DRAFT – not yet reviewed by a solicitor. These words may change before launch.

Version 0.2+082e9a28

Fristal Terms of Service

Draft v0.2, 18 October 2026. Not for publication. Items marked [LAWYER] or [TBD] are open; the full list is in legal/README.md. Remove every note in square brackets before these terms go live.

1. Who we are and what these terms cover

1.1 These terms are an agreement between Tagg Software Ltd, a company registered in England and Wales (company number 16997744, registered office Unit 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE) ("Tagg", "we", "us") and the business that signs up to use Fristal ("you", "the Customer").

[LAWYER: Company number, name and registered office were confirmed on Companies House on 18 October 2026. Re-check on the day of publication. Fristal is the trading name, renamed from our working name on 19 October 2026. Confirm that "Fristal" can be used as a trading name of Tagg Software Ltd, and whether a "trading as" statement is needed.]

1.2 Fristal is a web service that helps small software and device makers prepare for the EU Cyber Resilience Act (the "Service").

1.3 These terms, the Privacy Notice at https://fristal.com/privacy and the plan you choose at sign-up form the whole agreement. If anything conflicts, these terms win, except for the Privacy Notice on personal data.

1.4 You can contact us at hello@fristal.com [ROB: confirm these mailboxes exist] or by post to our registered office.

2. Business customers only

2.1 The Service is for business use only. By creating an account you confirm that you are signing up for a business, trade, craft or profession (including as a sole trader or self-employed person), and not as a consumer.

2.2 We do not sell to consumers. If you are a consumer, do not sign up or use the Service.

2.3 [LAWYER: Confirm that the consumer protection rules (in particular the Consumer Rights Act 2015) do not apply to these terms, and how the business confirmation at sign-up should be recorded. Check whether any mandatory rules in an EU customer's own country could apply to a business customer and, if so, whether these terms need a carve-out.]

3. Definitions

Account: your Fristal organisation account. Each organisation has one login, created at sign-up. The person who holds it is the "Account owner".

Customer Content: everything you upload or enter into the Service, including lockfiles, SBOMs, product names and versions, findings, reporting checklists, report fields, notes and evidence log entries.

Fees: the subscription fees for your plan.

Plan: a subscription option described in clause 9.1, or the free trial described in clause 9.6.

Third-Party Data: vulnerability and exploitation data from OSV.dev, the CISA Known Exploited Vulnerabilities (KEV) catalogue, and any other source we add.

4. The Service

4.1 The Service is an information service. It:

(a) takes a lockfile or SBOM that you upload and produces a CycloneDX SBOM for each product;

(b) checks the components in each product against Third-Party Data, usually once a day;

(c) sends alerts when it finds a new match;

(d) where you record that a vulnerability is being actively exploited in your product, starts a timed checklist with report fields pre-filled for you to review, export and use;

(e) keeps an evidence log of actions taken in the Service; and

(f) provides a free "Am I in scope?" checker and a quick SBOM scan.

4.2 Third-Party Data may be incomplete, delayed or wrong. The Service depends on sources we do not control. They may be incomplete, out of date, or contain errors. Matches depend on how well your components are identified in your lockfile or SBOM.

4.3 No guarantee of detection. We do not guarantee that the Service will find every vulnerability that affects your product, that every match is correct, or that every severity or exploitation label is accurate. You should not treat the Service as the only check on your components.

4.4 We do not submit reports. We do not submit reports to ENISA, to any Computer Security Incident Response Team (CSIRT), to any national authority or to any other body, on your behalf or otherwise. Any notification or report under the Cyber Resilience Act or any other law is yours to make, through the channels that apply to you. The Service helps you track the timing and prepare the content.

4.5 Who decides. The reporting clock starts only when you confirm the time you became aware of active exploitation. Fristal does not decide whether a vulnerability is actively exploited in your product. A listing in the CISA KEV catalogue is a prompt for you to assess, not a finding that your product is affected.

4.6 Changes. We may add, change or remove features. We will tell you in advance if we are going to remove a feature that is important to your plan, unless the change is needed for security or legal reasons.

5. Your responsibilities

5.1 You remain responsible for your legal obligations. You remain solely responsible for complying with the Cyber Resilience Act (Regulation (EU) 2024/2847) and every other law that applies to you. This includes monitoring your products for vulnerabilities, assessing them, documenting them, reporting them and deciding what to do about them, as well as conformity assessment, technical documentation, supply-chain duties and any sector-specific rules.

