Terms of service

01 The service

We discover, publish and maintain a sub-processor list for your business, and where you subscribe to it, monitor the published lists of vendors you nominate. We record what we observe, with dates.

02 Your account

Sign-in is via Google. You are responsible for who in your organisation you grant access to, and for any API key you issue. Tell us at once if a key is exposed and we will revoke it.

You must be entitled to ask us to analyse the domain you submit. Submitting a domain you do not control produces a private result that we never publish and never disclose to that company.

03 Fees

• Discovery is free and carries no obligation to continue.
• Subscription billing begins when you approve your first list, not when you submit a domain.
• Fees are exclusive of VAT, charged monthly or annually in advance.
• Cancel at any time from settings; the current period runs to its end and is not refunded, except under clause 5 where you object to a sub-processor of ours.

04 What we promise

• To re-check every source in your discovery at least once every 24 hours while your subscription is active, and to tell you when a check fails rather than showing a stale result.
• To have a named person review every discovery and every material change before it reaches you.
• To publish nothing about your business, and email none of your customers, without your explicit approval.
• To give you 30 days’ notice of a new sub-processor of ours, per our DPA.
• To let you export your complete dated record at any time, including after you leave.

05 What we explicitly do not promise

• We do not warrant completeness. A sub-processor that appears in no public source and on no list you give us will not be found. We publish our coverage gaps at how it works.
• We do not give legal advice and nothing we produce is legal advice. We publish observations and dated records; whether they satisfy your obligations is for you and your advisers.
• We do not replace notices your vendors owe you. Article 28 places that duty on them. We exist so you can check they met it.
• We do not assert that any company is in breach. We record that a page changed, on a date, with the evidence.
• We do not guarantee uninterrupted service. Where a check fails we record the failure, which is itself part of the record.

06 Your data

You keep all rights in what you give us. We process it only to provide the service, under the data processing agreement, which forms part of these terms. We do not use your data to train models, and we do not sell it.

07 Pages belonging to other companies

The register contains information published by third parties on their own websites. It belongs to them, we link to every source, and we correct errors on request. If you are one of those companies you may claim your page, correct it, or ask us to record your position alongside ours.

You may not use the register to harass a company, to assert publicly that anyone is in breach, or to scrape it wholesale for a competing product. Reading it, citing it and building on the API are all fine and encouraged.

08 Who owns the record

Dated records about your own business are your data. On termination you may export the whole record — PDF, CSV and the verification manifest. Your public register page remains, marked as no longer maintained rather than quietly going stale, and you may ask us to remove it.

09 Ending the agreement

You may cancel at any time. We may terminate for non-payment after notice, or immediately for use that breaks clause 7. We will give at least 60 days’ notice before withdrawing the service, and the register itself will be handed to a suitable custodian rather than switched off.

10 Liability

Nothing limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be limited. Subject to that, our aggregate liability is capped at the fees you paid in the twelve months before the claim, and neither party is liable for indirect or consequential loss.

Given clause 5, we specifically do not accept liability for a regulatory outcome, since we do not determine compliance and do not present ourselves as doing so.