Terms of Service

1. Who these terms are between

1.1 These terms are between Edward Hallam, a sole trader in England and Wales, trading as AquaCRM, whose address is the address given on request at [email protected] ("AquaCRM", "we", "us"), and the business named on the Order ("Customer", "you").

1.2 AquaCRM is sold to businesses only. You confirm that you are entering into these terms for the purposes of your trade, business or profession and not as a consumer.

1.3 These terms take effect on [EFFECTIVE DATE] or, if later, the date you accept them or sign an Order (the "Start Date").

2. Definitions

In these terms:

• Authorised User means a person you allow to sign in to your Workspace. This includes your owners, managers, staff and freelancers. It also includes your clients' people and your clients' customers, once you give them access to a client portal.
• Client Workspace means the part of your Workspace that holds the records of one of your clients.
• Connected Service means a third-party service that you connect to the Service using your own account and credentials. Examples are an email provider, a payment provider, an AI model provider, a messaging or telephony provider, Google, GitHub or Vercel.
• Customer Data means the data that you and your Authorised Users put into the Service, or that the Service receives for you from your websites and Connected Services.
• Customer Personal Data means the personal data in Customer Data.
• DPA means the data processing agreement in Schedule 2.
• Order means the order form, quote or online sign-up that names the plan, the fees and the Subscription Term.
• Service means the hosted AquaCRM software and its features as they are made available to you from time to time.
• Subscription Term means the period stated in the Order, as renewed under clause 12.
• Workspace means your agency's account on the Service and everything in it.

3. The Service

3.1 AquaCRM is hosted business software for agencies. It covers client and contact records, sales pipelines, a shared inbox, client workspaces and client portals, fulfilment and tasks, finance and invoicing, website building, and reporting. The modules available to you are the ones in your Order.

3.2 We may change, add to or remove features. If a change materially reduces what you have paid for, we will give you at least [30] days' notice. You may then end these terms under clause 12.4.

3.3 Some features may be marked as preview, beta or draft. They are provided as they are, they may change or be withdrawn without notice, and clause 9 does not apply to them.

3.4 Some features rely on a Connected Service and do nothing until you connect one. Examples are sending email, taking payments, the AI assistant, SMS and calls, and social messaging. Clause 5 applies to those features.

4. Accounts and access

4.1 You decide who becomes an Authorised User and what role they hold. The Service has fixed roles for your agency (owner, manager, staff), for freelancers, for your clients' people (client owner, client staff) and for your clients' customers. It also lets you grant narrower permissions on top of those roles. You are responsible for the roles and permissions you give, and for the acts of your Authorised Users.

4.2 You must keep sign-in details confidential and make sure each Authorised User has their own account. Tell us promptly at [SUPPORT EMAIL] if you suspect that an account has been compromised.

4.3 The Service offers two-factor sign-in with an authenticator app. [We strongly recommend that every owner and manager turns it on.] [Or, if Ed decides it: Owners must turn it on.]

4.4 Certain actions can be taken only by an owner of your Workspace. These include permanently erasing a client and changing data-retention settings. They also include locking the Workspace and signing everyone out.

5. Connected Services

5.1 You may connect Connected Services using your own accounts. Your use of each one is governed by your own agreement with its provider. We are not a party to that agreement. We are not responsible for the provider's acts, omissions or availability, or for any charges it makes to you.

5.2 When you connect a Connected Service, you instruct us to send Customer Data to it, and receive Customer Data from it, as the feature you are using requires. For example, the recipient address and the whole message are sent to your email provider when you send an email. The prompt and the records you give the assistant are sent to your AI provider when you use it.

5.3 We store the credentials you give us for Connected Services in encrypted form. We use them only to provide the feature you connected them for. [As the code stands, this is true of credentials held for the Service's integration, calendar and inbox connections, of the secret fields in a module's settings, and, from [the date the Email sender change is deployed], of the credentials entered on the Email sender module's own Settings page, but not of every place a credential can be typed. These are stored in plain text: a token you put in the headers of an automation's webhook, and the signing secret of a website-editor webhook target. Until that date every Email sender credential is stored in plain text too, and one stored before it stays in plain text until you save the module's settings again, a send succeeds, or a send fails with an authentication-type error. If our encryption key is not set in production, a save that would store a credential is refused, and a send records its result but cannot encrypt, so a credential already in plain text stays as it is until the key is set. The last four characters of each longer Email sender credential are also stored unencrypted, for display. See the reviewer note on 5.3.]

