Terms of service

1. Who these terms cover

AttackDesk is operated by FlashCat LLC, a Wyoming limited liability company (“AttackDesk,” “we,” “us”). These terms apply to our websites, account hub, APIs, managed services, and work we agree to provide. “You” means the person accepting and, when acting with authority for a business, that business. You must be at least 18 and legally able to enter this agreement.

An order or signed agreement controls its specific scope and price; a signed data processing agreement controls its subject matter; the purchase policy controls billing; these terms apply otherwise. The downloadable software has a separate license included with its release; that license governs software permissions, restrictions, termination, and reinstatement. These service terms do not expand those rights. A demo, roadmap, sales illustration, or future feature is not a service commitment.

These terms include a class-action waiver and a 30-day right to opt out in section 16. Please read that section before accepting these terms.

2. Accounts, teams, and access

Give accurate account and business information and keep it current. Protect your sign-in methods, API keys, devices, and integrations. Use individual team accounts, appropriate permissions, and prompt removal of access when someone leaves. Tell us promptly about suspected misuse. You are responsible for activity you authorize through your people, agents, and credentials, subject to applicable law and our own responsibilities.

Organization owners and authorized administrators manage membership, roles and permissions in the AttackDesk dashboard. Downloaded and published company apps consume and enforce that dashboard-issued access; they must not independently create or elevate it. Ordinary workspace users may enter their company app after portal authentication without access to dashboard management screens. Use a work account with the understanding that the organization may control that workspace. Account access does not transfer ownership of another business or its information.

Each business has its own AttackDesk account, owned by that business. A client can sign up itself and invite a developer or agency to its team, or an agency can make the client's account from Clients in its dashboard and invite the client's owner. Either way the account belongs to the client, which can remove the agency at any time. An agency may join multiple client teams but may not hold unrelated client businesses under its own organization account or use a client's account for its own business. A person may maintain accounts for multiple businesses they own, within the free-company limit below.

Free companies. Using AttackDesk without paying is limited: each person may have their own company plus five more that aren't paying at any one time, counting companies they own, client accounts they or their agency make, and copies of the AttackDesk software they run themselves for any business. A company is paying while it is on a paid monthly plan of $29 or more for its paid month, or when it had at least $29 of paid usage in each of the last three completed months or at least $59 in the last completed month. Every company beyond the free ones must be paying. Running AttackDesk for more businesses than this without paying breaks these terms and the software license: we may restrict or close the accounts involved and stop official downloads and services, and use outside the license is unlicensed use of our software.

Every person accessing a company workspace must sign in through the AttackDesk portal with their own authorized individual account on free and paid plans alike, including locally run, self-hosted and own-provider installations governed by release license 1.4. Do not substitute app-local authentication, fabricate identity or permissions, or bypass revocation. Recipients of permitted public forms, invoices and checkout need not join the company team merely to use those customer-facing functions. Portal identity on a free account does not itself require a paid managed-service subscription or create a managed-service seat fee.

Creating an account does not require a card. Before you obtain an official software or company-code download, the applicable account must complete the card verification described in the Purchase Policy. Verification alone is not an agreement to a subscription or undisclosed paid services. Download, update and code-access eligibility is checked through the account service; an old key or a locally edited copy does not override current eligibility.

3. Software, customization, and client work

You keep the rights you hold in your business data and original custom code. We keep our rights in AttackDesk and its branding. The downloadable CRM is source-available under the AttackDesk Source-Available Business-Use License; it is not open source. That license does not require publication of your private customizations or transfer ownership of your original contributions to us. Owning your additions does not give you ownership of the underlying AttackDesk software or unrestricted rights to distribute a combined product.

The release license permits free download, use, and customization for your own business, within the free-company limit in section 2. You may change the logo, colors, and interface of your installation, including through an authorized developer, without a white-label contract. The connected company’s name and account identity must remain the values issued by the AttackDesk dashboard; do not replace, locally rename, or conceal that identity. A customized logo does not change which company owns and controls the connection. Keep required legal notices. This does not grant rights to use our trademarks to market another product or imply our endorsement.

