
+
+              {/* Section 9 */}
+              <section id="international-transfers" className="mb-12">
+                <h2 className="mb-4 text-2xl font-bold text-neutral-900">9. International Data Transfers</h2>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Primary Storage (EU/EEA)</h3>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>All contact data, templates, workflows, and account data stored in EU/EEA (Hetzner, Germany)</li>
+                  <li>No routine transfers of stored Personal Data outside EU/EEA</li>
+                </ul>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Data in Transit (Email Delivery)</h3>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  When emails are sent to recipients, Personal Data may transit through non-EU regions:
+                </p>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>AWS SES processes emails globally for delivery purposes</li>
+                  <li>Data is in transit only (not stored long-term outside EU/EEA)</li>
+                  <li>Protected by AWS Data Processing Agreement and Standard Contractual Clauses (SCCs)</li>
+                </ul>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Payment Data (Stripe)</h3>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>Payment information (credit cards) processed by Stripe (USA-based)</li>
+                  <li>Stripe is PCI-DSS Level 1 certified</li>
+                  <li>Protected by Stripe's Data Processing Agreement and Standard Contractual Clauses</li>
+                  <li>Plunk does NOT store credit card numbers (tokenized by Stripe)</li>
+                </ul>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Standard Contractual Clauses</h3>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  All sub-processors that process Personal Data outside EU/EEA have executed Standard Contractual
+                  Clauses (SCCs) approved by the European Commission, providing appropriate safeguards for international
+                  transfers per GDPR Article 46.
+                </p>
+              </section>
+
+              {/* Section 10 */}
+              <section id="audits" className="mb-12">
+                <h2 className="mb-4 text-2xl font-bold text-neutral-900">10. Audits & Compliance</h2>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Information Provision</h3>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  Plunk will make available to Customer information necessary to demonstrate compliance with GDPR
+                  Article 28 obligations, including:
+                </p>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>This DPA (publicly available)</li>
+                  <li>Privacy Policy describing processing activities</li>
+                  <li>Sub-processor list (Section 6 above)</li>
+                  <li>Security measures documentation (available upon reasonable request)</li>
+                </ul>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Audit Rights</h3>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  Customer may audit Plunk's compliance with this DPA, subject to the following:
+                </p>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>Audits limited to once per year unless required by supervisory authority</li>
+                  <li>Request must be submitted in writing to legal@useplunk.com with 30 days notice</li>
+                  <li>Audits must be conducted by independent third-party auditors bound by confidentiality</li>
+                  <li>Audits conducted during business hours with minimal disruption to operations</li>
+                  <li>Customer bears all costs of audit</li>
+                  <li>Audit scope limited to GDPR compliance (not general security assessments)</li>
+                </ul>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Alternative to Audits</h3>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  In lieu of conducting a full audit, Customer may request and review sub-processor certifications and
+                  compliance documentation (SOC 2, ISO 27001, etc.) where available.
+                </p>
+              </section>
+
+              {/* Section 11 */}
+              <section id="deletion" className="mb-12">
+                <h2 className="mb-4 text-2xl font-bold text-neutral-900">11. Data Deletion & Return</h2>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Account Deletion</h3>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  When Customer deletes their Plunk account (via dashboard or by request):
+                </p>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>All Personal Data is immediately deleted from production systems</li>
+                  <li>No grace period or recovery window (deletion is permanent)</li>
+                  <li>
+                    Customer should access or backup data via API before deletion (Plunk does NOT provide data export)
+                  </li>
+                  <li>Deletion includes: contacts, emails, templates, workflows, campaigns, and email activity</li>
+                </ul>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Backup Retention</h3>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>Deleted data may remain in encrypted backups for up to 30 days for disaster recovery purposes</li>
+                  <li>Backup data is not accessible or restorable after account deletion</li>
+                  <li>Backups are automatically overwritten after retention period</li>
+                </ul>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Legal Retention</h3>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  Plunk may retain certain data if required by law (e.g., accounting records, fraud prevention):
+                </p>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>Billing records: Retained per tax/accounting laws (typically 7 years)</li>
+                  <li>Fraud/abuse records: Retained for security purposes (email addresses of suspended accounts)</li>
+                  <li>Legal requests: Data subject to legal holds retained as required by law</li>
+                </ul>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">No Data Return</h3>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  Plunk does NOT provide data export or return upon termination. Customer must retrieve data via API
+                  before deleting account. Once deleted, data cannot be recovered.
+                </p>
+              </section>
+
+              {/* Section 12 */}
+              <section id="liability" className="mb-12">
+                <h2 className="mb-4 text-2xl font-bold text-neutral-900">12. Liability & Indemnification</h2>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Customer Responsibilities</h3>
+                <p className="mb-4 leading-relaxed text-neutral-700">Customer (Data Controller) is responsible for:</p>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>
+                    Ensuring lawful basis for processing under GDPR (consent, contract, legitimate interest, etc.)
+                  </li>
+                  <li>Obtaining necessary consents from Data Subjects before adding them to Plunk</li>
+                  <li>Providing privacy notices to Data Subjects per GDPR Article 13/14</li>
+                  <li>Complying with anti-spam laws (CAN-SPAM, CASL, GDPR, etc.)</li>
+                  <li>Verifying Data Subject identity before fulfilling rights requests</li>
+                  <li>Notifying supervisory authorities and Data Subjects of breaches where required</li>
+                </ul>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Plunk's Liability</h3>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>Plunk is liable to Customer for compliance with this DPA and GDPR Article 28 obligations</li>
+                  <li>Plunk is liable for sub-processor acts/omissions to the same extent as its own acts</li>
+                  <li>
+                    Liability limitations in Terms of Service apply, except where prohibited by GDPR (particularly Art.
+                    82)
+                  </li>
+                </ul>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Indemnification</h3>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>
+                    Customer indemnifies Plunk for claims arising from Customer's violation of GDPR or data protection
+                    laws
+                  </li>
+                  <li>
+                    Plunk indemnifies Customer for claims arising solely from Plunk's breach of this DPA or GDPR Article
+                    28
+                  </li>
+                </ul>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">GDPR Fines</h3>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  Under GDPR Article 82(3), liability for damages is allocated between Controller and Processor based on
+                  fault. Each party is liable only for the damage caused by its own GDPR violation.
+                </p>
+              </section>
+
+              {/* Section 13 */}
+              <section id="term" className="mb-12">
+                <h2 className="mb-4 text-2xl font-bold text-neutral-900">13. Term & Termination</h2>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Effective Date</h3>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  This DPA is effective as of the date you first use Plunk's hosted service and remains in effect for
+                  the duration of the Terms of Service.
+                </p>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Termination</h3>
+                <p className="mb-4 leading-relaxed text-neutral-700">This DPA terminates automatically when:</p>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>Customer deletes their Plunk account</li>
+                  <li>Terms of Service are terminated</li>
+                  <li>All Personal Data has been deleted per Section 11</li>
+                </ul>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Survival</h3>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  Obligations regarding confidentiality, data deletion, and liability survive termination to the extent
+                  necessary to fulfill their purpose.
+                </p>
+
+                <h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">DPA Updates</h3>
+                <ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
+                  <li>Plunk may update this DPA to reflect changes in law, sub-processors, or processing activities</li>
+                  <li>Material changes will be notified via email 30 days in advance</li>
+                  <li>Continued use of Plunk after changes constitutes acceptance</li>
+                  <li>Check "Last Updated" date at top of page for version tracking</li>
+                </ul>
+              </section>
+
+              {/* Contact Section */}
+              <section className="mb-12 rounded-lg border border-neutral-200 bg-neutral-50 p-6">
+                <h2 className="mb-4 text-xl font-semibold text-neutral-900">Questions or Requests?</h2>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  For questions about this DPA, data processing activities, or to exercise audit rights:
+                </p>
+                <p className="mb-2 leading-relaxed text-neutral-700">
+                  <strong className="font-semibold text-neutral-900">Email:</strong> legal@useplunk.com
+                </p>
+                <p className="mb-4 leading-relaxed text-neutral-700">
+                  <strong className="font-semibold text-neutral-900">Response Time:</strong> Within 10 business days
+                </p>
+                <p className="text-sm text-neutral-600">
+                  For Data Subject rights requests, Customers should use the API (see Section 7) or contact
+                  legal@useplunk.com with Data Subject's email address and nature of request.
+                </p>
+              </section>
+            </div>
+          </div>
+        </div>
+      </div>
+    </>
+  );
+}