5.4 For most Connected Services, the Service does not use our own accounts with the provider to act for you. If you have not connected a provider, the feature that needs it does not work. The exceptions are:

(a) "Sign in with Google" and Google Calendar sync. Each user connects their own Google account to these, but through our Google application;

(b) the email that verifies your address when you sign up, which we send through our own email provider; and

(c) [as the code stands today — Ed to decide whether to keep this or to limit it to our own agency, see open question E9:] publishing a client project to GitHub, the code editor's access to a project's GitHub repository, and preview deployments of a client project to Vercel. Where you have not connected your own GitHub or Vercel account, these use ours, and the project's files are then held in our GitHub or Vercel account. In the code editor this happens only when the person using it is an owner of your Workspace; publishing and preview deployments do it for any of your agency users who can manage that client's systems.

Our providers for (a) to (c) are our sub-processors and are listed in the DPA.

6. Acceptable use

6.1 You must use the Service lawfully, and make sure your Authorised Users do the same. In particular you and they must not:

(a) send marketing email, SMS, WhatsApp messages or calls without the consent or other lawful basis the law requires. The Privacy and Electronic Communications Regulations 2003 are one example. You must also honour every request to stop. The Service does not add an unsubscribe link to messages and does not keep a suppression list across all sending. Recording and honouring opt-outs is your responsibility;

(b) put into the Service special category personal data, criminal offence data or children's data, unless we have first agreed in writing that you may. Special category data includes health, ethnicity, religion, sexuality and biometrics. There is one exception: the People module records your staff's leave by type, and one of those types is sick leave. You may use that, provided you have your own lawful basis as their employer. The Service's optional HIPAA checklist is a tracking aid only. It does not make the Service suitable for protected health information;

(c) enter payment card numbers into notes, messages or forms. Card payments must be taken through your payment provider's own checkout;

(d) upload malware or content that is unlawful, infringing, defamatory, harassing or obscene;

(e) try to get around or test the Service's security, including penetration testing, load testing or vulnerability scanning, without our written consent;

(f) access another customer's data, or try to;

(g) copy, reverse engineer or resell the Service, except as these terms or the law permit;

(h) use the Service's prospect-finding, map or search features in breach of the terms of the provider behind them, or to collect personal data unlawfully;

(i) rely on output from AI features without a person reviewing it first. AI output can be wrong;

(j) record a call without the consent or other lawful basis the law requires. Before a call is recorded, the Service asks the user to confirm that everyone on the call has agreed. You are responsible for that confirmation being true.

6.2 If you break clause 6.1, we may act under clause 11 (suspension).

7. Customer Data

7.1 You own Customer Data. You give us a non-exclusive licence to host, copy, transmit and process Customer Data for the Subscription Term, only so far as needed to provide the Service. That includes support and our security obligations.

7.2 Each party will comply with its obligations under UK data protection law. When we process Customer Personal Data for you, we do so as your processor under the DPA in Schedule 2. The DPA forms part of these terms.

7.3 We do not sell Customer Data. We do not use Customer Personal Data for our own purposes, except as the DPA allows.

7.4 [Optional — Ed to decide, solicitor to word: a right for us to use aggregated, anonymised information about how the Service is used, to run and improve it.]

7.5 You are responsible for the lawfulness of the Customer Data you put into the Service. That includes having a lawful basis for it, giving the privacy information your data subjects need, and having the authority to share your clients' data with us where you hold it for them. It also includes telling your staff about the working-time and activity records the Service keeps about them when they clock in.

8. Fees and payment

8.1 You will pay the fees in the Order: [FEES], [BILLING PERIOD — e.g. monthly in advance].

8.2 We will invoice you [in advance / in arrears]. Invoices are payable within [14] days. Fees exclude VAT, which you will pay at the applicable rate.