Downloads and code packages carry identifiers, some of them not visible, linked to the account and person that downloaded them, so a copy can be traced to its license. Removing, altering, or disguising them breaks the license.

A client may authorize a developer, consultant, or agency to set up, customize, deploy, manage, and support its own installation, including on infrastructure the client owns or controls. The provider may charge a fixed project fee for building and delivering the client’s customized installation, as well as ongoing support fees, whether the client uses the free software or paid managed services. The client obtains its rights to AttackDesk under its own license; the project fee is for the authorized work. No affiliate or partner agreement is required for this authorized client work. Code may be shared with the provider and returned or deployed for that client under the client’s license and authorization.

Except for the release license’s express permissions for authorized client work and business succession, selling, sublicensing, renting, or redistributing AttackDesk or modified copies, or offering it as a software platform to unrelated businesses, requires a separate written commercial product agreement with FlashCat LLC. That agreement must specify the covered product, permitted distribution or hosting, customer and account responsibilities, software or service charges, and treatment of existing installations when it ends. Contact support@attackdesk.com to request terms. Buying managed services, keeping a card on file, or joining an affiliate program does not by itself grant commercial product rights.

The downloadable software and our managed platform are separate. A software license does not grant access to or rights in proprietary account, provisioning, billing, or managed-service server code that is not included in the release. Code supplied to connect to our services remains covered by its release license. Service access, charges, and any permitted resale of service access are governed by these terms and an applicable written agreement. Choosing not to buy managed services does not remove the release license’s self-hosting and own-provider rights.

Anyone may recommend AttackDesk. Earning referral commissions requires acceptance of the affiliate terms and compliance with their attribution, eligibility, and payment conditions. A free signup earns no commission; a later eligible payment may qualify under those terms. Affiliate enrollment does not itself grant resale or redistribution rights.

Keep the applicable software license and copyright notices with copies of AttackDesk, including those shared for authorized client work, and identify changed files as changed. Do not edit, modify, replace, remove, or bypass license keys, account checks, protected or sealed components (including the files marked ATTACKDESK-PROTECTED-FILE), or required notices; only official AttackDesk updates, Repair, or maintenance we explicitly authorize may change them. The release license governs the consequences of a license breach and any opportunity to cure it; restrictions on access to our managed services are also governed by these terms.

Third-party components retain their own licenses, identified in the notices supplied with the software. These terms and our license restrictions do not take away rights granted directly under those third-party licenses. Preserve applicable notices.

Protected-file schedule for release license 1.4: the following exact repository-relative paths carry the ATTACKDESK-PROTECTED-FILE disclosure and are subject to the restriction above. The same inventory is supplied in PROTECTED_FILES.md, the common notice in PROTECTED_FILE_NOTICE.txt, and the protected-path rules in customization-policy.json. Preserve those records as well. This schedule identifies this release; it does not retroactively replace the license supplied with an earlier download. A later release must identify its own inventory. No omitted path, rename, alternate authentication setting or added wrapper authorizes bypassing the protected controls.

Sealed account/service core: src/sealed/README.md; src/sealed/account/checkin.ts; src/sealed/account/link.test.ts; src/sealed/account/link.ts; src/sealed/account/store.test.ts.

Sealed account/service core: src/sealed/account/store.ts; src/sealed/fingerprint.test.ts; src/sealed/fingerprint.ts; src/sealed/release-key.ts; src/sealed/seal.ts.

Sealed account/service core: src/sealed/services/actor.test.ts; src/sealed/services/actor.ts; src/sealed/services/phone.ts; src/sealed/services/places.ts.

