Terms of service

1

This agreement

These terms are the agreement between White Label Consultancy AS (registration number [to be completed before signature], registered at [to be completed before signature]), which provides Pritect Sonar, and the organisation that creates a workspace. "We" and "us" mean the provider. "You" mean that organisation, not the individual who signs up.

You accept these terms by creating a workspace or by using the service. The person who does so confirms that they are authorised to accept on the organisation's behalf. If they are not, the organisation is not bound and the workspace should be closed.

Three documents govern, and where they disagree they take this order: an order form or written agreement signed by both of us, then the data processing agreement, then these terms. Nothing in a link, a page of documentation or a support message changes them.

We may change these terms. A change that reduces what you get or increases what you owe takes effect at your next renewal and we tell you at least thirty days before. Any other change takes effect when published. If you do not accept a change, you may close your workspace and we refund the unused part of anything you have prepaid.

2

Words that mean something specific

• Workspace: your instance of the service, pinned to one region when it is created.
• Connection: the authorisation your administrator grants us to read a Microsoft 365 or Google Workspace tenant that belongs to you.
• Content: the documents, messages and attachments in a tenant you connect. Content is yours and stays yours.
• Finding: the record we keep about content, being a location, a category, a count, a confidence and a position reference.
• Inventory: the picture built from findings, of where personal data lives in your tenant and how it is shared.
• Sub-processor: a supplier we use to provide the service, listed in Annex III of the data processing agreement.
• Documentation: the trust, limits and legal pages published on our site, which say what the service does and does not do.

3

What the service is, and what it is not

The service reads content in the tenants you connect, classifies it in memory, and records where personal data lives, how much of it there is, and how it is shared. It is read only. It does not write to, move, quarantine, label, delete or otherwise change anything in your tenant.

Four things the service deliberately is not, because each is a thing a reader might reasonably assume:

• It is not a backup or an archive. It holds no copy of your content and cannot restore anything.
• It is not an enforcement tool. It reports exposure; it does not revoke a sharing link, change a permission or block an action.
• It does not produce redacted or altered copies of your documents. It produces a record about them.
• It is not legal advice. A finding, a category or a risk rating is an input to your own assessment, not a conclusion about your obligations.

The limits page is part of this section. Every capability the service does not have yet is stated there, in the place a reader would otherwise assume it, and we keep it current as a term of this agreement rather than as marketing.

4

Your workspace, your accounts and your people

You choose your workspace's region when you create it. The choice is fixed: the region cannot be changed afterwards, and moving to another region means a new workspace. We offer EU Frankfurt, and EU Stockholm by arrangement.

You decide who has an account and what role they hold. Roles carry different powers: an owner can close the workspace, an administrator can change the settings that govern what is shown and kept, a reviewer can act on findings, and a viewer can read. Every change to a setting that governs disclosure or retention is written to your audit log, which nobody can edit or delete, including us.

You are responsible for your accounts. Keep credentials to the people who need them, use the multi-factor authentication the service offers, and tell us promptly if you believe an account has been compromised.

If you are an adviser using a workspace on behalf of a client, the client is the customer under these terms and you act with their authority. The client can withdraw your access.

5

Connecting Microsoft 365 and Google Workspace

A connection is authorised in your own tenant by your own administrator. You confirm that you are entitled to grant it and that granting it is consistent with your obligations to the people whose data is in that tenant, including any works council or employee representative agreement that applies.

We request the narrowest set of permissions your chosen scope needs, and we show you each one with the reason it is needed before you grant anything. You choose what is in scope. Mailboxes are in scope only if you put them there.

You can revoke a connection at any time, from your own tenant or from the service. Revoking stops the reading. Findings already recorded stay until you delete them or the retention period ends, because they contain no content and are the record you were building.

Google Workspace is built and is in verification with Google. It will not connect until that verification is granted, and we do not charge for it before then.

Microsoft and Google are your own processors under your own agreements with them. They are not our sub-processors, we have no contract with them about your data, and their terms govern what happens in your tenant.

6

Your content, and what we keep

Content is yours. We claim no right in it, and the only right you give us is the right to read it in order to provide the service, on your instruction, for as long as you instruct it.

We commit, as a term of this agreement and not only as a description of how the system happens to work today:

• No document text, message body, attachment, matched value or snippet is written to persistent storage of any kind.
• A finding records a location, a category, a count, a confidence and a position reference such as a page, a sheet or a cell. It never records the value at that position.
• Filenames and paths are kept, because a finding you cannot open is a finding you cannot act on. They are treated as personal data, never written to a log line, and never sent to the Pritect platform.
• The account that owns a site, a drive or a mailbox is the only individual-level personal data we hold. Showing it is a setting that is off by default, and while it is off the database returns nothing for those fields.
• A masked snippet beside a finding is the one exception, it is off by default, only an administrator can turn it on, and every change is audited. At this stage it is a place in the schema rather than a feature you can switch on.

The data processing agreement governs our handling of personal data in content and takes precedence over this section where the two could be read differently.

7

Acceptable use

Use the service to find and govern personal data in tenants you are entitled to read. Do not use it to build a picture of an individual.

