Terms of Service

Last updated: September 17, 2026

1. About our Terms of use

1.1 Who we are

Consent Pro is provided by Finsweet Inc., a New York corporation with its principal place of business at 1732 Pettit Avenue, Unit A, Merrick, New York 11566, United States ("Finsweet", "we", "us", "our"). You can reach us at legal@finsweet.com.

1.2 What these Terms cover

These Terms govern your access to and use of Consent Pro — the consent management platform we make available at consentpro.com, including the hosted management interface, the client-side script you install on your websites, the scanning and detection service, our APIs, and our documentation (together, the "Service").

These Terms do not cover any other Finsweet product. If you also use Wized, Attributes, Client-First, Components, CMS Bridge, the Finsweet Extension, the Finsweet Forum or Finsweet's agency services, those are governed by the Finsweet Terms of Service and, where applicable, a separate Master Services Agreement.

1.3 Who may use the Service

The Service is offered to businesses and other organisations only. It is not offered to consumers, and it is not offered to individuals acting outside a trade, business, craft or profession.

You must be at least 18 years old to open an account or accept these Terms, and you must be acting on behalf of an organisation that you are authorised to bind. If you are accepting these Terms on behalf of an organisation, "you" means that organisation, and you confirm you have authority to bind it.

We do not knowingly make the Service available to anyone under 18. If we learn that an account has been opened by or for someone under 18, we will close it.

1.4 How these Terms fit with our other documents

Where documents conflict, the following order applies, highest first:

1. A separately signed written agreement between you and us that expressly refers to these Terms and states that it prevails.
2. The Finsweet Data Processing Agreement — but only as to the processing of personal data. On any matter of data protection law, the DPA prevails over these Terms.
3. These Terms.
4. The Consent Pro documentation, product notices and any policy referenced in these Terms.

Nothing in this clause limits any right you have under applicable data protection law, or purports to reduce any obligation we owe as a processor. For the avoidance of doubt, the DPA's precedence on matters of data protection law does not disapply §15 (Liability) of these Terms: the liability allocation and cap in §15 continue to apply to claims arising under or in connection with the DPA or applicable data protection law, to the maximum extent permitted by applicable law.

1.5 Changes to these Terms

We may change these Terms. If a change is material — for example, a change to fees, to the liability provisions, to how we handle Consent Data, or to the dispute resolution provisions — we will notify you by email to your account's primary email address at least 30 days before the change takes effect.

If you hold a monthly or annual subscription and you do not agree to a material change, you may terminate under §11.2 before it takes effect, and we will refund the prepaid fees attributable to the period after termination. If you hold a Lifetime Plan, terminating under this §1.5 does not itself entitle you to a refund; §10.5 governs. Continuing to use the Service after a material change takes effect means you accept it.

Non-material changes take effect when we post them.

2. Definitions

"Consent Data" means the records the Service creates and stores relating to consent choices made by End Users on your Properties, including the fields listed at §8.2.

"Personal Data" has the meaning given in the Finsweet Data Processing Agreement.

"End User" means a visitor to one of your Properties.

"Properties" means the websites, applications and domains you register in your account and on which you deploy the Service.

"Your Configuration" means the settings, categorisations, banner text, translations, regional rules and other choices you make in the Service.

"Lifetime Plan" means a subscription plan purchased for a single one-time fee rather than recurring payments, as further described in §3.9.

3. The Service

3.1 What we provide

Subject to these Terms and to payment of the applicable fees, we will provide you with access to the Service for your internal business purposes and for deployment on your Properties.

3.2 What we do not promise

Consent Pro is a tool. It is not legal advice, and using it does not by itself make you compliant with any law.

Consent and cookie rules differ between countries, are interpreted differently by different regulators, and change. Whether your use of trackers is lawful depends on facts we do not control: what trackers you run, what they do, how you have categorised them, what your banner says, what your privacy notice says, and how your Properties behave. We do not represent that using the Service will result in compliance with the GDPR, the ePrivacy Directive as implemented in any Member State, the CCPA/CPRA or any other law, and we do not act as your legal adviser. We recommend you take local legal advice on your implementation.

We do not warrant compatibility with, or continued support for, any particular browser, operating system, application programming interface, third-party platform, vendor, or integration. These are outside our control and may change independently of the Service, including over the multi-year period for which you may use a Lifetime Plan (§3.9).

What we do commit to is this: the Service will perform materially as described in our documentation, and where it does not, §15 sets out what you are entitled to.