5.2 Accuracy of what you upload. You are responsible for the accuracy and currency of every SBOM, lockfile and product detail you upload. The Service can only check what you give it. You must upload a new lockfile or SBOM when your product changes.

5.3 Keep alerts working. You must keep your alert channels working. In particular you must:

(a) keep the email addresses on your Account up to date, and check that Fristal emails are not blocked or filtered away;

(b) keep any Slack or other webhook you add working, and only add webhooks you control;

(c) use a monitored or shared mailbox for the Account, and/or the optional Slack channel, so that alerts do not depend on one person's inbox; and

(d) check the "last checked" date shown for each product, and act on any missed-scan alert.

We are not responsible for an alert you did not receive or act on because of your settings, your email provider, your webhook, or a change you made.

5.4 Your decisions. You decide whether a vulnerability is actively exploited in your product, what remedial action to take, whether and when to report, and what to say in any report.

5.5 Advice. You should take advice from a qualified adviser on your obligations. Section 6 explains what the Service does and does not do.

6. No legal advice

6.1 The Service, including the "Am I in scope?" checker, the reporting checklists, the report fields, the FAQs and all other content, is general information only. It is not legal, regulatory, technical or professional advice. Using the Service does not create a lawyer–client relationship.

6.2 The scope checker gives a general indication of whether the Cyber Resilience Act is likely to apply to a product. It does not decide whether the Act applies to you, and its results can be wrong if your answers are wrong or your circumstances are unusual.

6.3 We do not certify, approve or endorse any product, and nothing in the Service means your product complies with the Cyber Resilience Act or any other law.

6.4 [LAWYER: Please review the scope checker logic and wording in tickwatch/scope.py and the landing page copy, and confirm that this clause and the disclaimers around them are enough.]

7. Warranties

7.1 We will provide the Service with reasonable skill and care.

7.2 Except as set out in these terms, we give no warranties, conditions or representations about the Service. To the extent the law allows, we exclude all implied terms, including any implied terms about satisfactory quality, fitness for a particular purpose, and non-infringement.

7.3 [LAWYER: Section 13 of the Supply of Goods and Services Act 1982 implies a term of reasonable care and skill. In a business contract, excluding or limiting that term must meet the reasonableness test in UCTA 1977 (sections 3 and 11) and the Schedule 2 guidelines. Please confirm that "reasonable skill and care" is the right standard, and whether we should give any express security or availability commitment or should avoid one.]

7.4 You confirm that you have the authority to bind your business to these terms, and that you will use the Service in line with them.

8. Liability

8.1 What we cannot limit. Nothing in these terms limits or excludes:

(a) our liability for death or personal injury caused by our negligence;

(b) our liability for fraud or fraudulent misrepresentation; or

(c) any other liability that cannot be limited or excluded by law.

8.2 Cap. Subject to clause 8.1, our total liability to you arising out of or in connection with these terms or the Service, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is limited to the total Fees you paid to us under these terms in the 12 months before the event that gave rise to the claim.

[LAWYER: Please decide whether the cap needs a minimum figure, for example the greater of the Fees paid and a fixed sum. As drafted, a customer on the £29 plan who has paid one month's fee has a cap of £29, and a trial customer who has paid nothing has a cap of zero. Also decide whether the cap is per claim or in total, and whether it should be backed by professional indemnity insurance. Insurance cover has not yet been confirmed: [TBD].]

8.3 Exclusions. Subject to clause 8.1, we are not liable to you for any of the following, however they arise:

(a) indirect or consequential loss;

(b) loss of profit, revenue, business, anticipated savings or goodwill;

(c) loss or corruption of data, including Customer Content (you are responsible for keeping your own copies, see clause 12.4);

(d) regulatory fines, penalties or other sanctions imposed on you by any authority, and any amount you try to recover from us for them;

(e) losses arising from a missed notification or report deadline, to the extent the miss was caused by a failure to act on an alert, a failure to keep your Account or alert channels working, or a decision you made; or

(f) loss caused by inaccurate, incomplete or out-of-date information that you give us, including SBOMs and lockfiles (see clause 5.2).

[LAWYER: Recovering a regulatory fine from another party is generally restricted on public-policy grounds (Safeway Stores Ltd v Twigger [2010] EWCA Civ 1472; please verify the citation). Paragraph (d) excludes it expressly anyway. Please confirm.]

[LAWYER: Consider whether to exclude product recall or withdrawal costs, and the cost of responding to a regulator. These are not in the brief and are left out for now.]

