Terms of Service

This agreement is between Digidan (Pty) Ltd (registration number 2017/184017/07), a private company incorporated in the Republic of South Africa, trading as DeploySeal (“we”, “us”), and the organisation on whose behalf you accept it (“you”, the “Customer”).

By creating an organisation, accepting an invitation to one, or using the service, you accept these terms and confirm that you are entitled to bind that organisation. If you are a tester or signer who has been invited by a customer, section 8 applies to you and the rest of these terms bind the organisation that invited you.

The privacy policy, the data processing agreement and the refund policy form part of this agreement.

DeploySeal is a hosted service for reviewing a website before a release: inviting testers to work through tasks on the live or staging site, capturing issues with screenshots and session replays through a widget installed on that site, tracking the fixes and retests, and producing a sealed release record signed by the people you nominate. It includes a public API, installers for several platforms and integrations with issue trackers and chat tools.

We may change the service as we develop it. We will not remove a capability you rely on without 30 days’ notice unless security or the law requires it.

DeploySeal is in a private pilot. Access is by invitation. Accepted organisations may use the service free of charge for the pilot period we agree with them, normally 60 days from the first launched review, with no automatic charge at the end. Before the period ends we will propose terms for continuing. Continuing requires your explicit agreement; nothing converts to a paid plan on its own.

During the pilot we give no uptime commitment, though we publish live status at deployseal.com/status and treat the pilot as production. Either side may end the pilot on 14 days’ written notice. Section 12 on what happens to your data applies when it ends.

• Give us accurate details and keep them current. One person, one account; do not share credentials.
• You are responsible for what is done under your organisation’s accounts. Protect them: use two-factor authentication or passkeys, and remove people who leave.
• Tell us at security@deployseal.com as soon as you suspect an account has been compromised.
• Owners and admins of an organisation can see and control everything in it, including other members’ work.

The widget records what testers see and do. Because of that, you agree that you will:

• Install the widget only on websites you own or are authorised to test, and only on the environments you register in DeploySeal.
• Tell your testers that their session on the site is recorded. The widget shows a notice, but the lawful basis for recording is yours to establish.
• Mask any element that shows personal information about third parties, card details or other sensitive content, using the masking attributes we document. Typed input is always masked, but visible page text is recorded unless you mark it.
• Not point testers at pages that display other people’s personal information you have no right to record, such as a live admin area showing real customer orders, unless it is masked.
• Set an evidence retention period appropriate to your obligations, and purge evidence you no longer need.
• Keep your site keys and API keys secret, and rotate them if they leak.

For the personal information collected through the widget you are the responsible party and we are your operator, under the data processing agreement.

Everything your organisation puts into DeploySeal, and everything the widget captures for you, is yours (“Customer Data”). You give us a licence to host, copy, process, display and transmit it only as needed to run the service for you, to keep it safe and to comply with the law. We claim no other rights in it, and we do not use it to train models or for any purpose of our own.

You can export issues, evidence packages and sealed records at any time from within the service and through the API.

• A sealed record is a snapshot of a review at a moment in time, together with the statements and electronic signatures of the people you nominated as signers. Once sealed, its content cannot be edited. A later version can be sealed alongside it.
• Signatures are electronic signatures within the meaning of the Electronic Communications and Transactions Act 25 of 2002. We record who signed, what they signed, when, and from which address, and we sign the record’s digest with a key held in Azure Key Vault so that any later change is detectable.
• A sealed record proves what was tested and who approved it. It is not a warranty from us that the website works, is secure, or is fit to release. That judgement is yours and your signers’.
• Sealed records and their audit trail are retained for the life of the organisation, even after the evidence attached to them has been purged, because the signatures depend on them.

If you have been invited to review a website or sign a record, you accept the following when you open your link:

• Your session on the website under review is recorded as described in the privacy policy. Do not type anything into the website that you would not want the organisation to see, even though typed input is masked.
• What you submit (issues, comments, verdicts, your signature on a record) belongs to the organisation that invited you.
• Your link is personal. Do not share it. It can be paused or withdrawn by the organisation at any time.
• Questions about why you were invited or what happens to your contribution go to the organisation first; we will help if that fails.

