Terms of service
The full agreement between Veilux and a firm that subscribes to it: what each of us promises, what happens to your data, and what the law between us is.
01Parties and acceptance
These terms are an agreement between the operator of the Veilux platform ("Veilux", "we", "us") and the firm that subscribes to it ("you", "the firm"). Our registered company name, number and address will be added to this section — see docs/LEGAL.md for the open item — and until then "Veilux" means the operator of veilux.io and the product it sells under that name.
The person who creates the account, or who otherwise accepts these terms on a firm’s behalf — by ticking the box at signup, by continuing to use Veilux after being given notice of these terms, or by signing an order that references them — confirms to us that they are authorised to bind that firm to this agreement. If that is not true, the individual accepting is personally responsible for the obligations below until the firm ratifies or terminates the agreement.
Veilux is a service for businesses. The person accepting these terms must be at least 18 and acting on behalf of a business, not as a consumer. Veilux is not directed at children: a firm must not use it to collect personal data from children under 13, and must not give a portal login to anyone under 16, and we do not knowingly hold data about children except where a firm has put it in its own records against these terms.
A firm’s own customers, and the contacts inside those customers who sign in to the client portal, are not a party to this agreement. The firm’s relationship with them, and what the firm tells them, is the firm’s own responsibility; Veilux’s obligations to the firm’s customers, where any exist, are set out in the data processing agreement rather than here.
02Definitions
"Agreement" means these terms, the order or plan selected at signup or through the account portal, the data processing agreement, and the other policies these terms link to (the acceptable use rules, the privacy notice and the cookie policy so far as they describe our own obligations), read together.
"Business Data" means the data the firm and its authorised users submit to Veilux in the course of using it — customer and contact records, invoices and other financial documents, projects, tickets, files and everything else the firm puts into its own tenant. It does not include Veilux’s own account, billing and product-usage records about the firm, which the privacy notice covers.
"Module" means a distinct area of functionality (for example invoicing, projects, or the public API) that a plan may or may not include, as shown on the pricing page and in the firm’s own account portal. "Plan" means the named tier of the product (for example Studio, Practice or Firm) that determines the modules included, the seats available and the fee payable. "Trial" means the initial period on a plan during which no card is required and no fee is charged. "Subscription Fees" means the recurring fee payable for the plan in force from time to time.
"Authorised User" or "Staff User" means an individual the firm has given a login to its own workspace, whether an owner, an employee, or a contractor acting for the firm. "Portal User" means an individual — one of the firm’s own customers or their contacts — the firm has given a login to the client portal; portal logins are not staff seats and are not counted against any seat limit.
"API Key" means a credential issued under Setup → API that lets a program act on the firm’s tenant through the REST API or the MCP server described in the API documentation, within the scopes granted to that key.
04Plans, trials and subscriptions
Each plan sets out the modules it includes, the staff seats it allows (some plans are unlimited) and its price, on the pricing page and in the account portal, both of which read from the same catalogue our billing system uses — so what is quoted and what is billed cannot disagree.
A new firm starts on a trial of the plan it chose, for the number of days shown at signup, with no card required and no charge made. Every module is available during the trial. To continue after the trial ends, the firm adds a payment method from Account → Plan and add-ons, through our payment processor’s own checkout; we never collect or store card details ourselves. If no card is added before the trial ends, the account is not charged, and continued access follows the suspension terms below.
Automatic renewal. Once a firm adds a payment method, its subscription renews automatically at the end of every monthly billing period, at the price of the plan and add-ons in force at that time, until it is cancelled. The price, the renewal and how to cancel are shown next to the button that starts the subscription, and we email the account owner 7 days and 1 day before a trial ends. A firm can cancel online at any time from Account → Billing, through our payment processor’s portal, with no need to contact us; cancellation takes effect at the end of the period already paid for, access continues until then, and nothing further is charged. We do not refund part of a period already paid for, except where the law requires it.
A firm may switch between the self-serve plans (Studio, Practice, Firm) at any time from the account portal. Where the firm pays by card, changing plan is handled by our payment processor, which re-prices and prorates the change; we do not re-price a live subscription ourselves. A downgrade that would leave the firm over the new plan’s seat limit is refused, so a firm is never left with more staff than its new plan allows.
We may add features and modules to the product at any time, at no extra charge to plans that already include the area they extend. We will not remove a module a firm is currently paying for during a billing period it has already paid for; if we ever withdraw a module entirely, we will tell the firm’s account owner by email at least 60 days beforehand and will stop charging for it from the date it is withdrawn.
05Fees and payment
Subscription Fees are billed monthly in advance, in the currency shown at checkout, and are stated exclusive of VAT and any other applicable sales tax unless we say otherwise. Where a firm pays by card through our payment processor, the fee for the next period is charged automatically at the start of that period; where a firm is invoiced manually, payment is due on the terms stated on the invoice.