3.3 Availability

We aim to provide reliable, continuously available service and we monitor the availability of the consent ingest endpoint and the client-side script delivery. Current and historical availability for these components is published at https://status.finsweet.com/, for informational purposes only. We do not guarantee that the Service will be uninterrupted, continuous or error-free, and this section does not create a service level agreement or an uptime commitment. A dedicated service level agreement may be offered separately to Enterprise customers under a signed agreement.

3.4 Behaviour when the Service is unavailable

If the Service, the client-side script, or the mechanism used to retrieve or apply consent state is unavailable or cannot be reached, blocking behaviour depends on how a given tracker is configured to be blocked. Trackers you have manually tagged for blocking, and tags gated on our consent-management trigger in a tag-manager container, are designed to remain blocked without the Service being reachable. Trackers that rely on the Service's own automatic detection and blocking may run during such an outage or period of unavailability, because the client-side script has no way to identify or block them without the Service being reachable. We do not guarantee that any non-essential tracker will remain blocked during an outage or other period of unavailability, and we are not responsible for trackers that fire during one. Trackers you have categorised as strictly necessary are unaffected.

You are responsible for determining whether this behaviour is appropriate for your Properties, your End Users, and the laws applicable to you, and for implementing any additional safeguards you consider necessary.

3.5 Automatic blocking — known limitations

The Service's automatic detection and blocking is designed to prevent non-essential trackers from loading until the applicable consent has been given. It is not a guarantee that every tracker, request, or resource on a Property will be intercepted before it begins.

Even where the client-side script is installed correctly and executes as the first script on a page, a request can still leave the browser before the Service can stop it.

A browser may discover, preload, or otherwise initiate a network request for a resource on the page before the Service's blocking logic has initialised. It may also initiate such a request for a resource further down the page after the blocking logic has initialised, before the Service can intercept the element that would make it. A third party that receives such a request may process data or set cookies. This is a characteristic of how browsers load pages; it is not a defect in the Service, and it can occur independently of Your Configuration.

Separately, automatic blocking applies to elements on the page that the Service intercepts. It does not intercept a request the page or a script makes without loading such an element, including a request made with fetch, XMLHttpRequest, or sendBeacon, or by constructing an image in script and setting its source. A request of that kind can be made after the blocking logic has initialised.

Trackers you have manually tagged for blocking are less exposed to browser discovery and preloading, because they are not requested until the Service releases them. A tag gated on our consent-management trigger in a tag-manager container is likewise not requested until the Service releases it, including where that tag would make a request of the kind described in the previous paragraph. Where you need a higher degree of certainty that a particular tracker will not be requested before consent, you should use those mechanisms rather than relying on automatic detection and blocking alone. We do not warrant that automatic blocking will prevent every pre-consent request. We are not responsible for a pre-consent request that a browser initiates for a page resource, whether before or after the Service's blocking logic has initialised, or for a request that automatic blocking does not intercept, including a request made with fetch, XMLHttpRequest, or sendBeacon, or by an image constructed in script. You are responsible for testing your implementation, for determining whether this behaviour is appropriate for your Properties, your End Users, and the laws applicable to you, and for implementing any additional safeguards you consider necessary.

3.6 Support

We provide support to help you configure and operate the Service. Support is available by email to support@finsweet.com and through the resources in our documentation. Standard support is provided on a commercially reasonable, best-efforts basis: we do not guarantee any acknowledgment, response, or resolution time under these Terms. Support covers the Service as supplied; it does not extend to advising you on your legal obligations, to your implementation on your Properties, or to third-party software. Support under this §3.6 is separate from, and is not a substitute for, any statutory deadline that applies to a data subject or privacy-rights request (for example under the GDPR or the CCPA) — those requests are handled as described in our Privacy Policy and, where applicable, our Data Processing Agreement, not under this §3.6. Any enhanced or priority support is as stated in your plan (see https://consentpro.com/pricing) or in a separately signed written agreement with us; a future Enterprise agreement, for example, may include specific support or service-level commitments that standard support does not provide. If you have questions about which support tier applies to you, contact Consent Pro support.

3.7 Changes to the Service

We improve the Service continuously and may add, change or remove features. You will find a summary of feature updates in our changelog, and you may contact our support team if you have an issue with the released updates or terminate under §11.2 if the change materially reduces the value of the Service to you.