You will not, and will not let anyone using your organisation:

• Install the widget on a website you have no right to test, or use the service to gather information about a website or its users without authority.
• Upload or capture content that is unlawful, infringes someone else’s rights, or contains malware.
• Probe, overload or interfere with the service, or try to get at another organisation’s data. Security researchers are welcome to report findings to security@deployseal.com.
• Resell the service, or use it to build a competing product.
• Exceed the published rate limits of the API, or work around them.

We may suspend an organisation or an account that breaks these rules, after telling you, unless the risk to others makes immediate suspension necessary.

You may connect issue trackers, chat tools, Zapier and webhooks. When you do, we send issue and campaign data to those services on your instruction. Those services are governed by their own terms and are your responsibility; we are not liable for what they do with the data or for their availability. Disconnecting an integration stops future sending but does not retrieve what was already sent.

No fees are charged during the pilot. When paid plans open, the following will apply:

• Prices are published at deployseal.com/pricing in US dollars and exclude any tax, which is added at checkout where it applies.
• Payments are taken by our payment partner acting as merchant of record. Your contract of sale for the subscription is with that partner; your contract for the service remains with us.
• Subscriptions renew monthly or yearly until cancelled. You can cancel at any time from your organisation’s billing page; access continues to the end of the paid period.
• We may change prices with 30 days’ notice. A change takes effect at your next renewal after the notice.
• If a payment fails, we will remind you and may restrict the organisation to read-only after 14 days until it is settled.
• Refunds are handled under the refund policy.

• By you. Cancel at any time. The service stays available to the end of the current pilot or paid period.
• By us. We may end the agreement on 30 days’ notice, or at once if you materially breach it and do not put it right within 14 days of being told, or if continuing would expose us to legal risk.
• Afterwards. For 30 days after the agreement ends you can sign in to export your data. We then delete the organisation’s data, including sealed records, within a further 30 days, except what we must keep by law and backups, which expire within 7 days. Export your sealed records before then if you need to keep them.
• Sections 6, 7, 13, 14, 15 and 17 continue to apply after the agreement ends.

Each of us will keep the other’s non-public information confidential and use it only for this agreement, with the usual exceptions for information that is already public, independently developed, received from someone entitled to share it, or required to be disclosed by law (in which case we tell the other side first where we can). Customer Data is your confidential information. Our confidential information includes the service’s non-public design and pricing offered to you privately.

We own the service, its software, the widget, its documentation and the DeploySeal name and marks. You get a non-exclusive right to use them as these terms allow while the agreement lasts. If you give us feedback we may use it without obligation. Nothing here transfers any of your rights in Customer Data to us.

We will provide the service with reasonable skill and care and as described in our documentation. Beyond that, the service is provided as is: we do not promise it will be uninterrupted or error-free, and we give no warranty, express or implied, about fitness for a particular purpose. A sealed record is evidence of a process, not a guarantee of an outcome (section 7).

Our liability to you for all claims arising in any twelve-month period is limited to the fees you paid us in that period, or USD 100 if you paid nothing. Neither of us is liable to the other for indirect or consequential loss, lost profits, lost data that was exportable and not exported, or loss caused by a third-party service you connected. Nothing limits liability for fraud, death or personal injury caused by negligence, or anything that cannot lawfully be limited.

You indemnify us against claims by third parties that arise from Customer Data, from installing the widget on a website you were not entitled to test, or from recording people without a lawful basis. We indemnify you against claims that the service, used as these terms allow, infringes a third party’s intellectual property, and we may fix, replace or withdraw the affected part to resolve such a claim.

We may update these terms. Material changes are announced by email to organisation owners and by a notice in the application at least 30 days before they apply. If you do not accept a change you may cancel before it takes effect; continuing to use the service after that date is acceptance.

• These terms are governed by the law of the Republic of South Africa. The courts of South Africa have jurisdiction, and you consent to the jurisdiction of the Magistrates’ Court where that court would otherwise lack it.
• Before either of us starts proceedings, we will try for 30 days to resolve the dispute by discussion between people with authority to settle it.
• Notices to us go to desk@deployseal.com or to our registered address below. Notices to you go to the email address of your organisation’s owner.
• If any part of these terms is found unenforceable, the rest still applies. Neither side may assign the agreement without the other’s consent, except that we may assign it to a successor to our business on notice to you.