apps/web/src/components/ActivityItem.tsx

@@ -9,6 +9,7 @@ import {
   CheckCircle,
   ChevronRight,
   Eye,
+  Inbox,
   MousePointerClick,
   Send,
   ShieldAlert,
@@ -99,6 +100,7 @@ function isEmailActivity(type: string): boolean {
   return [
     'email.sent',
     'email.delivered',
+    'email.received',
     'email.opened',
     'email.clicked',
     'email.bounced',
@@ -181,6 +183,19 @@ function getActivityConfig(activity: Activity): ActivityConfig {
         },
       };
 
+    case 'email.received':
+      return {
+        icon: Inbox,
+        color: 'text-blue-600',
+        bgColor: 'bg-blue-100',
+        title: (typeof metadata.subject === 'string' ? metadata.subject : undefined) || 'Email received',
+        description: typeof metadata.from === 'string' ? `From: ${metadata.from}` : 'Inbound email',
+        badge: {
+          label: 'Received',
+          variant: 'default',
+        },
+      };
+
     case 'email.opened':
       return {
         icon: Eye,

apps/web/src/components/BillingLimits.tsx

@@ -78,6 +78,7 @@ export function BillingLimits({projectId, hasSubscription, billingEnabled}: Bill
       workflows: null,
       campaigns: null,
       transactional: null,
+      inbound: null,
     },
   });
 
@@ -88,6 +89,7 @@ export function BillingLimits({projectId, hasSubscription, billingEnabled}: Bill
         workflows: limitsData.workflows.limit,
         campaigns: limitsData.campaigns.limit,
         transactional: limitsData.transactional.limit,
+        inbound: limitsData.inbound.limit,
       });
     }
   }, [limitsData, form]);
@@ -121,6 +123,7 @@ export function BillingLimits({projectId, hasSubscription, billingEnabled}: Bill
         workflows: limitsData.workflows.limit,
         campaigns: limitsData.campaigns.limit,
         transactional: limitsData.transactional.limit,
+        inbound: limitsData.inbound.limit,
       });
     }
     setIsEditing(false);
@@ -217,6 +220,7 @@ export function BillingLimits({projectId, hasSubscription, billingEnabled}: Bill
                     usage={limitsData.transactional}
                     currency={limitsData.currency}
                   />
+                  <UsageDisplay category="Inbound" usage={limitsData.inbound} currency={limitsData.currency} />
                 </>
               )}
 
