Product terms of service

1. Business use; authority

StructLine is a business tool, offered to organizations, not to consumers. The person accepting these terms confirms they have authority to bind the Customer. “Users” are the individuals the Customer authorizes to access the service: administrators, read-only compliance viewers, and workforce members whose devices are enrolled.

2. The service

StructLine discovers the AI tools a Customer’s workforce uses, identifies the kinds of data flowing into them, and maintains compliance records (the AI register, exposure reports, audit trail). The service is provided per the plan selected, currently Discover (free), Comply (paid) and Enforce (paid), as described at the time of ordering. Plans are ranked: each paid plan includes everything in the plans below it. Comply is the evidence layer (the AI register, exposure reports, DPIA recommendations, vendor risk records, audit trail). Enforce adds active, on-device enforcement: policies authored by the Customer’s administrators that warn a user, coach them toward an approved tool, block a submission, or mask detected sensitive values in a prompt before it reaches the AI tool, with optional reversible tokenization. Enforcement is off by default (it acts only after an administrator turns it on and authors policies), and enforcement decisions are recorded as metadata only (the policy, the action, the time), never the content acted on.

Roadmap features are not part of the service. Capabilities described on our website or elsewhere as “coming”, “roadmap” or similar are not provided under this agreement until we make them generally available and they are included in the Customer’s plan.

Early access and beta features, where offered, are provided as-is for evaluation, may change or be withdrawn at any time, and are excluded from any service commitments.

3. Accounts, enrollment and acceptable use

• The Customer is responsible for its Users’ compliance with this agreement, for keeping credentials confidential, and for its configuration choices (privacy mode, detection categories, retention, corporate domains).
• Devices are enrolled with single-use tokens; the Customer must enroll only devices it is entitled to manage.
• The Customer must not: use the service to monitor individuals it has no lawful authority to monitor; resell it except under a separate agreement with us; reverse-engineer it except as permitted by law; use it to build a competing product; interfere with its operation or attempt unauthorized access; or use it in violation of applicable law.

4. The Customer’s responsibilities as employer and controller

StructLine observes workforce use of AI tools. The Customer, not StructLine, is the controller of that monitoring data and is solely responsible for deploying the service lawfully in each jurisdiction where it has workforce members, including:

• establishing a lawful basis for workplace monitoring and conducting any required assessment (for example a DPIA where the processing warrants it);
• informing its workforce that StructLine is in use and what it can see; the product’s built-in transparency supports this but does not replace the Customer’s own notice obligations;
• consulting works councils, staff representatives or unions where required;
• choosing a privacy mode proportionate to its purposes; the default is zero-retention, and escalating collection is the Customer’s explicit, recorded decision.

We process the monitoring data as the Customer’s processor under the data processing agreement, which is incorporated into this agreement.

Indemnity for unlawful use. The Customer indemnifies StructLine against third-party claims, and against regulatory investigations, penalties and losses, arising from the Customer’s unlawful use of the service. This includes monitoring workforce members without a lawful basis, without the required notice, or without any required works-council or employee-representative consultation. This indemnity is not subject to the liability cap in section 10.

5. Fees and payment

• Paid plans are priced per employee on total headcount, at the rates published or agreed in an order, with a flat minimum fee for organizations of up to 25 employees. Yearly billing is the default and carries the published headline rate: one payment per year of twelve times the monthly-equivalent rate. Monthly billing is available at the published premium.
• Self-serve subscriptions are bought and managed through our payment provider, Stripe: checkout, invoices, payment methods, headcount changes, plan and interval switches, and cancellation run in the Stripe-hosted checkout and billing portal. Payment card data is collected and held by Stripe and never touches our systems. Self-serve checkout is available up to 250 employees; larger organizations subscribe under a sales-assisted order.
• Headcount is self-reported: the Customer declares its total employee headcount at checkout (at least the members already known to the service) and keeps it reasonably accurate in the billing portal as the organization grows. We may sanity-check reported headcount against reasonable evidence; if it is materially understated, we may invoice the difference retroactively for the current term.
• Fees are exclusive of VAT and similar taxes. Where VAT applies it is calculated at checkout from the Customer’s billing address; a validated VAT number applies the reverse charge where the law provides for it. Fees are non-refundable except where this agreement says otherwise or the law requires it.
• If a renewal payment fails, it is retried and the plan stays active for a short grace period; if payment is not made, the subscription ends and the account reverts to the free plan as described in section 11.
• We may offer free trials of paid plans; at the end of a trial the account reverts to the free plan unless a subscription is purchased.
• Price changes take effect from the next renewal, with at least 30 days’ notice.