8.4 Third-Party Data. We are not liable for the content, accuracy, completeness or timeliness of Third-Party Data, beyond what clause 8.2 allows.

8.5 Reasonableness. This section applies because you are a business customer (clause 2). You and we agree that the limits and exclusions in this section are fair and reasonable. They reflect the Fees charged, the free and low-cost nature of some plans, and the fact that you control your regulatory decisions and submissions.

[LAWYER: Please check this section against UCTA 1977 (sections 2(2), 3 and 11 and Schedule 2). Confirm whether the reasonableness recital in clause 8.5 helps, and whether a court would treat a cap equal to 12 months' fees as reasonable for a service that supports a regulatory deadline. Also check any mandatory rules for EU business customers.]

8.6 Warranty and liability. Clause 7 sets out the standard we promise: reasonable skill and care, with no promise that the Service is fit for a particular purpose. Our liability for any breach of that standard is subject to this section 8.

9. Subscriptions, fees and payment

9.1 Plans. The current plans are:

[ROB: Confirm plan names, product limits and which features sit in each plan. Plan names were suggested in the brand draft and the brief gave prices only. Check the features promised in the table match the product as built.]

9.2 VAT. We are not registered for VAT, so no VAT is charged on the Fees. If we register for VAT in future, we will give you notice before VAT is added to the Fees, and VAT will then be charged at the rate in force at that time. [LAWYER: Confirm the notice wording and period for a future VAT registration. Also confirm the EU position for business customers in other member states (including reverse charge), and whether any non-UK customers need a different invoice.]

9.3 Billing. Fees are billed monthly in advance through Stripe ("Stripe"). [LAWYER: name the contracting Stripe entity once confirmed.] You authorise Stripe to charge the payment method you give us for each monthly period until you cancel. We do not store full card numbers.

[LAWYER: Confirm whether Stripe is the correct entity for the EU and non-UK customers, and whether it is a processor or independent controller for billing data. This should match the Privacy Notice.]

9.4 Failed payments. [LAWYER/ROB: If a payment fails, we will try again and tell you. Decide the grace period, whether access is suspended after it, and when the Account is closed. Currently: [TBD].]

9.5 Cancellation. You can cancel at any time from your Account. Cancellation takes effect at the end of the current monthly period. You keep access until then. We do not refund fees for part months, unused time or a part period after cancellation.

Closing your Account under clause 12.5 is different. It takes effect at once: the subscription is cancelled in Stripe on closure, and no further monthly Fees are charged. [LAWYER: Closing ends the current monthly period early. Under this clause the unused part is not refunded. Please confirm that this is fair and enforceable for business customers, or whether a pro rata refund should be given on closure.]

[LAWYER: Confirm that the no-refund rule is enforceable for business customers, and whether it should be subject to an exception for a failure of the Service. ROB: confirm that cancellation can be done from the Account. This is not yet confirmed as built.]

9.6 Trial. New Accounts start with a free trial of 14 days, with the limits of the Team plan. You do not need a payment card to sign up. At the end of the trial you must choose a plan. If you do not, your Account becomes read-only. Until you choose a plan, you can still log in, view your Customer Content, export it under clause 12.4 and close your Account, but you cannot add products or upload new lockfiles or SBOMs. Our daily scans, alerts and weekly summary emails for your existing products continue, subject to clauses 4.2 and 4.3. The same applies if a paid subscription is cancelled or lapses. If your trial ends without a paid plan, your Customer Content stays in your Account until you close it. You can close your Account at any time from the Account page. Clause 12.5 then applies: we permanently delete your data 14 days after closure. [LAWYER: Please confirm whether we should add automatic deletion after a long period of inactivity for trial accounts that never close, and if so the period and the notice to give.]

9.7 Price changes. We may change the Fees by giving you at least 30 days' notice by email to the Account owner. A change takes effect at the start of the first monthly period that begins after the notice period. If you do not accept a change, you may cancel before it takes effect, under clause 9.5.

9.8 Suspension for non-payment. [LAWYER: Confirm whether we can suspend for non-payment, after how long, and whether this should be in clause 10.]

10. Acceptable use

10.1 Upload only what you are allowed to share. You may only upload files, and data about products, that you are entitled to share with us. This means your own products, or products you have permission to assess.

10.2 Do not scan other people's products. You must not use the Service to scan, probe or test any product, network, system or service that you do not own or have written permission to test.