@@ -322,6 +326,36 @@ export function BillingLimits({projectId, hasSubscription, billingEnabled}: Bill
                   }}
                 />
 
+                <FormField
+                  control={form.control}
+                  name="inbound"
+                  render={({field}) => {
+                    const estimatedCost =
+                      limitsData?.currency && field.value
+                        ? formatEmailCost(Number(field.value), limitsData.currency)
+                        : null;
+                    return (
+                      <FormItem>
+                        <FormLabel>Inbound Emails Limit</FormLabel>
+                        <FormControl>
+                          <Input
+                            type="number"
+                            placeholder="Unlimited"
+                            {...field}
+                            value={field.value ?? ''}
+                            onChange={e => field.onChange(e.target.value === '' ? null : e.target.value)}
+                          />
+                        </FormControl>
+                        <FormDescription>
+                          Maximum inbound emails per month. Leave empty for unlimited.
+                          {estimatedCost && <span className="text-neutral-500"> ≈ {estimatedCost}/month</span>}
+                        </FormDescription>
+                        <FormMessage />
+                      </FormItem>
+                    );
+                  }}
+                />
+
                 <div className="flex justify-end gap-2 pt-4">
                   <Button type="button" variant="outline" onClick={handleCancel}>
                     Cancel

apps/web/src/components/WorkflowBuilder.tsx

@@ -226,6 +226,22 @@ function CustomNode({
         onMouseLeave={() => setShowActions(false)}
       >
         {/* Action buttons - shown on hover */}
+        {showActions && data.type === 'TRIGGER' && (
+          <div className="absolute -top-3 -right-3 flex gap-1.5 z-10">
+            <Button
+              onClick={e => {
+                e.stopPropagation();
+                data.onEdit?.();
+              }}
+              variant="outline"
+              size="icon"
+              className="h-7 w-7 shadow-md"
+              title="Edit trigger settings"
+            >
+              <Settings className="h-3.5 w-3.5" />
+            </Button>
+          </div>
+        )}
         {showActions && data.type !== 'TRIGGER' && (
           <div className="absolute -top-3 -right-3 flex gap-1.5 z-10">
             <Button
@@ -322,6 +338,14 @@ function CustomNode({
             </div>
           </div>
         )}
+        {data.type === 'TRIGGER' && data.config?.eventName && (
+          <div className="mt-3 pt-3 border-t border-neutral-100">
+            <div className="flex items-center gap-2 text-xs text-neutral-600">
+              <Lightbulb className="h-3 w-3" />
+              <span className="truncate">{data.config.eventName}</span>
+            </div>
+          </div>
+        )}
         {data.type === 'WEBHOOK' && data.config?.url && (
           <div className="mt-3 pt-3 border-t border-neutral-100">
             <div className="flex items-center gap-2 text-xs text-neutral-600">
@@ -375,11 +399,23 @@ export function WorkflowBuilder({workflowId, steps, onUpdate}: WorkflowBuilderPr
   const [stepToDelete, setStepToDelete] = useState<string | null>(null);
 
   // Define handlers before they are used in useMemo
-  const handleEditStep = useCallback((stepId: string) => {
+  const handleEditStep = useCallback(
-    // This will be handled by the parent component
+    (stepId: string) => {
-    const event = new CustomEvent('workflow-edit-step', {detail: {stepId}});
+      // Check if this is a TRIGGER step
-    window.dispatchEvent(event);
+      const step = steps.find(s => s.id === stepId);
-  }, []);
+
+      if (step?.type === 'TRIGGER') {
+        // For TRIGGER steps, open workflow settings instead
+        const event = new CustomEvent('workflow-open-settings');
+        window.dispatchEvent(event);
+      } else {
+        // For other steps, open step editor
+        const event = new CustomEvent('workflow-edit-step', {detail: {stepId}});
+        window.dispatchEvent(event);
+      }
+    },
+    [steps],
+  );
 
   const handleDeleteStepClick = useCallback((stepId: string) => {
     setStepToDelete(stepId);

apps/web/src/pages/activity/index.tsx

@@ -119,10 +119,12 @@ export default function ActivityPage() {
                     <SelectContent>
                       <SelectItem value="ALL">All Activity Types</SelectItem>
                       <SelectItem value="event.triggered">Events</SelectItem>
-                      <SelectItem value="email.sent,email.delivered,email.opened,email.clicked,email.bounced,email.complaint">
+                      <SelectItem value="email.sent,email.delivered,email.received,email.opened,email.clicked,email.bounced,email.complaint">
                         Emails
                       </SelectItem>
                       <SelectItem value="email.sent">Emails Sent</SelectItem>
+                      <SelectItem value="email.delivered">Emails Delivered</SelectItem>
+                      <SelectItem value="email.received">Emails Received</SelectItem>
                       <SelectItem value="email.opened">Emails Opened</SelectItem>
                       <SelectItem value="email.clicked">Emails Clicked</SelectItem>
                       <SelectItem value="email.bounced">Emails Bounced</SelectItem>

apps/web/src/pages/workflows/[id].tsx

@@ -318,7 +318,12 @@ export default function WorkflowEditorPage() {
     }
   };
 