• Do not connect a tenant you are not authorised to read, or use the service to read the content of a person outside the employment or contractual relationship that justifies it.
• Do not use the service to monitor the productivity, conduct or communications of a named individual. The product is deliberately built so that this is hard: the owner view is off by default and there is no way to search for one person's data.
• Do not attempt to extract content from the service. There is none to extract, and trying is a breach rather than a bug report.
• Do not probe, load test, reverse engineer or circumvent the service's limits without our written agreement. Tell us about a vulnerability instead and we will not pursue you for finding it responsibly.
• Do not resell or provide the service to a third party except as an adviser acting for a client, which the service supports directly.

If use of the service threatens the security or the availability of the service for others, we may suspend the workspace. We tell you why, we do it for no longer than the threat lasts, and we tell you what would end it.

8

Plans, fees and the first sweep

The first sweep is free. It is bounded rather than complete: it looks at a limited number of the largest sites and a sample of mailboxes, so that you see a real result before you commit to anything. What it covered is shown with the result, so you can see what it did not.

Plans are expected to be priced by the number of user accounts in the tenants you connect, measured at the time of a scan. Where a plan carries a limit, the limit is stated on the plan and enforced in the product rather than invoiced after the fact.

Fees are exclusive of value added tax. Where you are established in a country that requires it, you are responsible for the reverse charge.

9

Availability, support and change

We aim for the service to be available whenever you need it, and we do not yet publish an availability commitment. We will not publish one before we have measured it, for the same reason we publish no accuracy figure before the measurement harness has run.

The service depends on Microsoft's and Google's interfaces. When a provider throttles us, we slow down and keep going rather than failing, and we tell you in the connection's health record. When a provider withdraws or changes an interface, we adapt as fast as we reasonably can, and where that changes what the service can see we say so on the limits page.

Support is by email during Central European business hours. We will publish response targets when we can meet them consistently.

We improve the service continuously. We will not remove a capability you rely on without telling you at least thirty days before, and a change that would make the service materially worse for you is a reason to leave under section 15 with a refund of the unused part.

10

Security

The measures we operate are set out in Annex II of the data processing agreement, and they are the ones actually implemented rather than a list of intentions. In summary: every workspace's data is isolated at the database with row level security, each workspace's credentials are encrypted under a key belonging to that workspace alone which is itself wrapped under a master key held outside the database, the worker that reads content runs with an outbound allowlist and refuses to start without the master key, and audit records are append only.

We do not yet publish an independent penetration test summary. One is planned before public launch and we will publish it when it exists rather than describing it in advance.

If a personal data breach affects your data, the data processing agreement says what we do and how quickly. If a security incident affects your workspace without involving personal data, we tell you anyway.

11

Confidentiality

Each of us may learn things about the other that are not public. Neither of us uses the other's confidential information for anything except performing this agreement, and neither discloses it except to people who need it and are under an equivalent duty.

This does not cover information that is public without a breach, that the receiver already had, or that the receiver develops independently. Where disclosure is required by law, the receiver may disclose it and tells the other first unless it is prohibited from doing so.

Your inventory and your findings are your confidential information. We do not use them to improve the service for anyone else, we do not use them to train a model, and we do not disclose them, including in aggregate, without your written agreement.

12

Intellectual property and feedback

We own the service, its software, its rules, its taxonomy and its brand. You get a right to use it for the term, and nothing more transfers.

You own your content and your findings. Exporting them is a feature of the service, not a favour, and the export formats are documented.

If you tell us how to make the service better, we may act on it without owing you anything. We will not identify you as the source without asking.

Neither of us may use the other's name or marks in publicity without written agreement.

13

Warranties, and what we do not warrant

We warrant that we will provide the service with reasonable skill and care, that we have the right to provide it, and that it will work substantially as the documentation describes.

We publish no accuracy figure. When we do, it will carry the cases it was measured on and the limits of that measurement, and it will not be published before the measurement exists.

Beyond the warranties above, the service is provided as it is, and we exclude every other warranty that the law allows us to exclude.

14

Liability

Neither of us limits liability for death or personal injury caused by negligence, for fraud, or for anything else the law does not permit to be limited. Nothing in this section limits your obligation to pay fees due, or either party's liability for a breach of confidentiality or for infringement of the other's intellectual property.

Subject to that, neither of us is liable for indirect or consequential loss, loss of profit, loss of revenue, loss of anticipated saving, or loss of goodwill, and each party's total liability is capped at [to be completed before signature].

We each take reasonable steps to limit our own losses. A claim must be brought within the period the applicable law allows, and we do not shorten it here.

15

Term, termination, deletion and law

The agreement runs from the day you create a workspace until either of us ends it. You may end it at any time by closing the workspace. We may end it on thirty days' notice, or immediately if you materially breach these terms and do not fix the breach within fourteen days of being told.

When the agreement ends, connections stop, scanning stops, and you can export what you have. After that, deleting a workspace destroys the key that workspace's data was encrypted under, purges its rows, and leaves a tombstone and a confirmation reference so that the deletion itself can be evidenced. That is a shred rather than a row delete, and it cannot be undone.

Sections that are meant to survive do: definitions, confidentiality, intellectual property, liability, and this section.

This agreement is governed by the law of the country in which White Label Consultancy AS is established, and the courts of that country have exclusive jurisdiction. The specific jurisdiction and venue are [to be completed before signature]. This is a business service and is not offered to consumers, so nothing here affects a consumer's rights.