8.3 If an undisputed invoice is unpaid [14] days after its due date, we may charge interest under the Late Payment of Commercial Debts (Interest) Act 1998. After a further [14] days' written notice we may also suspend the Service under clause 11.1(c).

8.4 We may change the fees at renewal by giving you at least [30] days' notice.

8.5 [Pilot customers: the Order may state that the Service is provided free or at a reduced fee for a pilot period of [X] months. In that case clause 8.1 to 8.4 apply only after the pilot ends.]

9. Availability and support

9.1 We will use reasonable care and skill to provide the Service, and reasonable efforts to keep it available.

9.2 We do not offer a service level agreement, an uptime commitment or service credits. The Service may be unavailable at times. Causes include planned maintenance, releasing new versions, faults in our hosting or other providers, and events outside our control. Where we can, we will give notice of planned maintenance that we expect to cause noticeable downtime.

9.3 [Backups — to be completed only when it is true. See reviewer note 9.3 and open question E5. Until then, this clause should say that the Service keeps a limited number of recent recovery copies inside its own database, that these are not an independent backup, and that you should keep your own copies of anything you cannot afford to lose.]

9.4 Support is provided by email to [SUPPORT EMAIL], [during UK business hours]. We will try to respond within [2] business days. This is a target, not a commitment.

10. Security

10.1 We maintain the technical and organisational security measures described in Annex 2 of the DPA. We may change them, but we will not make a change that materially reduces the overall protection they give.

10.2 You are responsible for the security of your own devices and networks. You are also responsible for your Authorised Users' sign-in details, the permissions you grant, and the Connected Services you choose.

11. Suspension

11.1 We may suspend all or part of your access to the Service, or that of an Authorised User, if:

(a) we reasonably believe that doing so is needed to protect the Service, other customers or any person from a security threat or a personal data breach;

(b) you or an Authorised User materially breach clause 6;

(c) an undisputed invoice is still unpaid after the notice in clause 8.3; or

(d) we are required to by law or by a regulator.

11.2 We will suspend only as much, and for as long, as is reasonably necessary. Where the law and the circumstances allow, we will tell you beforehand, or as soon as we can afterwards, and say why. We will lift the suspension once the reason for it has been dealt with.

11.3 Suspension does not delete Customer Data.

12. Term and ending these terms

12.1 These terms start on the Start Date and continue for the Subscription Term. They then renew automatically for successive periods of [one month / the same length] unless either party gives notice under clause 12.2.

12.2 Either party may end these terms by giving at least [30] days' written notice, ending [at the end of the current Subscription Term / at any time].

12.3 Either party may end these terms immediately by written notice if the other:

(a) commits a material breach that cannot be remedied, or does not remedy a remediable breach within [30] days of being asked to in writing; or

(b) becomes insolvent, enters administration or liquidation, makes an arrangement with its creditors, or (if an individual) is made bankrupt.

12.4 You may also end these terms by notice within [30] days of being told about a change under clause 3.2 or 18.2.

13. Your data when these terms end

13.1 Export. Until these terms end, and for [30] days afterwards (the "Exit Period"), you may export your data.

(a) The Service lets you export records from a number of its modules, as structured files (JSON or CSV). This uses an access key you issue from your Workspace with export permission. The modules include clients, contacts, staff, leads, pipelines, tasks, SOPs, products, legal records, finance and the activity log.

(b) Those export features do not yet produce a complete copy of a Workspace. For example, they do not include inbox conversations, websites or the contents of uploaded files. So, if you ask us during the Exit Period, we will give you a copy of your Customer Data in [a commonly used, machine-readable format] within [30] days. [Charges, if any: [none / our reasonable costs]].

13.2 Deletion. After the Exit Period, we will delete Customer Data as set out in clause 12 of the DPA.

13.3 We may keep information we need for our own legal, tax or accounting records, or to establish, exercise or defend legal claims. Examples are your contact details, the Order and our invoices to you. We will handle it in line with our privacy notice.

14. Intellectual property

14.1 We and our licensors own the Service, including its software, designs, templates and documentation. We give you a non-exclusive, non-transferable right for your Authorised Users to use the Service during the Subscription Term, for your internal business purposes and to serve your own clients.