-  const handleUpdateSettings = async (data: {name: string; description?: string}) => {
+  const handleUpdateSettings = async (data: {
+    name: string;
+    description?: string;
+    allowReentry?: boolean;
+    triggerConfig?: {eventName: string};
+  }) => {
     try {
       await network.fetch<Workflow, typeof WorkflowSchemas.update>('PATCH', `/workflows/${id}`, data);
       toast.success('Workflow updated successfully');
@@ -352,9 +357,15 @@ export default function WorkflowEditorPage() {
       }
     };
 
+    const handleOpenSettingsEvent = () => {
+      setShowSettingsDialog(true);
+    };
+
     window.addEventListener('workflow-edit-step', handleEditStepEvent);
+    window.addEventListener('workflow-open-settings', handleOpenSettingsEvent);
     return () => {
       window.removeEventListener('workflow-edit-step', handleEditStepEvent);
+      window.removeEventListener('workflow-open-settings', handleOpenSettingsEvent);
     };
   }, [workflow]);
 
@@ -741,21 +752,49 @@ interface SettingsDialogProps {
   workflow: Workflow;
   open: boolean;
   onOpenChange: (open: boolean) => void;
-  onSave: (data: {name: string; description?: string; allowReentry?: boolean}) => Promise<void>;
+  onSave: (data: {
+    name: string;
+    description?: string;
+    allowReentry?: boolean;
+    triggerConfig?: {eventName: string};
+  }) => Promise<void>;
 }
 
 function SettingsDialog({workflow, open, onOpenChange, onSave}: SettingsDialogProps) {
+  const triggerConfig = workflow.triggerConfig as {eventName?: string} | null;
   const [name, setName] = useState(workflow.name);
   const [description, setDescription] = useState(workflow.description ?? '');
   const [allowReentry, setAllowReentry] = useState(workflow.allowReentry ?? false);
+  const [eventName, setEventName] = useState(triggerConfig?.eventName ?? '');
   const [isSubmitting, setIsSubmitting] = useState(false);
 
+  // Sync state when workflow changes or dialog opens
+  useEffect(() => {
+    if (open) {
+      setName(workflow.name);
+      setDescription(workflow.description ?? '');
+      setAllowReentry(workflow.allowReentry ?? false);
+      const config = workflow.triggerConfig as {eventName?: string} | null;
+      setEventName(config?.eventName ?? '');
+    }
+  }, [open, workflow]);
+
+  // Fetch available event names
+  const {data: eventNamesData} = useSWR<{eventNames: string[]}>(open ? '/events/names' : null, {
+    revalidateOnFocus: false,
+  });
+
   const handleSubmit = async (e: React.FormEvent) => {
     e.preventDefault();
     setIsSubmitting(true);
 
     try {
-      await onSave({name, description: description || undefined, allowReentry});
+      await onSave({
+        name,
+        description: description || undefined,
+        allowReentry,
+        triggerConfig: eventName.trim() ? {eventName: eventName.trim()} : undefined,
+      });
     } finally {
       setIsSubmitting(false);
     }
@@ -784,6 +823,36 @@ function SettingsDialog({workflow, open, onOpenChange, onSave}: SettingsDialogPr
             />
           </div>
 
+          <div>
+            <Label htmlFor="eventName">Trigger Event *</Label>
+            {eventNamesData?.eventNames && eventNamesData.eventNames.length > 0 ? (
+              <Select value={eventName} onValueChange={setEventName} required>
+                <SelectTrigger id="eventName">
+                  <SelectValue placeholder="Select an event" />
+                </SelectTrigger>
+                <SelectContent>
+                  {eventNamesData.eventNames.map(name => (
+                    <SelectItem key={name} value={name}>
+                      {name}
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+            ) : (
+              <Input
+                id="eventName"
+                type="text"
+                value={eventName}
+                onChange={e => setEventName(e.target.value)}
+                placeholder="e.g., contact.created, email.opened"
+                required
+              />
+            )}
+            <p className="text-xs text-neutral-500 mt-1">
+              The event that triggers this workflow to start for a contact
+            </p>
+          </div>
+
           <div className="flex items-start gap-3 p-4 bg-neutral-50 rounded-lg border border-neutral-200">
             <Switch id="allowReentry" checked={allowReentry} onCheckedChange={setAllowReentry} />
             <div className="flex-1">

apps/wiki/content/docs/guides/meta.json

@@ -1,3 +1,3 @@
 {
-  "pages": ["list-hygiene", "verifying-domains", "tracking", "api-keys", "localization", "webhooks"]
+  "pages": ["list-hygiene", "verifying-domains", "receiving-emails", "tracking", "api-keys", "localization", "webhooks"]
 }

