DRAFT — not yet reviewed. Have this reviewed (and every [PLACEHOLDER] filled in) before launch.
Terms of Service (including Data Processing Terms)
Version 2026-10-draft-1. Applies to Officexai at officexai.co.uk.
1. The agreement
These terms are between [BUSINESS NAME], [COMPANY ADDRESS] ("we") and the business or person who signs up ("you", the member). The service is for business use. By ticking the box at sign-up you accept these terms, including the Data Processing Terms in section 9, and confirm you have read the Privacy Policy.
2. Accounts
Keep your password safe. You are responsible for what happens under your account and for the people you let use it. We may suspend an account that breaks these terms or puts the service at risk.
3. Trials, payment and cancelling
New workspaces get a free trial. Paid desks are billed monthly through Stripe; we never hold your card details. You can cancel at any time in Settings → Billing; access continues to the end of the paid month. [Owner: state your refund policy.] Prices include/exclude VAT [CHOOSE].
Testers and sales agents. Tester and sales-agent access is free for the period shown in your account (usually one month). When it ends, the desks lock until you subscribe; your data is kept and normal account rules apply (including deletion of inactive free accounts). Sales agents may only create tester codes for desks they have, within the limits shown, and must not sell or publish codes. Referral scheme (only when we run it): a new customer who joins with a paying member's link gets 10% off their first desk purchase, and the referrer gets 10% off their next payment once that purchase is confirmed. One reward per referred customer; no cash value; we may end the scheme or refuse abusive referrals (for example self-referrals). [DRAFT — review]
4. Acceptable use
Don't use the service for anything unlawful, to store data you have no right to hold, to send spam, or to try to break or overload it.
5. AI apps and automated suggestions
You may connect your own AI app (for example Grok by xAI or Claude by Anthropic). Your use of that app is under your agreement with its provider. The service's automated checks (for example UK working-time warnings and cover suggestions) are aids only. Rota changes and leave approvals requested by an AI wait until a person approves them. You remain responsible for decisions about your staff and should check suggestions before publishing a rota.
6. Trading Journal
The Trading Journal records and analyses your own trades. It is not financial advice and cannot place trades.
7. Liability
We provide the service with reasonable care and skill. We are not liable for indirect loss, loss of profit or for decisions you make using the service. Our total liability in any 12 months is limited to the fees you paid in that period. Nothing limits liability that cannot be limited by law. [Owner: have this clause reviewed.]
8. Ending the agreement and deletion
You can close your account at any time in Settings → Your data; this deletes your workspace data on every desk and your account. Download a copy first if you need one. Free accounts with no sign-in for 30 days get a warning email and are deleted if there is no sign-in within a further 14 days. Paid and lifetime accounts are never deleted this way.
9. Data Processing Terms (UK GDPR Article 28)
9.1 Roles. For personal data you put into your workspace ("Customer Data") you are the controller and we are your processor. You are responsible for having a lawful basis, telling people (for example your staff and contacts) how their data is used, keeping it accurate and only adding what you need. Take extra care with special category data such as health information (for example sickness reasons).
9.2 Subject, duration, nature and purpose. Storing and processing Customer Data to provide the desks you use, for as long as your account is open. Types of data: names, contact details, job and contract details, shifts, leave and absence, notes, sales records, trades and journal notes. Data subjects: your staff, contacts, customers and you.
9.3 Instructions. We process Customer Data only on your documented instructions — which are these terms and your use of the service's features (including AI apps you connect) — unless the law requires otherwise, in which case we will tell you if allowed.
9.4 Confidentiality. Anyone we authorise to access Customer Data is bound by confidentiality. Administrators only look at workspace data when needed to support you, fix a problem or meet a legal duty.
9.5 Security. We keep appropriate technical and organisational measures: HTTPS, hashed passwords and keys, encrypted exchange keys, workspace separation, access controls and backups on UK servers.
9.6 Sub-processors. You give general authorisation for these sub-processors: [HOSTING PROVIDER — e.g. IONOS, UK data centre] (hosting, UK); Stripe (payments — billing data only); xAI (Grok) and Anthropic (Claude) only when you connect them, and then under your own account with them; [EMAIL PROVIDER] (service emails). We will tell you before adding or replacing a sub-processor so you can object, and we impose data protection terms on them as required.
9.7 International transfers. Where a sub-processor processes data outside the UK we rely on a lawful transfer mechanism (UK adequacy regulations, UK-US Data Bridge or IDTA/Addendum).
9.8 Helping you. We help you answer data subject requests (you can export and delete data yourself in the service), and with security, breach notification and impact assessments, taking into account the information available to us.
9.9 Breach notice. We will tell you without undue delay, and aim to within 48 hours, after becoming aware of a personal data breach affecting Customer Data, with the information you need to tell the ICO (within 72 hours) and the people affected.
9.10 Deletion on termination. When your account is closed or deleted we delete Customer Data from the live service straight away and from backups within [BACKUP RETENTION] days, unless the law requires us to keep it. You can download a copy beforehand.
9.11 Audits. We will make available the information reasonably needed to show we meet these terms, and allow reasonable audits on notice.
9.12 Our own data. For your account, billing and security data we are the controller — see the Privacy Policy.
10. General
We may update these terms and will give notice of material changes. These terms are governed by the law of England and Wales. Contact: [CONTACT EMAIL].