10.3 Do not misuse the Service. You must not:

(a) try to break, bypass or test the security of the Service, or access another customer's data;

(b) upload anything containing malware, or anything designed to harm the Service or its users;

(c) overload the Service, or use automated tools to bypass rate limits, including the limits on free scans and sign-in attempts;

(d) reverse-engineer, copy, resell or sublicense the Service, except as these terms allow; or

(e) use the Service for any unlawful purpose.

10.4 Do not misrepresent the Service. You must not tell anyone that Fristal certifies, approves or guarantees your product or your compliance.

10.5 Suspension. We may suspend your Account or part of the Service immediately if we reasonably believe that it is needed to protect the Service, other customers or any third party, or if you breach this section 10. Where practical we will tell you why and when we expect to restore access. We will restore access once the issue is resolved.

10.6 Termination for breach. We may end these terms by written notice if you breach them and do not fix the breach within [TBD: 14] days of our notice, or immediately if the breach is serious and cannot be fixed.

[LAWYER: Confirm the cure period and whether immediate termination for serious breach should be defined.]

11. Availability and scan failures

11.1 No service level agreement. We do not promise any level of uptime, response time or availability. Planned and unplanned downtime may happen.

11.2 We tell you when scanning fails. If a product has not been checked successfully for more than 26 hours, the product page shows a "last checked" date and a warning banner. We also send a missed-scan alert by email to the Account's registered email address. The banner also shows in the app. You must not rely only on the absence of an alert to tell you that scanning is working.

11.3 Maintenance. [TBD: planned maintenance window, if any, and how it will be announced.]

11.4 Backups. [TBD: backup frequency and retention. Please do not promise a restore time. Note that the database holds the evidence log.]

12. Customer Content and data

12.1 You own your Customer Content. We do not claim ownership of Customer Content.

12.2 Our licence. You give us a non-exclusive, worldwide, royalty-free licence, for the length of your Account, to host, copy, process and transmit Customer Content only to:

(a) provide, secure, support and maintain the Service;

(b) send component names and versions to Third-Party Data sources to check them for matches; and

(c) meet legal obligations that apply to us.

[LAWYER: The brief does not say whether we may also use Customer Content to improve the Service. This draft does not include that. If Rob wants to use aggregated or anonymised data, the wording needs to be added and the privacy notice must match.]

12.3 Personal data. Customer Content is normally about software components and is not personal data. But it may contain personal data, for example names in a file path or a maintainer's name in a package field. Where it does, the Privacy Notice applies to our processing, and [LAWYER: a data processing agreement under Article 28 UK GDPR and EU GDPR should be included, or referred to, for business customers]. You must not upload personal data that you do not have a lawful basis to process.

12.4 Export. You can export your Customer Content at any time from the Account. The exports are:

(a) a CycloneDX SBOM for each product;

(b) for each incident, its reporting checklist and report fields, as JSON, and as a printable HTML page that you can save as PDF from your browser;

(c) the evidence log, as CSV; and

(d) the original lockfile or SBOM file for each upload that we kept, downloaded one file at a time from the product page, as you uploaded it.

Reporting checklists and report fields exist only for an individual incident, not for a product as a whole. [ROB: confirm that each export is built before launch.] You are responsible for keeping copies you need.

12.5 Deleting products and closing your Account.

(a) Deleting a product. You can delete a product at any time from its page. Deletion is immediate and cannot be undone. It permanently deletes the product's data, its stored original files and its evidence-log entries. We keep one organisation-level record that the product was deleted, showing its name, who deleted it, when, and how many items were removed, until your Account is permanently deleted. You cannot delete a product while an incident for it still has a report that is not marked as submitted. This includes the final report, which blocks deletion until it is marked as submitted, even if its 14-day period has not started yet.

(b) Closing your Account. You can close your Account from the Account page by typing your organisation's name and entering your password. The closure page links every export (clause 12.4) before you confirm. Closure takes effect at once: the Account is locked, every user is emailed the date of permanent deletion, and any paid subscription is cancelled in Stripe.

(c) Export before you close. Once your Account is closed, you cannot use the Service for it and cannot export Customer Content. Export anything you need before you close. If you close by mistake, contact us within 14 days to reopen the Account.

(d) Permanent deletion. 14 days after closure we permanently delete everything for your Account: products, components, findings, incidents, the evidence log, users, alert-delivery logs and stored original files. This includes the record of the Terms you accepted. After permanent deletion nothing can be recovered. If a stored file cannot be deleted at first, we retry until it is. Our backups will be overwritten or deleted on the schedule in clause 11.4.