14.2 [Templates and content we supply: the Service may come with templates for portals, websites, documents and processes. Ed to decide what the Customer may keep after the end. Solicitor to word it.]

14.3 [Websites and projects built in the Service: who owns the code, content and domains of a client website built or published through the Service, and what happens to them at the end. Ed to decide. See open question E8.]

14.4 If you give us feedback or suggestions, we may use them freely.

15. Confidentiality

15.1 Each party will keep the other's confidential information confidential. It will use that information only to perform these terms, and will disclose it only to people who need it for that purpose and are bound by equivalent duties. Customer Data is your confidential information.

15.2 Clause 15.1 does not apply to information that is or becomes public through no fault of the receiving party, that the receiving party already lawfully held, that it develops independently, or that it must disclose by law. In the last case, the receiving party will give notice where it lawfully can.

16. Warranties and what the Service is not

16.1 Each party warrants that it has the authority to enter into these terms.

16.2 The Service includes tools that help you meet your own obligations. Examples are the compliance overview, the subject-request register, the erasure tools, retention settings, the breach register and the optional HIPAA checklist. These tools do not make you compliant with any law, and the Service says so where they appear. Whether your processing is lawful remains your responsibility.

16.3 Except as these terms expressly state, the Service is provided without any warranty, condition or other term, express or implied. That includes those of satisfactory quality and fitness for a particular purpose, to the extent the law permits.

17. Liability

17.1 Nothing in these terms limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot be limited or excluded by law.

17.2 Subject to clause 17.1, neither party is liable for loss of profits, revenue, business, goodwill or anticipated savings, or for any indirect or consequential loss.

17.3 Subject to clause 17.1, each party's total liability arising out of or in connection with these terms in any [12-month period] is limited to [LIABILITY CAP — e.g. the fees paid or payable in the 12 months before the event giving rise to the claim / £[X], whichever is greater].

17.4 [Data protection liability: Ed and solicitor to decide whether liability under the DPA sits inside the cap in 17.3, has its own cap of [£X / a multiple of fees], or is uncapped. See open question S4.]

17.5 [Loss of data: solicitor to decide whether, and how, to limit liability for loss or corruption of Customer Data. Any limit must match what the backup position actually is when the terms are signed (clause 9.3).]

17.6 [Indemnities, if any: for example, you indemnify us against claims arising from Customer Data or from your breach of clause 6. Solicitor to advise.]

18. Changes to these terms

18.1 We may update these terms. We will tell you at least [30] days before a change takes effect, by email to your account owner and in the Service.

18.2 If a change materially disadvantages you, you may end these terms under clause 12.4 before it takes effect.

19. General

19.1 Transfer. We may transfer these terms to a company that we control or that acquires the business of the Service, by giving you written notice. [This clause matters now: see open question E1 on the planned limited company.] You may transfer these terms only with our written consent, which we will not withhold unreasonably.

19.2 Subcontractors. We may use subcontractors to provide the Service. We remain responsible for them. The DPA governs sub-processors of Customer Personal Data.

19.3 Events outside our control. Neither party is liable for delay or failure caused by events beyond its reasonable control. This does not excuse a failure to pay.

19.4 Notices. Notices must be in writing and sent by email: to us at [LEGAL NOTICES EMAIL], and to you at the email of your Workspace owner. [Or by post to the addresses in clause 1.1.]

19.5 Entire agreement. These terms, the Order and the DPA are the whole agreement between the parties about the Service. If they conflict, the order of precedence is: the DPA (for data protection matters), then the Order, then these terms.

19.6 Third parties. No one other than the parties has any right under the Contracts (Rights of Third Parties) Act 1999 to enforce these terms.

19.7 Severance and waiver. If any provision is found invalid, the rest continues in force. A delay in enforcing a right is not a waiver of it.

20. Governing law and jurisdiction

20.1 These terms, and any dispute or claim arising out of or in connection with them, are governed by the law of England and Wales.

20.2 The courts of England and Wales have exclusive jurisdiction.

---

Schedule 1 — Order (template)

Schedule 2 — Data processing agreement

See data-processing-agreement.md in this folder. The sub-processor list is sub-processors.md.

---