Portal authentication and sessions: src/server/auth/delegated-organization.ts; src/server/auth/org-gate.ts; src/server/auth/repositories/AuthRepository.ts; src/server/auth/repositories/WorkspaceSessionRepository.ts; src/server/auth/workspace-hub.ts.

Portal authentication and sessions: src/server/auth/workspace-merge.test.ts; src/server/auth/workspace-merge.ts; src/server/auth/workspace-revalidate.test.ts; src/server/auth/workspace-session.ts; src/server/auth/workspace-sign-in-routes.ts.

Portal authentication and sessions: src/server/auth/workspace-sign-in.test.ts; src/server/auth/workspace-sign-in.ts; src/server/auth/workspace-test-support.ts; src/server/auth/workspace-token.test.ts; src/server/auth/workspace-token.ts.

Request identity and entry points: src/lib/auth-mode.ts; src/lib/org-permissions.ts; src/middleware/ensure-user/accessTokenErrors.test.ts; src/middleware/ensure-user/accessTokenErrors.ts; src/middleware/ensure-user/attackdesk.ts.

Request identity and entry points: src/middleware/ensure-user/cloudflareAccess.ts; src/middleware/ensure-user/delegated.ts; src/middleware/ensure-user/hosted.ts; src/middleware/ensure-user/resolve.ts; src/middleware/ensure-user/types.ts.

Request identity and entry points: src/middleware/ensureUser.ts; src/routes/api/attackdesk/callback.ts; src/routes/api/attackdesk/sign-in.ts; src/routes/api/attackdesk/sign-out.ts; src/serverFunctions/access.ts.

Request identity and entry points: src/serverFunctions/actor.ts; src/serverFunctions/middleware.ts; src/serverFunctions/projects.ts; src/shared/workspaces.ts.

Business permission enforcement: src/server/features/access/AccessContainment.test.ts; src/server/features/access/AccessPermissionGain.test.ts; src/server/features/access/AccessRepository.ts; src/server/features/access/AccessRolesService.test.ts; src/server/features/access/AccessRolesService.ts.

Business permission enforcement: src/server/features/access/AccessService.test.ts; src/server/features/access/AccessService.ts; src/server/features/access/ApiKeysService.test.ts; src/server/features/access/ApiKeysService.ts; src/server/features/access/access-test-fixtures.ts.

Business permission enforcement: src/server/features/access/accessResolve.ts; src/server/features/access/businessGate.test.ts; src/server/features/access/businessGate.ts; src/server/features/access/scopeCaps.ts; src/shared/permissions/catalog.ts.

Business permission enforcement: src/shared/permissions/effective.test.ts; src/shared/permissions/effective.ts; src/shared/permissions/matrix.ts; src/shared/permissions/roles.ts.

Protected control boundaries. The company switcher, launcher and portal sign-in, company/environment binding, dashboard-managed membership and permissions, revocation, installation identifiers, and required artifact, import and update verification may not be modified, disabled, replaced or bypassed through customer customization. Do not weaken a checker, replace its trusted policy or signing-key source, or add a template, plugin, wrapper, build setting or alternate route that defeats these controls. This applies to free and paid, local and published copies. Only official updates or our explicitly authorized maintenance may change protected components. Each release identifies its exact protected files in its release inventory and schedule.

Agency templates and client continuity. Agencies retain their rights in their original templates and reusable components. Installing or authorizing installation of an agency-owned template or module in a client account grants that client the business-use license described in release License section 4.2: the client can keep using and modifying it, including through a replacement provider, after the agency relationship ends. That grant does not permit standalone resale or redistribution. Agencies may reuse their own components for other separately licensed clients; client-owned work, records and secrets require permission before reuse. Disclosed third-party licenses continue to apply. The AttackDesk base remains licensed separately to each client.

Branches and copies. Authorized people may maintain copies on different branches within their permitted company accounts. Copies remain attributable to their account and installation. Switching branches is a controlled software update: it must preserve local work and installation binding and validate the replacement code and database compatibility before activation. Sharing a branch or template does not share another person's privileges or another client's records.