apps/wiki/content/docs/guides/receiving-emails.mdx

@@ -0,0 +1,142 @@
+---
+title: Receiving emails
+description: Receive incoming emails at your verified domain and trigger automated workflows
+icon: Inbox
+---
+
+Plunk can receive emails sent to your verified domain and turn them into `email.received` events. This allows you to build automated workflows that respond to inbound emails, such as support ticket systems, auto-responders, or email-based integrations.
+
+## How it works
+
+When someone sends an email to your verified domain (e.g., `[email protected]` or `[email protected]`), Plunk will:
+
+1. Receive the email through AWS SES
+2. Automatically create or update a contact for the sender
+3. Trigger an `email.received` event that can start workflows
+4. Make the email metadata available to your workflow steps
+
+The sender is automatically added to your contacts as a subscribed contact, allowing you to respond using Plunk's email sending capabilities.
+
+## Setting up inbound email
+
+<div className='fd-steps [&_h3]:fd-step'>
+
+### Verify your domain
+
+Before you can receive emails, your domain must be verified in Plunk. Follow the [verifying domains](/guides/verifying-domains) guide to set up the required DKIM, SPF, and MX records for sending.
+
+### Add the inbound MX record
+
+In your project settings, navigate to the **Domains** tab and expand your verified domain. You'll see an optional "Inbound Email" section with an MX record configuration:
+
+- **Type**: MX
+- **Name**: `yourdomain.com` (your root domain)
+- **Value**: `10 inbound-smtp.eu-north-1.amazonaws.com`
+
+Add this MX record to your domain's DNS settings. The priority value `10` ensures that inbound emails are routed to AWS SES for processing.
+
+<Callout title="Multiple MX records" variant="warning">
+  If you're already using MX records for another email service (like Google Workspace or Microsoft 365), adding this MX
+  record may conflict. You can only have one primary email receiver per domain. Consider using a subdomain (e.g.,
+  `mail.yourdomain.com`) if you need to maintain both services.
+</Callout>
+
+### Wait for DNS propagation
+
+DNS changes can take anywhere from a few minutes to 48 hours to fully propagate. You can verify the MX record is set correctly using:
+
+```bash
+dig MX yourdomain.com
+```
+
+You should see the AWS SES inbound endpoint in the response.
+
+</div>
+
+## Creating workflows with email.received
+
+Once your MX record is configured, you can create workflows that respond to incoming emails.
+
+### Event trigger
+
+Create a new workflow and use `email.received` as the trigger event. This workflow will run every time an email is received at your domain.
+
+### Available event data
+
+The `email.received` event includes the following data that you can use in your workflow steps:
+
+| Field                  | Type     | Description                                    |
+| ---------------------- | -------- | ---------------------------------------------- |
+| `messageId`            | string   | Unique identifier for the received message     |
+| `from`                 | string   | Email address of the sender                    |
+| `fromHeader`           | string   | Full "From" header including display name      |
+| `to`                   | string   | Primary recipient email address                |
+| `subject`              | string   | Email subject line                             |
+| `timestamp`            | string   | ISO 8601 timestamp when the email was received |
+| `recipients`           | string[] | All recipient email addresses                  |
+| `hasContent`           | boolean  | Whether the email body was captured            |
+| `spamVerdict`          | string   | Spam check result (e.g., "PASS", "FAIL")       |
+| `virusVerdict`         | string   | Virus scan result (e.g., "PASS", "FAIL")       |
+| `spfVerdict`           | string   | SPF authentication result                      |
+| `dkimVerdict`          | string   | DKIM authentication result                     |
+| `dmarcVerdict`         | string   | DMARC authentication result                    |
+| `processingTimeMillis` | number   | Time taken to process the email                |
+
+You can access these fields in your workflow using variable syntax, for example: `{{event.subject}}` or `{{event.from}}`.
+
+## Multi-project domains
+
+If you have verified the same domain in multiple projects, incoming emails will be processed for **all projects** that have the domain verified. Each project will:
+
+- Create/update the sender as a contact in that project
+- Trigger the `email.received` event in that project
+- Run any workflows configured for that event
+
+This allows you to segment inbound email handling across different projects if needed.
+
+## Limitations
+
+<Callout title="Email body content" variant="warning">
+  Currently, the email body content is not stored or made available in the event data. Only metadata (sender, subject,
+  recipients, timestamps, and security verdicts) is captured. The `hasContent` field indicates whether body content was
+  present, but the content itself is not accessible in workflows.
+</Callout>
+
+- **Catch-all addresses**: Plunk receives emails sent to any address at your verified domain (e.g., `[email protected]`). You can use workflow conditions to route emails based on the `to` field.
+- **Attachments**: Email attachments are not currently captured or stored.
+- **Email size**: AWS SES has a maximum message size limit of 40 MB for inbound emails.
+
+## Security considerations
+
+Plunk captures several security verdicts for each incoming email:
+
+- **SPF (Sender Policy Framework)**: Verifies the sender's mail server is authorized
+- **DKIM (DomainKeys Identified Mail)**: Validates the email hasn't been tampered with
+- **DMARC (Domain-based Message Authentication)**: Combines SPF and DKIM for additional validation
+- **Spam verdict**: AWS SES's spam detection result
+- **Virus verdict**: AWS SES's virus scanning result
+
+You can use these verdicts in workflow conditions to automatically filter or quarantine suspicious emails before processing them.
+
+## Troubleshooting
+
+### Emails not being received
+
+1. **Check DNS propagation**: Verify the MX record is correctly set using `dig MX yourdomain.com`
+2. **Verify domain**: Ensure your domain is fully verified in Plunk (all DKIM, SPF, and MX records for sending)
+3. **Check workflow**: Create a simple test workflow with just an `email.received` trigger and a webhook to verify events are being generated
+4. **Check sender**: Try sending from a different email provider as some may cache DNS records
+
+### Duplicate events
+
+If you have the same domain verified in multiple projects, you will receive duplicate `email.received` events (one per project). This is expected behavior. Use project-specific workflows to handle this.
+
+### Security verdicts failing
+
+If incoming emails consistently show failing security verdicts:
+
+- **SPF failures**: The sender's domain may not have SPF configured correctly
+- **DKIM failures**: The sender's domain may not have DKIM configured, or the email was forwarded/modified in transit
+- **DMARC failures**: The sender fails both SPF and DKIM checks
+
+These are issues with the sender's configuration, not your Plunk setup. You can choose to process these emails anyway or filter them using workflow conditions.