A change to a feature, integration, functionality, usage limit, or support arrangement under this §3.7 does not, by itself, entitle you to a refund, credit, or damages. §10.5 governs any discretionary refund or credit, and §15 governs any liability we may otherwise have to you arising from such a change. If you hold a Lifetime Plan, terminating under §11.2 stops your access but, because a Lifetime Plan involves no further recurring fees, gives you nothing further beyond that.

We may make changes without notice where they are needed to address a security vulnerability, to comply with law, or to prevent harm.

3.8 Beta features

We may offer features identified as beta, preview or early access. These are optional, are provided as-is, are excluded from §3.3 and §3.4, and may be changed or withdrawn at any time. Do not deploy a beta feature on a Property where a failure of that feature would create legal exposure for you.

3.9 Lifetime Plans

A Lifetime Plan is a single, one-time purchase. It does not automatically renew, and there are no recurring subscription fees for it (§10.2 does not apply to it). "Lifetime" means access to the Service under that plan for as long as we continue to make the Service generally available. It does not mean your lifetime or the lifetime of any individual, and it does not guarantee that the Service, or any particular feature, integration, functionality, usage limit, support level, or third-party dependency, will remain available, unchanged, or compatible indefinitely. The Service continues to evolve under §3.7, and a Lifetime Plan does not create a perpetual service level commitment, support commitment, feature guarantee, compatibility guarantee, or an obligation to update the Service for future changes in law or regulatory guidance.

We may discontinue the Service in its entirety under §11.4. Neither discontinuation, nor a change to a feature, integration, functionality, usage limit, or support arrangement under §3.7, by itself entitles a Lifetime Plan customer to a refund, credit, or damages. §15.2(b) governs the maximum amount recoverable if we are otherwise liable to you, and §10.5 governs any discretionary refund, credit, migration assistance, or other accommodation we may choose to offer in connection with a discontinuation or change.

4. Your account

4.1 Registration and accuracy

You will provide accurate registration information and keep it current. We use your primary email address for service notices, billing and the notifications required by §1.5 and §3.7, so it must be an address you monitor and which can receive our mail.

4.2 Credentials and account security

You are responsible for your credentials and for activity under your account. Tell us promptly at security@finsweet.com if you believe your credentials have been compromised.

4.3 Authorised users

You may permit your employees and contractors to use the Service on your behalf. You are responsible for their compliance with these Terms.

4.4 Agencies, resellers and other intermediaries

If you use the Service to deploy Consent Pro on a Property belonging to a client of yours:

a) you confirm you are authorised by that client to deploy and administer the Service on its Property and to act on its behalf for those purposes;

b) you will make these Terms and the Consent Pro Privacy Policy available to that client;

c) you may access Consent Data relating to that client's Property only to configure and administer the Service for them; and

d) you must not sell, share, or use for your own purposes any Consent Data relating to that client's Property.

The client does not become a party to these Terms solely because you deploy or administer the Service on its Property.

4.5 Domains and Properties

You will only add Properties you own or are authorised to add. Adding a Property authorises us to scan it as described in §6. You are responsible for the accuracy of the domains you enter.

4.6 Ownership disputes

If two or more parties claim rights to an account, we may ask for documentation and, if the dispute is not resolved, suspend access to the account until it is resolved between them or determined by a court or other competent authority.

We will not transfer control of an account, or of any Consent Data, to a party other than the account holder of record except on the written instruction of the account holder, or where we are compelled to do so by a binding legal order.

5. Your responsibilities

5.1 Implementation

Consent Pro is a self-serve service. We supply the software; you decide how it is deployed. You are responsible for installing the script correctly, for placing it so that it executes before non-essential trackers, and for testing your implementation. Correct placement does not eliminate the limitations described in §3.5. We are not responsible for non-compliance arising from your incorrect implementation of the Service.

5.2 Tracker categorisation

The Service detects trackers on your Properties and proposes a category and purpose description for each. Those proposals are a starting point, not a determination.

You are responsible for reviewing each proposed categorisation against what the tracker actually does on your Property, and for correcting it before it goes live. Pay particular attention to the strictly necessary category: a tracker belongs there only if it is genuinely required to deliver a service the End User has asked for. Categorising a marketing or analytics tracker as strictly necessary will cause it to fire without consent.

§7.2 sets out how this works where a categorisation was proposed by an AI-assisted feature.

5.3 Your End Users

You decide what to tell your End Users and on what legal basis you process their data. You are responsible for your privacy notice, for the accuracy of the banner text and purpose descriptions you publish, for having a lawful basis for the trackers you run, and for handling data subject requests your End Users make to you. §8 sets out what we can and cannot do to assist.

