Terms of Service

1 The agreement, and what the words mean

These Terms are a contract between Efferent Media LLC, a New York limited liability company doing business as Consential ("Consential", "we"), and the practice or organisation that subscribes ("you", "Customer"). They take effect when you accept them, sign an order form referencing them, or begin using the Service, whichever happens first. The person accepting must be authorised to bind the Customer.

Where an executed order form conflicts with these Terms, the order form governs for that subject only. Where the Business Associate Agreement conflicts with these Terms in relation to protected health information, the BAA governs. Where the Data Processing Addendum conflicts in relation to personal data, the DPA governs.

• Service — the Consential consent management platform, the accessibility monitoring service, the consent widget, the preference centre, the reports, and the dashboards, as we make them available from time to time.
• Customer Site — a website you own or are authorised to modify, on which the Service is installed.
• Consent Record — a row written when a visitor to a Customer Site makes or changes a consent decision, containing the ten fields listed in our Privacy Policy.
• Customer Data — Consent Records, scan results, reports, and configuration belonging to you.

2 What the Service does

Subject to these Terms and to payment, we grant you a non-exclusive, non-transferable right to use the Service on your Customer Sites during the subscription term.

The Service, depending on the modules on your order form:

1. holds non-essential third-party tags on a Customer Site until a visitor makes a choice, and releases only those the visitor allowed;
2. writes each decision to an append-only record with a timestamp and a hash of the policy text in force at that moment;
3. signals that decision to platforms that accept a consent signal, where you have configured them;
4. scans Customer Sites against WCAG 2.1 AA on a schedule and produces a dated report of what it found; and
5. flags when a published privacy notice has stopped matching what the site does.

We may change how the Service works. We will not materially reduce its core functionality during a paid term without giving you notice and, if the reduction is material and you object, a pro-rata refund of the unused balance.

3 Your account

You are responsible for the credentials issued to your users, for the acts of those users, and for telling us promptly if you believe an account has been compromised. You must be a business; the Service is not sold to consumers. You must be at least 18.

4 Fees, renewal, and cancellation

4.1 Fees

Fees are those stated on your order form or on our pricing page at the time you subscribe. Subscriptions are billed monthly or annually in advance. Fees are exclusive of taxes, which you are responsible for except for taxes on our income.

4.2 Renewal and price changes

Subscriptions renew automatically for successive terms of the same length unless cancelled. We may change fees at renewal on at least 30 days' written notice before the renewal date; if you do not accept the change, cancel before the term ends and the change will not apply to you.

4.3 Cancellation

You may cancel at any time, effective at the end of the then-current term. We do not refund fees already paid for a term in progress except as stated in section 2 or where required by law. There is no cancellation fee and no minimum commitment beyond the term you bought.

4.4 Non-payment

If an invoice is more than 30 days overdue we may suspend the Service after giving you 10 days' written notice and an opportunity to pay. We will not delete, withhold, or condition access to your Consent Records for non-payment, and suspension does not affect your right to an export under section 13.3. Charging a practice for access to the evidence it may need is not a business we are willing to be in.

5 What you are responsible for

The Service acts on your website, at your direction. Accordingly you are responsible for:

• owning, or being authorised to modify, every Customer Site on which you install it;
• the accuracy of your configuration — in particular, which tags you assign to which category. We hold what you tell us to hold. A tag you do not declare, or that a plugin or a theme injects outside the Service's reach, is not held;
• the content of your own privacy notice and consent language;
• deciding, with your own counsel, what your legal obligations are; and
• ensuring that anything you send us is lawful for you to send, and does not include protected health information except as contemplated by the BAA.

6 Acceptable use

You may not: resell or sublicense the Service except under a written partner agreement with us; attempt to gain access to another customer's data; probe, scan, or load-test our infrastructure without written permission; use the Service to scan a website you neither own nor are authorised to test; reverse engineer the Service except to the extent that restriction is unenforceable where you are; or use the Service to build a competing product.

Security researchers acting in good faith are welcome. See the reporting route on our Security page; we will not pursue you for testing that follows it.

7 Your data

Customer Data is yours. We claim no ownership of it. You grant us only the licence needed to host, process, transmit, and display it in order to provide the Service, and to produce aggregated statistics that do not identify you, any Customer Site, or any visitor.

We do not use Customer Data to train models, we do not sell it, and we do not share it between customers. Our handling of personal data is governed by the DPA and, where protected health information is involved, by the BAA.

8 Our intellectual property

The Service, the software, the scanning engine, the reports' format and the Consential name and marks are ours and stay ours. Nothing here transfers them. Feedback you give us we may use without obligation, but we will not identify you as its source without asking.

9 What we warrant, and what we expressly do not

9.1 What we warrant

We warrant that we will provide the Service with reasonable skill and care, and that we will not materially decrease its security protections during a paid term. If we breach this warranty and cannot fix it within 30 days of your written notice, you may terminate and receive a pro-rata refund of the unused balance. That is your exclusive remedy for breach of this warranty.