4. Customer content and processing

You are responsible for having the rights and lawful basis needed to collect, import, store, use, publish, and share the information you put into AttackDesk. That includes leads, uploaded files, website content, recordings, prompts, and personal information. Give the notices and obtain the permissions your use requires.

Operating license. You retain ownership of Customer Content, including original code, templates and modules. You grant FlashCat LLC a non-exclusive, worldwide, royalty-free license to host, store, back up, reproduce, transmit, display to authorized recipients, build and run that content, and perform necessary technical adaptations, only as needed to provide the services you request, maintain compatibility, perform security and integrity checks, respond to authorized support, comply with law and enforce these terms. We may allow service providers to exercise these rights only for those purposes and subject to appropriate confidentiality and data-protection obligations. Private code access is limited to personnel and providers who need it for those purposes. The license lasts while we provide those services and for limited backup, legal or security retention afterward as described in the Privacy Policy. It does not transfer ownership, authorize selling private customer lists, or grant general rights to incorporate your private source code or templates into our products. A template marketplace or broader distribution requires a separate, affirmative grant.

The privacy policy explains our handling of account and service data. When we process personal information on your business’s behalf, you determine its business purpose. If applicable law requires a data processing agreement or international transfer terms, those must be put in place before the affected processing begins. This general agreement is not a substitute for an executed DPA.

Feedback submissions. If you intentionally submit suggestions, feature requests or other feedback to AttackDesk for product development, you grant us a non-exclusive, worldwide, perpetual, irrevocable, royalty-free license, transferable and sublicensable as needed to develop and distribute our products and services, to use, reproduce, adapt, implement and otherwise exploit that feedback without additional approval, attribution or compensation. You must have authority to grant these rights. Routine hosting uploads, code imports, customer records and private support attachments are not automatically feedback submissions. Including code or other protected materials requires an explicit contribution license or written permission covering that material; this feedback clause does not silently grant rights in unrelated code, patents or third-party material. Do not submit information you are required to keep confidential unless we have expressly agreed how it may be used.

Independent development. AttackDesk may develop, acquire, market and provide products or features that are similar to or compete with your additions. We may use public ideas, properly licensed feedback, and our own independently developed knowledge without an obligation to compensate you merely because the results are similar. Similarity alone does not establish misuse or ownership of our work. General non-confidential skills, experience and know-how may be retained and used; remembering information does not authorize using protected customer expression, private code, confidential information or trade secrets. We do not obtain a general residuals license to private customer work through hosting, support access or unaided memory. This clause preserves valid intellectual-property and confidentiality rights and any applicable separate written agreement. Where we want to develop a feature from a private customer demonstration, we will obtain a suitable feedback/contribution permission or use independently obtained, lawful specifications.

Private submissions and customer work. We treat non-public customer code and business information obtained through hosting, imports and support as confidential and use it within the operating license above. Information lawfully public, independently developed without use of the confidential information, or lawfully received without a duty of confidence is outside that restriction. A customer can affirmatively authorize specified information to be used for product development. That authorization must identify its scope; uploading a repository or merely requesting support is not such an authorization.

5. Agents, AI models, and automated actions

AI can produce incorrect, incomplete, biased, insecure, or non-unique outputs. It can also act on misleading instructions in websites, files, or messages. Review important outputs and code before using or publishing them. AI output is not legal, financial, medical, or other professional advice, and we do not guarantee accuracy, rights clearance, business results, rankings, leads, or revenue.

You choose which agents and tools to enable, the data and credentials they can access, and the actions they may take. An authorized agent may send messages, spend credits, publish content, change records, or modify code. Use limited permissions, budgets, approval steps, and independent backups appropriate to the task. We do not promise to catch every unintended action.