Add-on modules and any other charges the firm agrees to are billed on the same cycle as the base subscription unless stated otherwise at the point of purchase.
A firm’s own customers’ payments — the online payments a firm’s customers make against the firm’s own invoices, where the firm has connected its own payment account — go directly to the firm’s own account with its payment provider. We never touch that money, take no share of it, and it is not part of the Subscription Fees.
06Taxes
Subscription Fees are exclusive of VAT and any equivalent sales, use or turnover tax. Where our payment processor’s automatic tax calculation is switched on, UK VAT is added for UK customers and EU business customers who provide a valid VAT or tax identification number are reverse-charged, in each case as our processor calculates it at the time of payment. A firm is responsible for providing us with a correct and current tax identification number where one applies, and for any tax it is itself required to withhold or account for on payments to us.
Each of us is responsible for its own income, corporation and similar taxes arising from this agreement.
07Late payment and suspension for non-payment
If a scheduled payment fails, we will tell the firm’s account owner and, where the firm pays by card, our payment processor will retry the payment on its own schedule. If payment is not brought up to date, the account moves to a suspended state: staff can still sign in, see their own data and export it in full, but modules beyond the small set every account keeps stop working until the outstanding balance is paid. A firm’s own client portal, and the firm’s customers’ ability to sign in and view what has already been shared with them, is not affected by suspension for non-payment.
We do not charge a separate late-payment interest rate or fee under this agreement; a firm invoiced manually and materially in arrears may be moved to card billing, or the account may be suspended, at our discretion, on reasonable notice.
08Price changes
We may change the price of a plan or an add-on for future billing periods. For an existing subscriber, we will give the account owner at least 30 days’ notice by email before a price increase takes effect on their account; continuing to use Veilux after that date is acceptance of the new price, and cancelling before it takes effect avoids it entirely. A price change never applies retroactively to a period already paid for.
Prices shown to new subscribers, and prices agreed in a separate written order, are not affected by this section and are governed by whatever was agreed at the time.
09Acceptable use
The firm must not use Veilux, and must not let an Authorised User or anyone using an API Key use it, to: send unsolicited bulk email or use the product’s own email sending for anything that would breach the Privacy and Electronic Communications Regulations or equivalent law in the recipient’s jurisdiction; store or process data it has no lawful right to hold, including special category data it has not assessed a lawful basis for; attempt to access, probe or interfere with another tenant’s data or another firm’s account; reverse engineer, decompile or attempt to extract the source code of the product, except to the extent a licence cannot lawfully exclude that; resell or provide the product as a service to others without our written agreement, distinct from a firm using it to run its own business; upload malicious code; or do anything intended to disrupt, overload or degrade the service for other tenants.
A breach of this section is grounds for suspension under the next section, and for termination for cause under "Term and termination" below. We will tell the firm’s account owner why an account was suspended, except where doing so would itself create a security or legal risk (for example, tipping off someone under active investigation).
10Suspension
Beyond non-payment, we may suspend an account, or a specific Authorised User’s or API Key’s access, where we reasonably believe it is necessary to prevent harm to Veilux, to another tenant, or to a third party — for example a live security incident, a credible report of a breach of the acceptable use rules, or a legal or regulatory requirement to do so. We will restore access as soon as the reason for suspension is resolved, and will tell the account owner what happened, at the same time or as soon afterwards as is reasonably possible given the reason for the suspension.
Suspension under this section is not termination: the firm’s data is untouched and, subject to the reason for suspension, remains exportable.
11Customer data: ownership and licence
Everything the firm and its Authorised Users put into Veilux — its Business Data — remains the firm’s property. We claim no ownership in it. The firm grants us only the licence we need to host, process, back up and display that data in order to provide the service, and to use it as described in the data processing agreement; we do not use Business Data for our own marketing, to train models for another customer’s benefit, or for any purpose the firm has not asked for.
The firm is responsible for having the rights it needs to put Business Data into Veilux in the first place, including any consents or notices its own customers are owed, and for the accuracy of that data.
The firm can export its Business Data at any time it is not suspended for a reason that specifically restricts export: every list in the product exports to CSV, and a full export of the account is available to the account owner from Account → Data. If the firm’s relationship with us ends, it keeps a copy; what happens to our copy after that is set out in "Effect of termination" below and in the data processing agreement.
12Confidentiality
Each party will keep the other’s confidential information confidential and use it only to perform this agreement, except where disclosure is required by law, by a regulator, or by a court, in which case the disclosing party will give the other notice where it is lawfully able to. This obligation does not cover information that is or becomes public other than through a breach of this clause, that was already known to the receiving party without a duty of confidence, or that is independently developed.