6. Intellectual property; Customer data; feedback

StructQ Ltd owns the service and all intellectual property rights in it: the software, models, design and documentation, and the StructLine name and brand. Nothing in this agreement transfers those rights to the Customer. The Customer owns its data (the findings, registers, reports and content processed for it) and grants us only the rights needed to run the service. Generated compliance artifacts (the AI register, exposure reports) belong to the Customer and may be shared with its auditors, clients and regulators. We may use feedback to improve the service without obligation. We do not use Customer data to train AI models.

7. Confidentiality

Each party protects the other’s confidential information with at least the care it uses for its own, uses it only to perform this agreement, and discloses it only to those who need it and are bound to confidentiality, or where disclosure is required by law, with notice where lawful.

8. Service changes, suspension and availability

We develop the service continuously and may modify it, provided we do not materially reduce the core functionality of the Customer’s plan during a paid term. We may suspend access immediately where necessary for security, legal compliance, or material breach (including non-payment), restoring it once the cause is resolved. We aim for high availability but, absent a separately agreed SLA, do not guarantee uninterrupted service.

Discontinuation and wind-down. If we discontinue the service, or wind down as a company, we will notify the Customer’s administrators at least 60 days in advance where the circumstances allow, and in any event with as much notice as we lawfully can. Through that period the export tools remain available, so the Customer can take its data with it: the AI register, exposure reports, the audit trail, and the per-person data export. We will refund prepaid fees for the period after the service ends, pro rata, and afterwards delete personal data as set out in the DPA. The compliance artifacts the Customer has exported are its own, and remain usable after the service ends.

9. Warranties and disclaimers

We warrant that we provide the service with reasonable skill and care. Beyond that, the service is provided without other warranties, express or implied. In particular:

• Detection is not exhaustive. StructLine is designed for high-precision detection, but no detection technology finds every AI tool or every piece of sensitive data. The service reduces and evidences risk; it does not eliminate it, and it is not a guarantee that data has not left the organization.
• Outputs are not legal advice. The AI register, DPIA recommendations, regulatory mappings and similar outputs support the Customer’s compliance work; they do not constitute legal advice, and using StructLine does not by itself make the Customer compliant with the GDPR, the EU AI Act or any other law.
• Enforcement is designed fail-open. Enforce’s policies are evaluated on the device, and the service is engineered so that governance never takes a work tool down: where a policy decision cannot be made in time (for example, an AI tool changes its interface, or a decision exceeds the latency budget), the prompt proceeds and the stand-down is recorded in the enforcement log. Enforce reduces the risk of sensitive data leaving the organization; it is not a guarantee that every policy violation is prevented.

10. Liability

Nothing in this agreement excludes or limits liability that cannot be excluded under the law of England and Wales (including for death or personal injury caused by negligence, or fraud). Subject to that: neither party is liable for indirect or consequential loss, loss of profits, revenue or goodwill; and each party’s total aggregate liability under this agreement is capped at the fees paid or payable by the Customer in the 12 months before the event giving rise to the claim, or £1,000 where the Customer uses only the free plan. The cap does not limit the Customer’s obligation to pay fees due, or the Customer’s indemnity under section 4.

11. Term, termination and exit

• Self-serve subscriptions run for the billing period selected (month or year) and renew automatically at the end of each period. The Customer can cancel at any time in the billing portal; cancellation takes effect at the end of the current period, which remains paid and usable. Sales-assisted orders renew per the order; free-plan use runs until terminated. Either party may terminate for material breach not cured within 30 days of notice, or immediately on the other’s insolvency.
• When a paid subscription ends, the account reverts to the free Discover plan: paid features stop, but the organization keeps its account and data, and compliance reports generated while the plan was active remain readable: the audit record belongs to the Customer.
• On termination, the Customer can export its data (including the per-person GDPR export and report exports) before its account closes; afterwards we delete or return personal data as set out in the DPA.
• The confidentiality, IP, liability and governing-law provisions survive termination.

12. Changes to these terms

We may update these terms. For paid Customers, material changes take effect at the next renewal, with at least 30 days’ notice to administrators; for free plans, 30 days after we post the change. Continued use after the effective date is acceptance.

13. General

This agreement (with the order and the DPA) is the entire agreement about the service and supersedes prior discussions. Neither party may assign it without the other’s consent, except to an affiliate or in a merger or sale of substantially all assets, with notice. Notices go to the administrators’ registered emails (to the Customer) or to [email protected] (to us). Failure to enforce a provision is not a waiver. If any provision is held invalid or unenforceable, it is severed and the remaining provisions continue in full force and effect. This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.