apps/wiki/content/docs/guides/verifying-domains.mdx

@@ -9,9 +9,78 @@ Verifying your domain is a requirement to send emails through Plunk. Domain veri
 ## Verifying a domain
 
 You can verify a domain by adding it in the domain tab of the project settings. Once added, Plunk will provide you with the necessary DNS records to add to your domain's DNS settings.
+
 Once you have added the DNS records, it may take some time for the changes to propagate. You can check the verification status in the domain tab of the project settings.
 
-### DNS Records
+## DNS Records
-- 3 CNAME records for DKIM (DomainKeys Identified Mail) to authenticate your emails.
+
-- 1 TXT record for SPF (Sender Policy Framework) to specify which mail servers are authorized
+Domain verification requires adding several DNS records to your domain. Each record serves a specific purpose in email authentication and delivery.
-- 1 MX record to handle bounces and feedback loops
+
+### DKIM Records (3 CNAME records)
+
+**DomainKeys Identified Mail (DKIM)** adds a digital signature to your emails, proving they haven't been tampered with during transit.
+
+You'll need to add **3 CNAME records** provided by Plunk. These records contain cryptographic keys that email receivers use to verify your emails are authentic.
+
+**Why it matters:**
+
+- Prevents email spoofing and tampering
+- Improves deliverability and inbox placement
+- Required by most email providers (Gmail, Outlook, etc.)
+
+### SPF Record (1 TXT record)
+
+**Sender Policy Framework (SPF)** specifies which mail servers are authorized to send emails on behalf of your domain.
+
+You'll need to add **1 TXT record** that lists the authorized sending servers.
+
+**Why it matters:**
+
+- Prevents unauthorized servers from sending emails using your domain
+- Reduces the likelihood of your domain being used for spam
+- Works together with DKIM for complete authentication
+
+### Bounce Handling (1 MX record)
+
+This **MX record** allows Plunk to receive bounce notifications and spam complaints from email providers.
+
+**Why it matters:**
+
+- Automatically tracks which contacts have bounced or complained
+- Helps maintain your sender reputation
+- Prevents sending to invalid email addresses
+- Required for deliverability monitoring
+
+<Callout title="Receiving inbound emails" variant="idea">
+  The MX record above is for sending emails (handling bounces and complaints). If you want to **receive** emails at your
+  domain and trigger workflows, see the [receiving emails](/guides/receiving-emails) guide for additional MX record
+  setup.
+</Callout>
+
+## Verification Status
+
+After adding all DNS records, Plunk will automatically check the verification status. Verification typically completes within a few minutes but can take up to 72 hours depending on DNS propagation.
+
+You can check the status in the Domains section of your project settings. Each record type will show as verified once detected.
+
+## Troubleshooting
+
+### Records not verifying
+
+If your DNS records aren't verifying after 24 hours:
+
+1. **Double-check the values**: Ensure you copied the exact values without extra spaces
+2. **Check DNS propagation**: Use tools like `dig` or online DNS checkers to verify the records are published
+3. **TTL settings**: Some DNS providers cache records. Try lowering the TTL (Time To Live) value
+4. **Contact your DNS provider**: Some providers have specific requirements or interfaces for adding these record types
+
+### Emails still going to spam
+
+Even with a verified domain, emails may go to spam if:
+
+- Your content triggers spam filters (excessive links, suspicious keywords)
+- Your sender reputation is new or low
+- Recipients have marked your emails as spam in the past
+- You're sending to invalid or unengaged contacts
+
+Follow email best practices and maintain good [list hygiene](/guides/list-hygiene) to improve deliverability.

apps/wiki/content/docs/guides/webhooks.mdx

@@ -22,33 +22,33 @@ Plunk automatically tracks a set of internal events that you can use as workflow
 
 ### Email events
 
-| Event | Description |
+| Event             | Description                                                                                              |
-|-------|-------------|
+| ----------------- | -------------------------------------------------------------------------------------------------------- |
-| `email.sent` | An email was successfully sent |
+| `email.sent`      | An email was successfully sent                                                                           |
-| `email.delivery` | An email was delivered to the recipient |
+| `email.delivery`  | An email was delivered to the recipient                                                                  |
-| `email.open` | A contact opened an email for the first time |
+| `email.open`      | A contact opened an email for the first time                                                             |
-| `email.click` | A contact clicked a link in an email for the first time |
+| `email.click`     | A contact clicked a link in an email for the first time                                                  |
-| `email.bounce` | An email bounced (hard or soft bounce) |
+| `email.bounce`    | An email bounced (hard or soft bounce)                                                                   |
-| `email.complaint` | A contact marked an email as spam |
+| `email.complaint` | A contact marked an email as spam                                                                        |
+| `email.received`  | An email was received at your verified domain (requires [inbound email setup](/guides/receiving-emails)) |
 