5.4 Prohibited uses

You will not: use the Service to collect special category data or children's data through the banner; configure the Service so that it records a consent an End User did not give; use the Service to build a profile of an identified individual; resell or sublicense access to the Service except under §4.4; disable, bypass, circumvent, or tamper with the Service's consent, blocking, or security logic, or attempt to do so — including by modifying the client-side script, manipulating stored consent state other than through the Service's own interfaces, or configuring the Service to misrepresent an End User's actual choice; deliberately attack, disrupt, or seek unauthorised access to the Service or our systems; or use the Service in a way that breaks the law.

5.5 Health and other regulated data

The Service is not designed for and must not be used to process Protected Health Information as defined by HIPAA, or data subject to GLBA or FISMA.

6. Scanning and detection

We scan the Properties you register to detect trackers, on the frequency applicable to your plan. The number of URLs scanned per Property in a given scan is determined by your applicable plan, order, or Service configuration, and we may establish or change technical or plan-based scanning limits from time to time without amending these Terms. Scans are a sample of your Property, not an exhaustive inventory, and a tracker that does not appear in a scan may still be present — for example because it fires only on a page we did not reach, only for logged-in users, or only in response to a user action.

You remain responsible for knowing what runs on your Properties.

7. AI-assisted features

7.1 What they do

Parts of the Service use AI models supplied by a third party to (a) propose categories and purpose descriptions for detected trackers and (b) assist in completing configuration forms.

The AI vendor we use is listed on our Subprocessors page at https://trust.finsweet.com/subprocessors.

7.2 Your review of AI-assisted output

Categorisations and purpose descriptions proposed by an AI-assisted feature are presented to you for review and are not applied to your site until you confirm them. Once you confirm a categorisation, it becomes part of Your Configuration and §5.2 applies to it. Where you confirm a proposed categorisation without reviewing it, the categorisation is still yours.

7.3 Your data and model training

We do not permit the AI vendor to use your inputs or outputs to train their models.

7.4 Accuracy

AI-assisted output can be wrong. It is provided to reduce your effort, not to replace your judgement. §5.2 and §7.2 apply.

7.5 Transparency

No AI-generated text currently reaches your End Users: generated policy documents are template-rendered from your own submitted form data with no AI involvement, and the AI-assisted tracker-categorisation feature is confirmed to your dashboard for your own review (§7.2), not published to End Users. If that changes, any AI-generated text published to your End Users will be marked as such in a machine-readable form, and this section will be updated to describe the mechanism.

8. Consent Data

8.1 Our role

In relation to Consent Data we act as your processor. You are the controller. We process Consent Data only on your documented instructions, which comprise these Terms, the DPA and Your Configuration.

The DPA governs our data protection obligations and prevails over this §8 on any question of data protection law (§1.4).

8.2 What a consent record contains

Each consent record contains:

• a pseudonymous identifier for the End User (§8.3);
• a UUID for that interaction (this is the ID shown in Logs and CSV, not the hashed user identifier).
• the domain of the Property;
• the consent choice made, by category;
• the date and time of the choice;
• the Consent Pro site/project.
• use action: accept_all, reject_all, submit, or preferences.
• origin + path at the time of the choice (no query string).
• copy shown on the banner when they consented (optional).
• record source: banner, preferences, or api.
• the banner mode: opt-in, opt-out, informational, or dont-sell.
• the runtime’s detected region.
• browser UA string.
• the runtime version.
• the providers and trackers ids (and later-enriched metadata) active at the time of consent.
• optional forwarding fields if a custom storage endpoint is configured.

8.3 The pseudonymous identifier

The identifier in each consent record is derived by combining the End User's IP address with a secret value we hold, hashing the result (SHA-256) and truncating it. The raw IP address is not stored. The identifier is pseudonymous, not anonymous: because we hold the secret, it remains personal data, and we treat it as such. The interaction UUID recorded alongside it (§8.2) is generated by the client and is not derived from the IP address.

8.4 Where Consent Data is stored

Consent Data is stored in Cloudflare R2 in the Western Europe region.

8.5 Retention

Our retention policy is to keep each consent record for 5 years from that record's own date — the date of the consent interaction it reflects. Where an End User later makes a new choice, that choice is recorded as a separate consent record with its own five-year period; an earlier record's retention period is not extended or reset by a later one. We have not yet implemented an automated mechanism that deletes a record once this period elapses — until we do, a record is not automatically deleted at the five-year mark. Aggregated, non-identifying statistics derived from them are retained for as long as your account is open.