9.2 What we do not warrant

Read this section. It is the honest description of a compliance product.

• We do not guarantee compliance with HIPAA, the ADA, WCAG, any state privacy statute, or any other law. Compliance is determined by a regulator or a court on the facts of your practice. No vendor can grant it and any vendor who says otherwise is selling you something they cannot deliver.
• We are not a law firm and nothing we produce is legal advice. Our documents, our reports and this page are not a substitute for your own counsel.
• We do not warrant that the Service detects every tracking technology. Server-side tracking, tags hardcoded into theme files, scripts injected by plugins, and tracking inside third-party iframes we do not control may be outside its reach.
• Automated accessibility testing is partial by nature. It catches a real but incomplete share of what disabled patients actually encounter. It does not replace testing with a human being.
• Except as stated in 9.1, the Service is provided "as is", and we disclaim all other warranties, express or implied, including merchantability, fitness for a particular purpose, and non-infringement, to the fullest extent permitted by law.

10 Limitation of liability

Neither party is liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, or goodwill, even if told such damages were possible.

Each party's total aggregate liability arising out of or relating to this agreement is limited to the fees you paid or owed for the twelve months immediately before the event giving rise to the claim.

Those two limits do not apply to: (a) your obligation to pay fees; (b) either party's indemnity obligations under section 11; (c) a party's breach of confidentiality; (d) our obligations under the BAA in respect of protected health information; or (e) fraud, wilful misconduct, gross negligence, or any liability that cannot lawfully be limited.

Some states do not allow certain exclusions, and to that extent they do not apply to you.

11 Indemnities

We will defend you against a third-party claim that the Service, used as permitted, infringes that party's US intellectual property rights, and pay damages finally awarded or agreed in settlement. If the Service becomes subject to such a claim we may modify it, procure the right to continue, or terminate the affected part and refund the unused balance.

You will defend us against a third-party claim arising from a Customer Site, your configuration of the Service, content you supplied, your breach of section 5 or 6, or your installation of the Service on a site you were not authorised to modify.

Either indemnity requires prompt notice, sole control of the defence by the indemnifying party, and reasonable cooperation. No settlement admitting fault binds the other party without consent.

12 Confidentiality

Each party will protect the other's non-public information with at least reasonable care and use it only for this agreement. This does not cover information that is public, already known, independently developed, or lawfully received from someone else. Compelled disclosure is permitted if the other party is given notice and a chance to object, where lawful.

Scan findings about your website are your confidential information. We do not publish them, cite them, or use them as a sales example without your written permission.

13 Term, termination, and getting your data out

13.1 Term

This agreement runs while you hold an active subscription.

13.2 Termination for cause

Either party may terminate for the other's material breach that is not cured within 30 days of written notice, or immediately if the other becomes insolvent.

13.3 Your export right

On termination or cancellation you may request, and we will provide, a complete machine-readable export of your Consent Records and reports. We will provide it within 30 days of the request, free of charge, and the right survives for the balance of the retention period in Privacy Policy section 9. Cancelling stops collection, dashboards and reports; it does not destroy the archive.

13.4 Survival

Sections 7, 8, 9.2, 10, 11, 12, 13.3, 16 and 17 survive termination.

14 Professional services

Work performed on your website — accessibility remediation and consent mode implementation — is not part of the subscription. It is separate, one-time work under its own written scope agreed before it begins, stating which pages are in scope, what will be changed, and how a change is rolled back. These Terms, including sections 9, 10 and 11, apply to that work.

15 Changes to these Terms

We may update these Terms. For a change that materially reduces your rights or increases your obligations, we will give at least 30 days' notice by email before it takes effect, and if you object you may terminate before the effective date and receive a pro-rata refund. Continued use after the effective date is acceptance. The version in force when you subscribed governs your current term unless you agree otherwise.

16 Governing law and disputes

New York law governs, without regard to its conflict-of-laws rules. The UN Convention on Contracts for the International Sale of Goods does not apply.

Before filing anything, the parties will try in good faith for 30 days to resolve the dispute between people with authority to settle it. If that fails, the state and federal courts sitting in Nassau County, New York have exclusive jurisdiction, and both parties consent to venue there and waive any objection based on inconvenient forum.

Nothing prevents either party from seeking injunctive relief where it is needed to stop ongoing harm.

17 General

These Terms, with any order form, the DPA and the BAA, are the entire agreement and supersede earlier discussions. If a provision is unenforceable, the rest stands and that provision is limited to the minimum extent necessary. A failure to enforce is not a waiver. You may not assign without our consent, except to a successor to your business; we may assign to an affiliate or a successor. Neither party is liable for delay caused by events beyond its reasonable control. There are no third-party beneficiaries. The parties are independent contractors.

Notices to us: Contact. Notices to you: the email on your account. Notice is effective on the next business day after sending.