Terms of Service

The Service is a hosted, multi-tenant web application for tracking an organisation’s compliance status against a set of security and privacy frameworks. It provides a pre-built library of control descriptions, a cross-framework mapping (“crosswalk”), status tracking, dashboards, and PDF/CSV reporting.

The Service is a tracking and organisation tool only. It does not provide legal, audit, certification or professional advice, it does not collect or store your compliance evidence, and using it does not by itself make you compliant with, or certified against, any framework. You remain solely responsible for your own compliance posture and for any filings, attestations or certifications you pursue.

You must provide accurate account information and keep your login credentials secure. You are responsible for all activity under your account. Tell us promptly at kim_abdalian@yahoo.com if you believe an account has been compromised.

Data in the Service is organised into “workspaces”. The person who creates a workspace is its owner and controls membership, roles (owner, editor, viewer) and billing. The owner is responsible for who they invite and for the actions of members they add.

You must be at least 18 years old and not barred from receiving the Service under applicable law.

Each new workspace includes a 5-day free trial with full functionality. A payment method is collected at the start of the trial so that, unless you cancel before it ends, the subscription begins automatically. If the workspace has not subscribed when the trial ends, editing is paused; your data remains readable and exportable. We may change or end the trial offer for future sign-ups at any time.

The Service is licensed annually on a per-seat basis. The firstsubscription may be for a single seat; the workspace may add or remove seats individually. Each seat entitles the workspace to one active member for the 12-month term, at the price shown on the pricing page when you subscribe. Fees are billed in advance for the annual term and are exclusive of VAT and sales taxes, which are added at checkout where they apply.

Payments are processed by Lemon Squeezy, LLC (“Lemon Squeezy”), which acts as our Merchant of Record and reseller. Your purchase is also subject to Lemon Squeezy’s terms and privacy notice, and your card or bank statement will show Lemon Squeezy. We do not receive or store your full card details.

Seats are reassignable within the term: the workspace may have as many active members as it has seats, and removing a member frees their seat immediately for a replacement at no additional charge. Adding seats is charged on a prorated basis and aligned to the same renewal date. Reducing the seat count applies a prorated credit to your next invoice. Subscriptions renew automatically for a further annual term until cancelled.

If a payment fails, we may retry it and may suspend editing after a short grace period until the balance is cleared. Refunds, where offered, are governed by our Refund Policy.

The workspace owner can cancel at any time from the billing page. Cancellation stops the next renewal; the workspace keeps paid access until the end of the current paid period, after which editing is paused. You can export your data at any time before or after cancelling. We do not delete workspace data automatically on cancellation, but you may ask us to delete it (see the Privacy Policy).

You agree not to:

• copy, resell, sublicense, or provide the Service to third parties as a bureau or service, except as your own internal users;
• extract, scrape, or reproduce the control library, category framework or crosswalk mappings for use outside the Service, or to build a competing product;
• reverse engineer or attempt to derive source code, except to the extent this restriction is prohibited by law;
• upload unlawful content, malware, or anyone else’s confidential information without authority;
• probe, scan, or test the vulnerability of the Service, or breach or circumvent any security or authentication measure, without our prior written consent;
• use the Service in a way that disrupts it for others or places disproportionate load on it.

We may suspend access without notice if we reasonably believe your use threatens the security, integrity or availability of the Service.

The Service, and all of its content that is not your data — including the software, the control library, the category framework, the cross-framework crosswalk, text, design and branding — is the proprietary property of Kim and is protected by copyright and other laws. You are granted a limited, non-exclusive, non-transferable, revocable licence to access and use the Service for your organisation’s internal compliance management for as long as your subscription is active. Access is licensed, not sold. All rights not expressly granted are reserved.

Framework names and standards referenced in the Service (for example ETGRMF (BPRD Circular 05 of 2017), Digital Banking Security Measures (BPRD Circular 04 of 2023), Cloud Outsourcing Framework (BPRD Circular 01 of 2023), Outsourcing Risk Management (BPRD Circular 06 of 2019)) are the property of their respective owners. Kim is not affiliated with, endorsed by, or certified by any of those bodies, and the Service is not an official product of any of them.

As between you and us, you own the data you enter into your workspaces (statuses, notes, member lists). You grant us the limited right to host, process and transmit that data for the purpose of providing and supporting the Service. Our handling of personal data is described in the Privacy Policy.

We keep reasonable technical and organisational safeguards (encryption in transit, row-level tenant isolation, access controls, managed and backed-up infrastructure). No method of storage or transmission is completely secure, and you are responsible for keeping your own copies of anything you cannot afford to lose — the export tools are provided for this.

The Service runs on third-party infrastructure, including Supabase (database and authentication), Vercel (hosting) and Lemon Squeezy (payments). Their availability and terms are outside our control, and their processing of data is covered in the Privacy Policy.

We aim to keep the Service available but do not guarantee any particular uptime. We may modify, suspend or discontinue features, and we may change these terms or the price. For material changes we will give at least 30 days’ notice by email or in the app before they take effect for you; continuing to use the Service after that means you accept the change. If you do not accept a change, your remedy is to cancel.

Defect fixes. If you report a genuine bug or flaw in the Service, we will correct it at no charge, as soon as reasonably practicable and in any event within 30 calendar days of your first report. This does not cover new features, control-set version updates (section 11), issues caused by your own configuration or misuse, or faults in third-party services outside our control.

Standards bodies periodically issue new versions of their control sets (for example a move from one release of PCI DSS, ISO/IEC 27001 or the NIST frameworks to the next). When a regulatory or standards body publishes a new control-set version covered by the Service, we will update the control library, the category framework and the cross-framework crosswalk to reflect it and roll the update out to workspaces.

Each such control-set version update is a chargeable engagement billed at USD 2,500 per update, separate from your subscription fee. We will notify the workspace owner before an update is applied. Routine fixes, corrections and minor improvements within an existing control-set version are included in your subscription at no extra cost.

The Service is provided “as is” and “as available”, without warranties of any kind, whether express, implied or statutory, including implied warranties of merchantability, fitness for a particular purpose, accuracy, and non-infringement. We do not warrant that the control library or crosswalk is complete, current or free of error, or that the Service will meet your regulatory obligations.

To the maximum extent permitted by law, Kim will not be liable for any indirect, incidental, special, consequential or punitive damages, or for any loss of profits, revenue, data, goodwill, or the cost of substitute services, arising out of or relating to the Service, whether in contract, tort or otherwise, even if advised of the possibility.

Our total aggregate liability for all claims relating to the Service in any 12-month period will not exceed the greater of (a) the fees you paid for the Service in the 12 months before the event giving rise to the claim, or (b) USD 100.

You will indemnify and hold Kim harmless from claims, losses and expenses (including reasonable legal fees) arising from your data, your use of the Service in breach of these terms, or your violation of law or the rights of a third party.

These terms are governed by the laws of the Kingdom of Bahrain, without regard to conflict of law rules. The courts of the Kingdom of Bahrain have exclusive jurisdiction, except that either party may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property or confidential information. Nothing in these terms removes any mandatory consumer right you have under the law of your country of residence.

If any provision is held unenforceable, the rest remain in effect. Our failure to enforce a provision is not a waiver. You may not assign these terms without our consent; we may assign them to a successor of the business. These terms, together with the Privacy Policy and Refund Policy, are the entire agreement between us about the Service.

Questions about these terms: kim_abdalian@yahoo.com.