8.6 Your access to Consent Data

You may export the consent records for your Properties from the management interface at any time. Once exported, you are responsible for the exported copy.

8.7 Deletion of individual records

We do not currently support deletion of an individual consent record, a specific End User's records, or a Property's consent logs, through the Service or via API. Where you need such data deleted before the retention period described in §8.5 otherwise applies, we will delete it as part of a full removal of your data from the Service, carried out manually on your request under our existing account-level deletion process.

8.8 Global Privacy Control and other browser signals

Where an End User's browser transmits a Global Privacy Control signal, the Service honours it at runtime and applies it to banner behaviour in accordance with Your Configuration. Consent records do not currently capture whether a Global Privacy Control signal was received or whether it was applied to the choices recorded; this matches §4.2 of the DPA. If that changes, this section and the DPA will be updated together.

8.9 Demonstrating consent

The consent records we hold are intended to help you demonstrate consent under Art. 7(1) GDPR and equivalent provisions. We do not warrant that they will be sufficient for that purpose in any particular case, and §8.6 to §8.8 describe the current limits of what we can produce.

9. Data protection

9.1 The DPA

Our processing of Personal Data, including Consent Data, is governed by the Finsweet Data Processing Agreement, which forms part of these Terms. See consentpro.com/legal/data-processing-agreement — the DPA is available on request by emailing privacy@finsweet.com.

9.2 Sub-processors

We use sub-processors to provide the Service. The current list is at https://trust.finsweet.com/subprocessors. We will notify you of additions in advance and you may object as set out in the DPA.

We remain responsible to you for the performance of our sub-processors' data protection obligations. This §9.2 does not allow us to disclaim that responsibility merely because a failure originated with a sub-processor, but this responsibility remains subject to, and is not an exception to, §15.

9.3 International transfers

Transfers of Personal Data out of the EEA, the UK and Switzerland are made under the mechanisms set out in the DPA.

9.4 Security

We maintain technical and organisational measures appropriate to the risk, described in the DPA.

9.5 Audit

Your audit rights are set out in the DPA.

9.6 Personal data breach

We will notify you of a personal data breach affecting Personal Data without undue delay after becoming aware of it, with the information required by Art. 33(3) to the extent available to us, and will supplement as more becomes known.

10. Fees and payment

10.1 Fees

Current plans, features and fees are set out at https://consentpro.com/pricing, or in a separately signed written agreement with us. If you have questions about pricing, contact Consent Pro support. Fees are charged per Property and per subscription period.

10.2 Billing and renewal

Subscriptions renew automatically for successive periods unless cancelled before the end of the current period. We bill monthly or annually in advance according to your plan.

10.3 Taxes

Fees are exclusive of taxes. You are responsible for applicable sales, use, VAT and similar taxes, other than taxes on our income. If you are exempt, provide a valid certificate.

10.4 Price changes

We may change fees on at least 30 days' notice by email, effective from your next renewal.

10.5 Refunds

Refunds, credits, and other accommodations are granted, if at all, at our sole discretion, evaluated case by case. Cancelling, ceasing to use the Service, disagreeing with a change to the Service or these Terms, or holding a Lifetime Plan does not, by itself, entitle you to a refund, credit, or accommodation, except as expressly stated in §1.5.

If we do grant a discretionary refund or credit: for a Lifetime Plan, it will not exceed the amount you actually paid for that plan; for a monthly or annual subscription, it will not exceed the fees you actually paid, looking back no more than 12 months. These are maximum possible amounts, not entitlements to any amount.

Granting a refund, credit, or other accommodation to you or to another customer in one case does not create an entitlement, obligation, or precedent for any other case.

This section does not limit any refund or similar right that applicable law expressly grants and that cannot be excluded by contract.

10.6 Non-payment

If fees are overdue, the following applies.

(a) Payment method. Fees are charged automatically to the payment method you have on file on each billing date. You are responsible for keeping a valid payment method on file and for updating it before it expires or is replaced.

(b) Failed charge. If a charge fails, we will notify you at the billing contact address on your account and will re-attempt the charge over a period of at least 30 days. The Service continues without interruption during that period.

(c) Suspension. If fees remain unpaid at the end of that period, we may suspend the Service. We will give you at least 7 days' written notice before suspension takes effect, and that notice may be given during the period in paragraph (b). §11.5 applies to what happens to your Properties on suspension.