Business Data is the firm’s confidential information. The terms of this agreement, and information about our pricing not otherwise made public, are our confidential information.
13Security
The measures we have in place are set out plainly on the security page and in the annex to the data processing agreement, with the mechanism behind each one. We will not reduce the protection those pages describe without saying so, and the data processing agreement records our obligation to keep them accurate.
14API and integrations
A firm on a plan that includes the API module can create API Keys under Setup → API. A key is shown once, at the moment it is created, and never again; we store only its one-way hash, its prefix and its last four characters, which is enough to recognise it in a list and never enough to use it. The firm is responsible for keeping a key secret once it has been shown.
A key carries only the scopes it was granted at creation, and can do nothing outside them; the same scopes, the same tenant boundary and the same request limit apply whether the key is used against the REST API or the MCP server, because both are the same authority checked the same way.
A key may optionally be given an expiry date at creation, after which it stops working automatically. Revoking a key is immediate and permanent — there is no "reactivate" — because a reversible toggle would make "was this key live on the day those records were read" unanswerable after a leak, which is the one question that matters. The firm should revoke a key the moment it is no longer needed or is suspected of being exposed, and should rotate keys periodically as a matter of good practice.
Requests through either the REST API or the MCP server are rate-limited at 600 requests per minute per key; a request beyond that limit receives a clear 429 response rather than being queued silently. A tenant without the API module reaches neither surface at all. This limit may change as the product and its infrastructure grow; a material reduction will be announced on the API documentation page.
Where a firm connects a third-party integration (for example a payment gateway, a video-conferencing provider, or its own outgoing mail server), that connection is between the firm and the third party under the third party’s own terms; our role and what is shared to make the connection work are described on the sub-processors page.
15Availability and support
We aim to keep Veilux available at all times and will tell the account owner about planned maintenance by email in advance where it is expected to affect access. We do not currently offer a contractual uptime commitment or service credits; if we introduce one, it will be written here and will not be taken away from a firm already relying on it without notice.
Support is provided by ticket from inside the product, through the same help desk a firm uses for its own customers, and through the account portal’s own support screen for questions about the Veilux relationship itself (billing, the domain, closing the account). We do not currently commit to a fixed response time, and will not claim one until it is something we can actually measure and stand behind.
16Term and termination
This agreement starts when the firm’s account is created and continues on a rolling monthly basis for as long as the firm keeps a plan active. The firm may cancel at any time from the account portal or through our payment processor’s customer portal; cancellation takes effect at the end of the period already paid for, and no further charge is made after that.
We may terminate this agreement, or decline to renew it, on at least 60 days’ written notice to the account owner for any reason, or with immediate effect where the firm is in serious or repeated breach of this agreement (including the acceptable use rules) and, where the breach is capable of being fixed, has not fixed it within 14 days of being asked to.
Closing the account is something the firm requests through a support request, rather than a button that fires immediately — this is deliberate, given how final it is. Once closure is confirmed, the account enters a 30-day grace period, described next.
17Effect of termination: export and deletion
For 30 days after an account is closed, its data is kept exactly as it was: the former owner can change their mind and ask for the account to be reopened, or can take a full export of everything the account held. A full account export is also available at any time before closure, from Account → Data, so a firm never needs to wait until the last moment.
Once the 30-day period ends, the account and its Business Data are permanently deleted from our production systems, and that deletion is itself recorded (without the data it describes) so a firm can confirm it happened. Deletion from backups follows our normal backup retention and rotation, described in the data processing agreement.
Sections of this agreement that by their nature ought to survive termination — confidentiality, the limitation of liability, the indemnities, and this section itself — continue to apply after the agreement ends.
18Intellectual property
We own, or are licensed to use, all intellectual property in the Veilux product itself — its software, design, documentation and the Veilux name and marks. Nothing in this agreement transfers any of that to the firm; the firm receives only the right to use the product as this agreement allows for as long as it remains in effect.
The firm owns its Business Data and its own brand, logos and content, and grants us only the licence in "Customer data" above to use it to provide the service — including, where the firm’s plan includes it, showing the firm’s own branding on its client portal.
19Copyright complaints
We respect copyright and expect firms to do the same. If you believe material stored on or shown through Veilux infringes a copyright you own or are authorised to act for, send a written notice to our designated copyright agent (contact details in the "Notices" section once registered; until then, to the support address on our contact page) that includes: your physical or electronic signature; identification of the copyrighted work; identification of the material you say infringes it and where it is on Veilux, precisely enough for us to find it; your contact details; a statement that you have a good-faith belief the use is not authorised by the owner, its agent or the law; and a statement, under penalty of perjury, that the notice is accurate and that you are the owner or authorised to act for them.