 ### Contact events
 
-| Event | Description |
+| Event                  | Description                                             |
-|-------|-------------|
+| ---------------------- | ------------------------------------------------------- |
-| `contact.subscribed` | A contact's subscription status changed to subscribed |
+| `contact.subscribed`   | A contact's subscription status changed to subscribed   |
 | `contact.unsubscribed` | A contact's subscription status changed to unsubscribed |
 
 ### Segment events
 
-| Event | Description |
+| Event                  | Description                 |
-|-------|-------------|
+| ---------------------- | --------------------------- |
 | `segment.<name>.entry` | A contact entered a segment |
-| `segment.<name>.exit` | A contact exited a segment |
+| `segment.<name>.exit`  | A contact exited a segment  |
 
-<Callout
+<Callout title="Segment event names" variant="idea">
- title="Segment event names"
+  Segment events use a slugified version of the segment name. For example, a segment called "VIP Users" would produce
- variant="idea">
+  the events `segment.vip-users.entry` and `segment.vip-users.exit`.
-Segment events use a slugified version of the segment name. For example, a segment called "VIP Users" would produce the events `segment.vip-users.entry` and `segment.vip-users.exit`.
 </Callout>
 
 ## Setting up a webhook
@@ -115,14 +115,14 @@ The `event` field contains the data associated with the event that triggered the
 
 The `event` field varies depending on which event triggered the workflow:
 
-| Event | Fields in `event` |
+| Event             | Fields in `event`                                                        |
-|-------|-------------------|
+| ----------------- | ------------------------------------------------------------------------ |
-| `email.sent` | `subject`, `from`, `messageId`, `templateId`, `campaignId`, `sourceType` |
+| `email.sent`      | `subject`, `from`, `messageId`, `templateId`, `campaignId`, `sourceType` |
-| `email.open` | `subject`, `from`, `openedAt`, `isFirstOpen` |
+| `email.open`      | `subject`, `from`, `openedAt`, `isFirstOpen`                             |
-| `email.click` | `subject`, `from`, `clickedAt`, `clicks`, `isFirstClick` |
+| `email.click`     | `subject`, `from`, `clickedAt`, `clicks`, `isFirstClick`                 |
-| `email.bounce` | `subject`, `from`, `bounceType`, `bouncedAt` |
+| `email.bounce`    | `subject`, `from`, `bounceType`, `bouncedAt`                             |
-| `email.complaint` | `subject`, `from`, `complainedAt` |
+| `email.complaint` | `subject`, `from`, `complainedAt`                                        |
-| Custom events | Whatever data you passed when tracking the event |
+| Custom events     | Whatever data you passed when tracking the event                         |
 
 ## Common use cases
 
@@ -150,4 +150,4 @@ Since webhooks are part of the workflow system, you can combine them with other
 
 - Use a **Condition** step to only fire the webhook when certain criteria are met (e.g. only notify for contacts on a specific plan)
 - Use a **Wait for Event** step to wait for a follow-up event before sending the webhook (e.g. wait to see if a bounced contact re-subscribes)
-- Use a **Delay** step to add a time buffer before the webhook fires
+- Use a **Delay** step to add a time buffer before the webhook fires

package.json

@@ -1,6 +1,6 @@
 {
   "name": "plunk",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "private": true,
   "scripts": {
     "build": "turbo build",

packages/db/prisma/migrations/20260218141637_add_inbound_email_tracking/migration.sql

@@ -0,0 +1,5 @@
+-- AlterEnum
+ALTER TYPE "EmailSourceType" ADD VALUE 'INBOUND';
+
+-- AlterTable
+ALTER TABLE "projects" ADD COLUMN     "billingLimitInbound" INTEGER;

packages/db/prisma/migrations/20260218151425_add_received_email_status/migration.sql

@@ -0,0 +1,2 @@
+-- AlterEnum
+ALTER TYPE "EmailStatus" ADD VALUE 'RECEIVED';

packages/db/prisma/schema.prisma

@@ -53,6 +53,7 @@ model Project {
   billingLimitWorkflows     Int? // Max workflow emails per month
   billingLimitCampaigns     Int? // Max campaign emails per month
   billingLimitTransactional Int? // Max transactional emails per month
+  billingLimitInbound       Int? // Max inbound emails per month
 
   // Email Tracking
   tracking TrackingMode @default(ENABLED) // Open and click tracking mode
@@ -750,6 +751,7 @@ enum EmailSourceType {
   TRANSACTIONAL // Sent via API call
   CAMPAIGN // Sent as part of broadcast
   WORKFLOW // Sent via workflow automation
+  INBOUND // Received via SES inbound
 }
 
 enum EmailStatus {
@@ -757,6 +759,7 @@ enum EmailStatus {
   SENDING // Currently being sent
   SENT // Successfully sent to provider
   DELIVERED // Confirmed delivered
+  RECEIVED // Received by platform (inbound)
   OPENED // Recipient opened email
   CLICKED // Recipient clicked link
   BOUNCED // Bounced (hard or soft)

packages/shared/src/i18n/index.ts

@@ -9,6 +9,7 @@ import ptTranslations from './locales/pt.json' with {type: 'json'};
 import bgTranslations from './locales/bg.json' with {type: 'json'};
 import csTranslations from './locales/cs.json' with {type: 'json'};
 import plTranslations from './locales/pl.json' with {type: 'json'};
+import esTranslations from './locales/es.json' with {type: 'json'};
 
 export {
   SUPPORTED_LANGUAGES,
@@ -43,6 +44,7 @@ const translationsMap: Record<string, Translations> = {
   bg: bgTranslations,
   cs: csTranslations,
   pl: plTranslations,
+  es: esTranslations,
 };
 