[LAWYER: The evidence log, including the Terms-acceptance record, is deleted at permanent deletion and not kept longer. Please advise whether any record should be kept longer to deal with claims or disputes, such as the closure record. Also confirm the retention of billing records under UK tax and company law. The Privacy Notice must match.]

12.6 Retained records. We may keep records we must keep by law, such as billing and tax records, and records we need to defend or bring a legal claim. These are kept only for as long as needed for that purpose.

12.7 Security. We take reasonable technical and organisational measures to protect Customer Content, as described in the Privacy Notice. No internet service is completely secure. You must keep your login details safe and tell us promptly if you think they have been compromised.

13. Confidentiality

13.1 Each of us will keep confidential the other's confidential information that we receive under these terms, and use it only to perform these terms. This does not apply to information that:

(a) is or becomes public other than through a breach of these terms;

(b) we already knew, or develop independently without using the other's information;

(c) we must disclose by law or by a regulator; or

(d) we disclose to our professional advisers or insurers who are bound by duties of confidence.

13.2 Customer Content is your confidential information. We keep it confidential, except as needed to provide the Service and as the Privacy Notice describes.

13.3 Obligations in this section continue for [TBD: 5] years after these terms end. For trade secrets they continue for as long as the information remains a trade secret.

[LAWYER: Confirm the confidentiality period and whether it is needed alongside the data clauses.]

14. Changes to these terms

14.1 We may update these terms. For a material change we will give you at least 30 days' notice by email to the Account owner. The updated terms take effect on the date stated in the notice.

14.2 Whenever these terms change, we will ask the Account owner to accept the updated terms the next time they log in. We record the version accepted and the time of acceptance. If the Account owner does not accept, they may cancel under clause 9.5.

14.3 If you do not accept a material change, you may cancel under clause 9.5 before it takes effect.

[LAWYER: Please confirm the re-acceptance mechanism. Decide whether continued use after a change should still count as acceptance, and what the Service should do for an Account that does not re-accept (for example, read-only access so that the customer can export and cancel). A customer who cancels because of a material change may expect a pro rata refund. The brief says no refunds for part months. Please decide whether this is an exception.]

15. Ending these terms

15.1 These terms start when you create an Account and continue until the Account is closed.

15.2 Either of us may end these terms by giving notice through the Service or by email. Your notice takes effect at the end of the monthly period in which it is given (clause 9.5). Closing your Account under clause 12.5 takes effect at once. We may end these terms immediately, by written notice, if you do not pay, or if clause 10.6 applies.

15.3 When these terms end, your access to the Service ends, and clause 12.5 applies to your Customer Content. Clauses 6, 8, 12.5, 12.6, 13, 15.3, 16 and 17 continue to apply after these terms end, together with any other clause that by its nature should continue.

16. General

16.1 Entire agreement. These terms and the Privacy Notice are the whole agreement between us about the Service. They replace any earlier statements. [LAWYER: Please check whether the landing page and marketing copy need to be listed here. Nothing in this clause excludes liability for fraud.]

16.2 Assignment. You may not transfer your rights under these terms without our written consent. We may transfer our rights to a successor to all or part of our business, and we will tell you if that happens.

16.3 Force majeure. Neither of us is liable for a delay or failure caused by events beyond our reasonable control. This does not excuse payment of Fees. [LAWYER: Check the wording and whether a longer period should apply.]

16.4 Notices. Notices to you go by email to the Account owner. Notices to us go by email to legal@fristal.com, or by post to our registered office. A notice sent by email is treated as received on the next business day after it is sent, unless the sender receives a delivery failure message. [LAWYER: Confirm the deemed receipt rules.]

16.5 Third-party rights. No one other than us and you has any right to enforce these terms under the Contracts (Rights of Third Parties) Act 1999.

16.6 Severance. If any part of these terms is found to be unenforceable, the rest stays in force.

16.7 Waiver. If we do not enforce a right straight away, we have not given it up.

17. Governing law and jurisdiction

17.1 These terms, and any dispute or claim arising out of or in connection with them or the Service (including non-contractual claims), are governed by the law of England and Wales.

17.2 The courts of England and Wales have [TBD: exclusive / non-exclusive] jurisdiction to settle any such dispute or claim.

[LAWYER: Please decide between exclusive and non-exclusive jurisdiction, and whether to add a short negotiation step before proceedings. Please also check whether an EU customer can be sued or can sue in its own courts under the rules that apply to it, and whether a choice of English law and courts will be respected there.]

Last updated: [TBD: date of final version].