(d) Reinstatement. Suspension ends when the outstanding amount is paid in full.

(e) Termination. If fees remain unpaid for 30 days after suspension, we may terminate your account under §11.4. Deletion of your Properties following termination is governed by §11.5.

(f) Lifetime payments. Paragraphs (b) and (c) above apply only to recurring billing. If the one-time fee for a Lifetime Plan is charged back, reversed, disputed and resolved against us, fraudulently obtained, or otherwise not ultimately received by us in full, we may suspend or terminate your access to that Lifetime Plan under §11.3 or §11.4 without the notice periods in paragraphs (b) and (c). Access under a Lifetime Plan is not irrevocable where the original payment was not ultimately received.

11. Term, suspension and termination

11.1 Term

These Terms apply from your acceptance until terminated.

11.2 Your termination

You may terminate at any time by cancelling in your account. Termination takes effect at the end of your current billing period unless you are terminating under §1.5 or §3.7, in which case it takes effect on the date you specify. Terminating under this §11.2 does not itself entitle you to a refund of fees already paid, except as provided in §1.5; §10.5 governs any other discretionary refund.

11.3 Suspension

Except where §10.6 provides a different payment-related process, we may suspend your access immediately, without a cure period, where reasonably necessary because of: your prohibited or unlawful use of the Service (§5.4); abuse, attack, or interference affecting the Service or its infrastructure; a security threat; excessive load or material disruption to the Service for other customers; nonpayment or a payment reversal (§10.6); your activity creating material legal or regulatory exposure for Finsweet or the Service; where required by law; or where §4.6 (ownership disputes) applies. We will restore access when the cause is resolved, except where we instead terminate under §11.4.

11.4 Our termination

We may terminate for material breach that you do not cure within 30 days of written notice, or immediately where the breach cannot be cured or where required by law. We may terminate for convenience on six months' notice.

11.5 What happens to your Properties

When your subscription ends, the Service stops working on your Properties. Depending on your implementation and on §3.4, that may mean your banner stops rendering. Remove the Consent Pro script from your Properties before your subscription ends. We are not responsible for the consequences of leaving it installed after termination.

11.6 Your data after termination

On termination we will, at your election, delete or return all Personal Data, and delete existing copies, except where we are required by law to retain it.

11.7 Survival

§§2, 3, 5, 6, 7, 8.1, 9, 11.5–11.7, 12, 13, 14, 15, 16, 17, 18 and 19 survive termination.

12. Intellectual property

12.1 Our rights

We own the Service, including the software, interfaces, documentation, designs and marks. These Terms grant you a licence, not a sale.

12.2 Your licence

We grant you a non-exclusive, non-transferable, revocable, worldwide licence to use the Service and to deploy the client-side script on your Properties for the term of your subscription, in accordance with these Terms.

12.3 Restrictions

You will not reverse engineer, decompile or disassemble the Service, or attempt to derive its source code, except to the extent that this restriction is prohibited by applicable law, including Article 6 of Directive 2009/24/EC and the equivalent provisions of the Copyright, Designs and Patents Act 1988 as they apply to lawful users.

You will not remove proprietary notices, or sublicense, resell or make the Service available to third parties except as permitted by §4.4.

12.4 Your Configuration and content

You own Your Configuration and any content you supply. You grant us a licence to use it as needed to provide the Service.

12.5 Feedback

If you give us suggestions for improving the Service, we may use them without obligation to you. This does not affect your rights under data protection law.

12.6 Publicity

We may identify you as a customer and use your name and logo in our customer lists and marketing, and you may revoke that permission at any time by emailing legal@finsweet.com.

13. Confidentiality

Each party will protect the other's confidential information with at least reasonable care, use it only for the purposes of these Terms, and disclose it only to personnel and advisers who need it and are bound to keep it confidential.

The obligation does not apply to information that is public other than through breach, was already known, is independently developed, or is lawfully received from a third party. A party compelled by law to disclose will, where permitted, give notice and cooperate to limit the disclosure.

These obligations continue for five years after termination, and indefinitely for information that constitutes a trade secret.

14. Warranties and disclaimers

We warrant that the Service will perform materially in accordance with our documentation, and that we will provide it with reasonable skill and care.

Except as expressly stated in these Terms, and to the fullest extent permitted by law, we disclaim all other warranties, express or implied, including implied warranties of merchantability, fitness for a particular purpose, accuracy and non-infringement, and we do not warrant that the Service will be uninterrupted or error-free.