 // In-memory cache for loaded translations

packages/shared/src/i18n/languages.ts

@@ -15,6 +15,7 @@ export const SUPPORTED_LANGUAGES: Language[] = [
   {code: 'bg', name: 'Bulgarian', nativeName: 'Български', flag: '🇧🇬'},
   {code: 'cs', name: 'Czech', nativeName: 'Čeština', flag: '🇨🇿'},
   {code: 'pl', name: 'Polish', nativeName: 'Polski', flag: '🇵🇱'},
+  {code: 'es', name: 'Spanish (Spain)', nativeName: 'Español (España)', flag: '🇪🇸'},
 ];
 
 export const DEFAULT_LANGUAGE = 'en';

packages/shared/src/i18n/locales/es.json

@@ -0,0 +1,45 @@
+{
+  "pages": {
+    "unsubscribe": {
+      "title": "Cancelar suscripción",
+      "description": "Lamentamos que te vayas. ¿Estás seguro de que quieres cancelar la suscripción de {email} para dejar de recibir correos electrónicos?",
+      "button": "Cancelar suscripción",
+      "buttonLoading": "Cancelando suscripción...",
+      "managePreferences": "Gestionar preferencias en su lugar",
+      "successTitle": "Suscripción cancelada",
+      "successDescription": "Se ha cancelado la suscripción de {email}. No recibirás más correos electrónicos de nuestra parte.",
+      "changedMind": "¿Has cambiado de opinión?",
+      "subscribeAgain": "Suscribirse de nuevo"
+    },
+    "subscribe": {
+      "title": "Suscribirse a las novedades",
+      "description": "¿Te gustaría suscribir {email} para recibir correos electrónicos?",
+      "button": "Suscribirse",
+      "buttonLoading": "Suscribiendo...",
+      "successTitle": "¡Suscripción completada!",
+      "successDescription": "{email} está ahora suscrito para recibir correos electrónicos de nuestra parte."
+    },
+    "manage": {
+      "title": "Gestionar preferencias",
+      "description": "Gestiona las preferencias de correo electrónico de {email}",
+      "subscriptionLabel": "Suscripción de correo electrónico",
+      "subscribedStatus": "Actualmente estás suscrito para recibir correos electrónicos",
+      "unsubscribedStatus": "Actualmente tienes cancelada la suscripción a los correos electrónicos",
+      "subscribedSuccess": "¡Suscripción realizada con éxito!",
+      "unsubscribedSuccess": "¡Suscripción cancelada con éxito!",
+      "unsubscribeCompletely": "Cancelar suscripción completamente",
+      "subscribeToEmails": "Suscribirse a los correos electrónicos",
+      "disclaimer": "Esta página te permite gestionar tus preferencias de correo electrónico. El estado de tu suscripción se actualiza en tiempo real."
+    },
+    "common": {
+      "loading": "Cargando...",
+      "error": "Error"
+    }
+  },
+  "email": {
+    "footer": {
+      "unsubscribeText": "Has recibido este correo electrónico porque aceptaste recibir correos electrónicos de {projectName}. Si ya no deseas recibir correos electrónicos como este, por favor",
+      "updatePreferences": "actualiza tus preferencias"
+    }
+  }
+}

packages/shared/src/schemas/index.ts

@@ -180,6 +180,7 @@ export const WorkflowSchemas = {
     triggerType: z.nativeEnum(WorkflowTriggerType).optional(),
     triggerConfig: jsonSchema.optional(),
     enabled: z.boolean().optional(),
+    allowReentry: z.boolean().optional(),
   }),
   addStep: z.object({
     type: z.nativeEnum(WorkflowStepType),
@@ -439,6 +440,7 @@ export const BillingLimitSchemas = {
     workflows: z.coerce.number().int().positive().nullable(),
     campaigns: z.coerce.number().int().positive().nullable(),
     transactional: z.coerce.number().int().positive().nullable(),
+    inbound: z.coerce.number().int().positive().nullable(),
   }),
 } as const;
 

packages/types/src/api/activity.ts

@@ -9,6 +9,7 @@ export enum ActivityType {
   EVENT_TRIGGERED = 'event.triggered',
   EMAIL_SENT = 'email.sent',
   EMAIL_DELIVERED = 'email.delivered',
+  EMAIL_RECEIVED = 'email.received',
   EMAIL_OPENED = 'email.opened',
   EMAIL_CLICKED = 'email.clicked',
   EMAIL_BOUNCED = 'email.bounced',

packages/types/src/api/billing.ts

@@ -20,6 +20,7 @@ export interface BillingLimitsResponse {
   workflows: CategoryUsage;
   campaigns: CategoryUsage;
   transactional: CategoryUsage;
+  inbound: CategoryUsage;
   currency: string | null;
 }