Terms of Service

1. Parties and agreement

These Terms of Service (“Terms”) form a binding agreement between GBOS (the “Company”, “we”, “us”) and the individual or entity that registers for the GBOS platform (the “Service”).

The Company is [SOLICITOR TO CONFIRM: registered legal name, company number, and registered office address]. GBOS is a multi-tenant business operating system: an authenticated web application (hosted on Vercel) backed by a managed PostgreSQL database (Neon) in which each customer’s workspace ("tenant") is isolated.

By creating a workspace or using the Service you accept these Terms. If you are accepting on behalf of an organisation, you confirm you have authority to bind it. If you do not accept, do not use the Service.

The Service is offered for business use. [SOLICITOR TO CONFIRM] whether and how consumer use is permitted or excluded, and the effect of consumer-protection law where it cannot be excluded.

2. Accounts, workspaces and tenant isolation

You are responsible for activity in your workspace, for maintaining the confidentiality of credentials, and for ensuring your users comply with these Terms and the Acceptable Use Policy.

Each workspace (tenant) is logically isolated. GBOS enforces isolation both in the application and independently at the database layer using PostgreSQL row-level security (fail-closed), so an account may only access data belonging to its own tenant. You must not attempt to access another tenant’s data or probe the isolation boundary except under an authorised, scoped security test (see the Acceptable Use Policy).

Multi-factor authentication (TOTP with backup codes) is available to all users, and sensitive financial approvals require a server-verified second factor (step-up).

3. Your data and our role

You retain ownership of the data you and your users put into the Service ("Customer Data"). You grant us the limited rights needed to host, process and secure it to provide the Service.

For Customer Data, you are the data controller and GBOS is the data processor; our processing is governed by the Data Processing Addendum (DPA). For account and website data where we decide the purposes, GBOS is the controller — see the Privacy Policy.

You may export your Customer Data at any time using the in-product governed export, and you may request deletion of your workspace (see clause 7 and the Privacy Policy).

4. Subscriptions, plans, billing and renewal

The Service is offered on subscription plans (which may include a free trial). Plan features, seat allowances and pricing are described in-product and may change on reasonable notice.

Fees are billed in advance for each period and are non-refundable except as required by law or as expressly stated. Where credits or refunds are granted they are issued as first-party credit notes. Payment-provider integrations are not yet activated; [SOLICITOR TO CONFIRM] billing, tax-invoicing, auto-renewal disclosure and refund/cancellation terms against the law of each market in which the Service is sold.

5. Acceptable use

Your use of the Service is subject to the Acceptable Use Policy, which is incorporated into these Terms. In summary: no unlawful use, no infringement of others’ rights, no malware, no attempts to break tenant isolation or the governance controls, and no unauthorised security testing.

We may suspend a workspace that presents a security risk or materially breaches this clause, with notice where practicable.

6. Autonomous agents and automation

GBOS can run autonomous agents that act within your workspace. Every agent is a governed principal: it acts within a configured authority limit, consequential actions (spend, external effects, sensitive-data actions) are held for human approval by default, a halted agent can take no action, and every agent action is audited with agent provenance.

You are responsible for the authority limits and approvals you configure for agents in your workspace.

7. Term, suspension and termination

Either party may terminate as described in-product or in an order form. On termination you may export Customer Data for a limited window, after which it is deleted or anonymised in line with the Privacy Policy and our retention practice.

Account deletion runs a governed, confirmed, grace-gated process that removes tenant-scoped data and anonymises the workspace record, leaving an immutable deletion record.

8. Warranties and disclaimers

We provide the Service with reasonable skill and care. Except as expressly stated and to the maximum extent permitted by law, the Service is provided “as is” and we disclaim implied warranties of merchantability, fitness for a particular purpose and non-infringement.

GBOS provides business tooling; it is not a substitute for professional accounting, tax, legal or financial advice. Nothing in these Terms limits liability that cannot be limited by law. [SOLICITOR TO CONFIRM] the extent to which these disclaimers are enforceable in each target jurisdiction.

9. Liability and indemnities

PLACEHOLDER — REQUIRES QUALIFIED DRAFTING. [SOLICITOR TO CONFIRM] the limitation of liability (including any aggregate cap, e.g. by reference to fees paid), the categories of excluded loss, any indemnities (and whether mutual), and the interaction with the Company’s insurance. GBOS makes no representation that any particular cap is enforceable.

10. Confidentiality

Each party will protect the other’s confidential information and use it only to perform under these Terms, subject to legal disclosure obligations.

11. Changes to the Service and to these Terms

We may improve or change the Service. We may update these Terms; material changes will be notified and may require renewed acceptance. The version you accepted is recorded against your account.

12. Governing law, disputes and contact

These Terms are drafted to be governed by the laws of England & Wales, with the courts of England & Wales having jurisdiction. [SOLICITOR TO CONFIRM] governing law, jurisdiction and any dispute-resolution mechanism given the global, multi-jurisdiction user base.

Contact: legal@[YOUR-DOMAIN] (owner to set the operational legal contact).