15. Liability

15.1 Excluded loss

Neither party is liable for indirect or consequential loss, loss of profit, loss of revenue, loss of anticipated savings, or loss of goodwill, however arising.

To the maximum extent permitted by applicable law, we are not liable for fines, penalties, enforcement costs, or similar amounts imposed by a regulator or other public authority on you, arising from your own compliance obligations or from your use, configuration, or deployment of the Service. This exclusion does not apply to the extent applicable law does not permit it to be excluded or limited, in which case §15.4 governs.

15.2 Cap

Each party's total aggregate liability arising out of or in connection with these Terms is subject to a single ceiling, calculated once as described below and applied across all claims, incidents, events, and legal theories arising during the relationship between the parties. It does not reset, renew, or apply separately per claim, incident, year, or legal theory, however many of these arise.

(a) Monthly or annual subscriptions. The ceiling is the total subscription fees actually paid by you for the Service in the 12 months immediately preceding the earliest event giving rise to any claim, or, if you have been subscribed for less than 12 months at that time, the fees actually paid by you during that shorter period.

(b) Lifetime Plans. The ceiling is the amount actually paid by you for the applicable Lifetime Plan — a single, fixed amount for your entire use of the Service under that plan, regardless of how many years you use the Service or how many claims, incidents, or legal theories arise over that time.

This is a limitation on the total damages recoverable under these Terms, not a per-claim allowance. It is not, and does not create, an entitlement to a refund of fees paid.

15.3 Carve-outs from the cap

§15.1 and §15.2 do not apply to: your obligation to pay fees; your breach of §13 (Confidentiality); or your indemnification obligations under §16.1.

§15.1 and §15.2 also do not apply to your liability for intentional or deliberate conduct consisting of: a breach of §5.4 (Prohibited uses); unauthorised resale or sublicensing of the Service otherwise than as permitted by §4.4; or intentional misuse or misappropriation of Finsweet's intellectual property in breach of §12. This carve-out is narrow and does not extend to ordinary or unintentional breaches of these Terms, which remain subject to §15.1 and §15.2.

Finsweet's liability for its own breach of §13, and Finsweet's indemnification obligations under §16.2, remain subject to §15.1 and §15.2.

15.4 Non-excludable liability

§§15.1 and 15.2 apply to all liability arising out of or in connection with these Terms, to the fullest extent permitted by applicable law — including liability for a party's own breach of applicable data protection law, such as the GDPR (including Article 82). Where applicable law does not permit a particular liability to be limited or excluded — including liability for death or personal injury caused by negligence, liability for fraud or fraudulent misrepresentation, and any liability under applicable data protection law that cannot lawfully be limited or excluded — §§15.1 and 15.2 do not apply to that liability, but only to the extent, and only for so long as, applicable law requires. All other liability remains subject to §§15.1 and 15.2.

16. Indemnities

16.1 By you

You will indemnify us against third-party claims arising from your Configuration, from content you publish through the Service, from your breach of §5, or from your use of the Service in breach of law. This indemnity is not subject to the cap in §15.2 (see §15.3).

16.2 By us

We will indemnify you against third-party claims that the Service as supplied by us infringes that third party's intellectual property rights, provided you notify us promptly, allow us to control the defence, and cooperate at our expense. We may modify or replace the Service, or terminate and refund prepaid fees, to mitigate such a claim. This indemnity is subject to the cap in §15.2.

16.3 Procedure

The indemnified party will give prompt notice, allow the indemnifying party to control the defence, and provide reasonable cooperation. No settlement admitting liability may be made without the indemnified party's consent.

17. Sanctions and export

You confirm that you are not located in, or a resident of, a country or territory subject to comprehensive US sanctions; that you are not on a US restricted party list including OFAC's Specially Designated Nationals list; and that you will not use the Service in a way that would cause us to breach US export controls or sanctions. We may restrict or terminate access where we determine that use presents a sanctions or export control risk.

18. Governing law and disputes

18.1 Informal resolution

Before commencing proceedings, the parties will attempt to resolve the dispute informally for 30 days from written notice. You give notice to legal@finsweet.com; we give notice using the method in §19.2.

18.2 Customers established in the United States

These Terms are governed by the laws of the State of New York. Disputes not resolved under §18.1 will be resolved by binding arbitration under the Commercial Arbitration Rules of the American Arbitration Association, seated in New York, New York.