On a valid notice we remove or disable access to the material and tell the firm that stored it. A firm that believes the material was removed by mistake or misidentification may send a counter-notice with the same elements the law requires; if it does, we may restore the material after 10 business days unless the complainant tells us it has started court proceedings. We end the accounts of firms that repeatedly infringe. These steps follow the notice-and-takedown process of the US Digital Millennium Copyright Act, and we apply the same process to complaints under UK and EU law.
20Feedback
If the firm gives us feedback, suggestions or ideas about the product, we may use them to improve Veilux for every customer without owing the firm anything for that use, and without the feedback becoming the firm’s confidential information.
21Warranties and disclaimers
Each party warrants that it has the authority to enter into this agreement and that doing so does not breach an obligation it owes to anyone else.
Because Veilux is sold to firms for use in their own business, not to consumers, and to the fullest extent the law allows we exclude the implied terms about quality, fitness for purpose and description that would otherwise apply to the supply of goods or services — the Consumer Rights Act 2015 protections that apply to individual consumers are accordingly not relevant to this agreement. Subject to that, the product is provided "as is" and we do not warrant that it will be uninterrupted or error-free; we do warrant that we will provide it with reasonable skill and care.
22Limitation of liability
Neither party is liable to the other for loss of profit, loss of business, loss of anticipated savings, or any other indirect or consequential loss, even if that party knew such loss was possible.
Subject to the next paragraph, each party’s total liability to the other arising out of or in connection with this agreement in any twelve-month period is limited to the greater of the Subscription Fees paid or payable by the firm in that same twelve-month period, and £1,000.
Nothing in this agreement excludes or limits either party’s liability for death or personal injury caused by its negligence, for fraud or fraudulent misrepresentation, for a breach of the confidentiality obligations above, or for any other liability that cannot lawfully be excluded or limited.
23Indemnities
The firm will indemnify us against claims, losses and reasonable costs arising from the firm’s breach of the acceptable use rules, from Business Data the firm had no right to submit, or from the firm’s own breach of data protection law in relation to its use of Veilux.
We will indemnify the firm against claims that the Veilux product, as we provide it and excluding any Business Data or third-party integration the firm has added, infringes a third party’s intellectual property rights, provided the firm gives us prompt notice of the claim and lets us control its defence and settlement. Each indemnity is subject to the cap in "Limitation of liability" above.
24Changes to these terms
We may update these terms from time to time — to reflect a change to the product, a change in the law, or to make them clearer. Where a change is material, we will email the account owner at least 30 days before it takes effect and will say plainly what has changed; a change that only clarifies wording without altering a party’s rights or obligations may be made without that notice period, and the version number and "last updated" date at the top of this page always show which version is current.
If a firm does not agree with a material change, it may cancel under "Term and termination" before the change takes effect; continuing to use Veilux after the effective date is acceptance of the updated terms.
25Notices
A notice to the firm under this agreement is validly given by email to the firm’s account owner at the address on file, or by a notice shown inside the product to signed-in Authorised Users. A notice to us is validly given by email to [email protected], or through a support request from the account portal, and is treated as received on the next business day.
26Assignment
The firm may not assign or transfer this agreement without our prior written consent, except to a successor that acquires substantially all of the firm’s business, of which the firm must give us notice. We may assign or transfer this agreement to an affiliate or to a successor that acquires substantially all of our business, provided the assignee agrees to be bound by it.
27Force majeure
Neither party is liable for a failure or delay in performing its obligations (other than an obligation to pay money already due) caused by something reasonably beyond its control, including an internet or utility outage, a failure of a third-party provider we depend on, a natural disaster, or an act of government — for as long as that cause continues, provided the affected party tells the other about it and uses reasonable efforts to reduce its effect.
28Governing law and jurisdiction
This agreement, and any dispute arising out of or in connection with it, is governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction to settle any such dispute, without prejudice to either party’s right to seek interim relief in another jurisdiction where necessary to protect its rights.
29Entire agreement
This agreement — these terms, the order or plan in force, the data processing agreement, and the policies these terms expressly link to — is the entire agreement between the parties about its subject matter, and replaces every earlier discussion, proposal or representation about it, whether written or oral. Nothing in this clause limits liability for fraud.
30Severability and waiver
If a court finds part of this agreement unenforceable, the rest continues in effect and the parties will negotiate in good faith to replace the unenforceable part with something that achieves the same intent. A failure or delay by either party in enforcing a right under this agreement is not a waiver of it, and a waiver on one occasion is not a waiver of any later occasion.
31General
This agreement does not create a partnership, joint venture or agency between the parties, and neither party may bind the other. A person who is not a party to this agreement has no right to enforce any of its terms. Acceptance given electronically — ticking a box, continuing to use the product after notice, or replying to an email — is as effective as a signature on paper.
Questions about this document: [email protected].