Hosted model use sends the data needed for the request to the selected provider. Model availability, context limits, retention, permitted uses, and output rights vary. Your own coding-agent subscription or provider account is a separate agreement and does not include AttackDesk usage. Local operation does not make separately connected services offline.

6. Calls, texts, email, and recording

Use communications services only for lawful, permitted traffic. You are responsible for recipient consent and evidence of it, sender identification, opt-outs, suppression lists, do-not-call requirements, permitted contact times, email disclosures, and restrictions on automated or AI-generated calls. A purchased or scraped lead is not permission to contact that person. Carrier registration or approval does not establish consent.

Obtain all notices and permissions required for recording, transcribing, analyzing, or sharing a call, including every participant’s consent where required. Do not impersonate another sender or use deceptive caller identification. Honor withdrawal of consent and provider rules, including the policies applicable to Twilio-backed services.

Numbers, registrations, delivery, and portability depend on providers, carriers, location, and eligibility. We do not guarantee approval, delivery, inbox placement, uninterrupted calling, or continued availability of a number. AttackDesk is not a replacement for an emergency telephone service; do not rely on it to reach emergency services.

7. Acceptable use

Do not use the services for unlawful activity, fraud, spam, harassment, exploitation, malware, unauthorized access, deceptive impersonation, or infringement. Do not bypass access restrictions, spending controls, service limits, license checks, or security protections. Do not resell our credentials or let unauthorized parties use our provider accounts.

Research, enrichment, scraping, advertising, and content publishing must respect applicable law, intellectual property, access permissions, platform terms, and privacy rights. Having a tool capable of an action does not establish permission to perform it. Do not use agents to evade these restrictions.

AttackDesk is not HIPAA compliant out of the box. Do not create, upload, store, or transmit protected health information (PHI) through our services unless you have separately requested HIPAA support, we have agreed to the use in writing and signed a Business Associate Agreement (BAA) with you, and we have confirmed that the specific services, configuration, and required safeguards are in place. An inquiry, add-on request, plan purchase, or BAA alone does not activate or establish a compliant configuration. We may decline a request or exclude features and providers from the approved scope.

Do not submit payment-card security codes, government secrets, or similarly restricted data unless we have expressly agreed in writing to support that data and the required safeguards. You must also comply with applicable law and the rules of connected providers.

Our Acceptable Use Policy (https://attackdesk.com/acceptable-use?version=2026-09-26.6) is part of these Terms. It is published with the same version as these Terms and adds the rules for texting, calling, email, AI and automated agents, address lookups, and how we handle abuse. Where a service has stricter rules, they apply to that service.

8. Connected services and editable deployments

You can use your own compatible providers subject to their separate fees and terms. You authorize us to communicate with providers when you connect a service or request managed setup. Their outages, changes, approvals, quotas, and account restrictions can affect the features available to you.

Managed services are optional. You may run the software on your infrastructure and use your own compatible providers under the applicable release license. For releases governed by license 1.4, company workspace users still use portal identity and dashboard-managed access on every plan as described in section 2. Hosting, usage, keys and other paid services remain subject to their separate entitlements and charges. Editing or configuring a copy must not bypass identity, permissions, revocation, billing or service controls.

For copies you run or modify, you are responsible for deployment, device security, dependencies, access controls, migrations, backups, and testing unless an order expressly assigns a task to us. Customizations may need maintenance and may conflict with updates. Support does not automatically include fixing every customization or restoring every prior version.

An account-connected copy can report installation information and aggregate usage counts as described in the privacy policy. Integrity checks can restrict managed services for incompatible or altered protected components. This does not grant us unrestricted access to your computer.

9. Managed services, support, and backups

Your order identifies the services you purchase. Activation can require your information, DNS changes, provider approval, account verification, payment, and other setup steps. Availability varies by feature and configuration. A payment confirmation does not mean all external services have been provisioned.

Implementation, custom development, reviews, migrations, and ongoing support have the scope, charges, and estimated timing agreed for that work. Unless expressly stated in a signed service agreement, there is no uptime SLA, guaranteed response time, completion deadline, recovery time, or recovery point commitment.