Individual basis. To the maximum extent permitted by applicable law, each party may bring a claim only in its individual capacity, and not as a plaintiff or class/collective/group member in any purported class, collective, consolidated, or representative proceeding. The arbitrator may not consolidate more than one party's claims or preside over any class, collective, or representative proceeding, except as provided in the next paragraph.

Similar claims filed together. If 25 or more substantially similar arbitration demands against us, arising from substantially the same facts, are filed by or with the assistance of the same or coordinated counsel within a short period, the demands will be administered under the AAA's procedures for related or coordinated cases (or an equivalent bellwether process the AAA administers), and the associated administrative and arbitrator fees may be consolidated or apportioned across those demands rather than charged in full for each one. Each claim is still decided individually — this paragraph coordinates how related claims are administered and billed, and does not create class, collective, or representative arbitration.

Costs. Each party bears its own attorneys' fees. If the AAA's administrative and arbitrator fees for an individual arbitration would substantially exceed what you would have paid in filing fees to bring an equivalent claim in a court of competent jurisdiction, we will pay the portion of those AAA fees above that amount. This does not commit us to pay all arbitration fees in every case — only to prevent their cost alone from making arbitration an inaccessible forum for a low-value claim.

Injunctive relief and small claims. Either party may seek injunctive or other equitable relief in the state or federal courts in New York, New York, without first arbitrating, where urgently needed in respect of: intellectual property rights; breach of confidentiality (§13); a security incident or unauthorised access; or circumvention or tampering in breach of §5.4. Either party may also bring a claim in small claims court in lieu of arbitration.

Jury trial waiver. To the maximum extent permitted by applicable law, each party waives any right to a jury trial in any court proceeding permitted under this §18.

18.3 Customers established outside the United States

These Terms are governed by the laws of the State of New York, and disputes not resolved under §18.1 are subject to the exclusive jurisdiction of the state and federal courts in New York, New York. The arbitration provisions in §18.2 do not apply.

Individual basis. To the maximum extent permitted by applicable law, each party may bring a claim only in its individual capacity, and not as a plaintiff or class/collective/group member in any purported class, collective, consolidated, or representative proceeding.

Jury trial waiver. To the maximum extent permitted by applicable law, each party waives any right to a jury trial in any proceeding under this §18.3.

18.4 Limitation period

Any claim must be brought within one year of the date the cause of action accrued, except where applicable law does not permit that period to be shortened.

18.5 EU Standard Contractual Clauses and UK Addendum

This §18 does not apply to a dispute arising under the EU Standard Contractual Clauses or the UK Addendum incorporated into the DPA, to the extent those instruments themselves specify a governing law or forum (see DPA §7 and Exhibits B–D). Those instruments' own governing law and forum provisions control for such a dispute.

19. General

19.1 Assignment and novation

You may not assign these Terms without our written consent, not to be unreasonably withheld. We may assign or novate these Terms, in whole or in part, to an affiliate or in connection with a merger, reorganisation or sale of the business or assets to which the Service relates, on notice to you. Your rights under these Terms and the DPA are unaffected by such an assignment or novation.

19.2 Notices

We give notice by email to your account's primary email address; you give notice to legal@finsweet.com and, for notices under §11 or §16, also by post to the address in §20. Email notices are effective 24 hours after sending.

19.3 Force majeure

Neither party is liable for delay or failure caused by events beyond its reasonable control, other than a failure to pay.

19.4 Severability

If any provision is held unenforceable, it is modified to the minimum extent necessary or severed, and the remainder continues in effect.

19.5 No waiver

Failure to enforce a provision is not a waiver of it.

19.6 Entire agreement

These Terms, together with the documents identified in §1.4, constitute the entire agreement between the parties as to the Service and supersede prior discussions on that subject. This clause does not limit liability for fraud or fraudulent misrepresentation, and does not exclude the DPA or any separately signed written agreement between the parties.

19.7 Independent contractors

The parties are independent contractors. Nothing creates a partnership, joint venture or agency.

20. Contact

legal@finsweet.com

Finsweet Inc., 1732 Pettit Avenue, Unit A, Merrick, New York 11566, United States

EU representative (GDPR Art. 27): Alexandre Iglesias Piñol — Lleida, Catalonia, Spain — alex.iglesias@finsweet.com

UK representative (UK GDPR Art. 27): Rohan Ganachari — Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA, United Kingdom — rohan.ganachari@finsweet.com

‍

‍