A backup benefit applies only to the resources and retention actually included in your order and enabled for your account. It does not cover unconnected local databases, external services, or every file automatically. Backups can be incomplete or fail; keep appropriate independent exports and recovery plans. We do not guarantee that every deletion, modification, or outage can be reversed.

Publishing to AttackDesk-hosted infrastructure requires an eligible card-backed company account and is a paid deployment operation at the rate and charge trigger disclosed before authorization. Free software does not include free hosted deployments. Creating a local branch or making a local code edit does not itself authorize a deployment charge. A card on file alone is not proof that a deployment succeeded or that a particular deployment fee was authorized.

10. Billing, cancellation, and service restrictions

The purchase policy and checkout describe subscription fees, credits, usage, optional services, and cancellation. You authorize the charges you approve, including disclosed recurring charges. Your own customers’ purchases and invoices are separate: you remain responsible for your offerings, refunds, taxes, and payment-provider obligations.

We may limit or suspend services for nonpayment, insufficient balance, credible security or abuse concerns, legal obligations, provider restrictions, or material breach. We will give notice and an opportunity to address the issue when reasonably appropriate; urgent situations may require immediate action. Restrictions do not eliminate valid accrued charges or non-waivable rights.

Cancel renewal through account Settings or contact us if you cannot access that control. Export what you need before ending a hosted service. Cancellation, account closure, and deletion of data are different actions; the purchase policy and applicable order explain their effects.

Software-download card verification is a temporary $49 authorization that we cancel without capturing. Your bank controls when its pending hold clears. Verification is separate from later metered usage, subscriptions or deployments, which require the applicable disclosed authorization. Ordinary downloads, retries, clone/pull and updates do not each create a new hold merely because they recheck an already verified eligible account; a new verification, when required, must be disclosed before it is initiated.

11. Changes and discontinuation

We may maintain or change the services. Material changes affecting an existing paid commitment, prices, or these terms will be communicated with the notice and consent required by law. Changes apply prospectively, not to turn previously authorized usage into a new charge. We will explain available cancellation options for a material paid-service change.

Previews and experimental features can change or end and should not be relied on for critical operations. If we permanently end a prepaid service without your breach, contact us about the unused affected service; any refund required by law or your order remains available.

12. Warranties and responsibility

AttackDesk may experience bugs, interruptions, or compatibility issues. We don’t guarantee that the software will operate without errors or meet every business’s particular needs.

To the maximum extent permitted by law, services and software are provided “as is” and “as available.” We disclaim implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement. We do not warrant uninterrupted, error-free, completely secure, or universally compatible operation.

Nothing in these terms excludes a warranty, remedy, duty, or liability that applicable law does not allow to be excluded. General disclaimers do not cancel an express obligation we make in a signed agreement.

13. Limits on liability

To the maximum extent permitted by law, neither FlashCat LLC nor its suppliers or personnel will be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or lost profits, revenue, goodwill, anticipated savings, or data arising from the services, even if advised of the possibility.

Our total aggregate liability for claims arising out of or relating to the services or this agreement will not exceed the greater of US $100 or the fees you paid us for the service giving rise to the claim during the twelve months before the event giving rise to liability. These limits apply across legal theories to the extent permitted by law.

These exclusions and limits do not apply to fraud, willful misconduct, or any liability that cannot lawfully be limited. A different liability provision expressly agreed in a signed contract controls its subject matter.

14. Claims arising from your use

If you use AttackDesk for a business, that business will defend and indemnify FlashCat LLC against third-party claims and reasonable associated costs arising from its unlawful communications, infringement by its supplied content or customizations, unauthorized processing of personal information, or material violation of these terms.

This obligation does not apply to the extent a claim results from our breach, negligence, or willful misconduct. We will promptly notify you of a claim, reasonably cooperate, and let you control a competent defense. You may not settle a claim by admitting fault for us or imposing non-monetary obligations on us without our written consent.

15. Governing law and court venue

The laws of the State of Arizona, without its conflict-of-law rules, govern these terms and disputes arising out of or relating to these terms or the services, subject to applicable federal law and mandatory protections that cannot lawfully be excluded.

Except where applicable law requires otherwise, the parties agree to the exclusive jurisdiction and venue of the state courts located in Maricopa County, Arizona, or, where federal subject-matter jurisdiction exists, the United States District Court for the District of Arizona, Phoenix Division. Each party consents to personal jurisdiction in those courts. This provision does not remove mandatory consumer protections or a right to bring a claim in another court where that right cannot lawfully be waived.

You may contact support@attackdesk.com to try to resolve a dispute informally. Doing so is not a prerequisite to bringing a claim and does not change a filing deadline. These terms do not require arbitration.

16. Class-action waiver and 30-day opt-out

To the fullest extent permitted by applicable law, you and FlashCat LLC agree to bring claims arising out of or relating to these terms or the services only in an individual capacity. Neither party will bring or participate as a class representative or class member in a class, collective, or representative action against the other. This is a mutual class-action waiver; it does not waive an individual claim or an otherwise available right to a jury trial.

You may opt out of this waiver by sending an email to support@attackdesk.com within 30 calendar days after you first accept a version of these terms containing this waiver. Use the subject “Class-action waiver opt-out” and include your name, the email associated with your account, the organization name if applicable, and a clear statement that you opt out of the class-action waiver. An opt-out on behalf of a business must be sent by someone authorized to act for that business. No postal letter or opt-out fee is required.

If you timely opt out, neither you nor FlashCat LLC is bound by this waiver for claims between us. Opting out does not affect your account, pricing, services, or the remaining terms. A valid opt-out remains effective through later renewals or updates. If we materially change this waiver, you receive a new 30-calendar-day opt-out period beginning on the later of our notice of the change or your acceptance of the changed waiver; a previous valid opt-out remains effective.

This waiver does not restrict complaints to regulators, participation in government investigations, or claims, representative proceedings, or public injunctive relief that applicable law does not allow to be waived. If a court finds any part of this waiver unenforceable for a particular claim or remedy, that part is severed only to the extent necessary and that claim or remedy may proceed as permitted by law; the remaining terms continue to apply.

This waiver applies prospectively to disputes arising from events after you accept it, and does not alter an already-filed proceeding. A court, rather than an arbitrator, decides the waiver’s applicability and enforceability.

17. General terms

Neither party is responsible for delay caused by events reasonably beyond its control, except for payment obligations already incurred. Invalid provisions are limited or severed only as needed, and the remainder continues. Failure to enforce a provision is not a waiver.

You may transfer this agreement for the relevant operating business to a successor in a merger, reorganization, or sale of all or substantially all of that business or its assets without our prior consent or a transfer fee, if the successor continues that business and assumes this agreement and outstanding obligations in writing. Notify us and update account ownership records within 30 days after the transfer. A change in shareholders or control that leaves the contracting legal entity in place does not terminate this agreement or require our consent; update affected account ownership records within the same period. These permissions do not authorize a standalone sale or resale of service accounts, credentials, or software. Other transfers require our consent except as applicable law permits.

We may verify the authority of new account administrators before changing access. Contractual permission to transfer does not itself transfer third-party accounts or credentials or waive provider-specific verification, approval, or legal requirements for numbers, domains, or other resources. This permission does not erase existing liabilities or guarantee that a provider will transfer a resource. Software transfers are governed by the release license, including its separate business-succession provision.

We may assign this agreement in connection with a merger, reorganization, or sale of the relevant business, subject to privacy obligations. Provisions that by their nature should survive termination do so. These terms, incorporated policies, applicable license, and agreed orders form the agreement for their subject matter.