ArcGabriel Terms of Service

Version 1.5, September 2026

These Terms are a contract between you (the business subscribing, "you", "the

Client") and ArcGabriel Ltd ("we", "us", "the Service"), a company registered

in England and Wales (company no. 17389329). ArcGabriel is the

trading name of ArcGabriel Ltd.

By signing during onboarding you agree to them. Please read them; they are

written to be readable.

1. What the Service is, and is not

ArcGabriel is automated marketing software. It audits your website, produces a

prioritised search-engine optimisation strategy from what it finds, designs

social media content, publishes it to accounts you connect, and reports monthly

on the work done and the results measured.

The strategy is a set of recommendations, not changes made to your website.

We have no access to a website we did not build, and nothing in the report is

applied to such a site automatically: the report names each problem, the fix,

and the order to do them in, for you or whoever maintains your site to carry

out. A website we build and host for you is a different matter: it is

constructed to meet those recommendations from the outset, and we maintain it.

We do not and cannot guarantee search rankings, traffic levels, or revenue.

No honest provider can: search engines are controlled by their operators, not

by us. What we commit to is the work itself: done, logged, and reported to you

every month with real numbers, never invented ones.

2. Your account

You get an account for your business. Keep your password secret; you are

responsible for activity under your account. We may block an account that we

reasonably believe is compromised or being used in breach of these Terms, and

will tell you if we do.

3. Subscriptions, payment and cancellation

Plans and prices are as shown at checkout, exclusive of VAT.
Monthly plans: you can cancel at any time. Your subscription runs to the

end of the period already paid, which is your only minimum commitment, and

does not renew after that.

Annual plans: you pay for a year at a discount; the plan runs to the end

of the paid year and renews unless cancelled before renewal.

Payment is taken by card through Stripe, our payment processor.

If a payment fails. It is usually an expired card, and we would rather sort

it out than switch you off. This is exactly what happens, and we will not do

anything to your account that isn't on this list:

1. Straight away, we email you: what was declined, how much, when your bank

will be asked again, a link to pay it there and then, and what stops if it

isn't paid. Everything keeps running.

2. After 48 hours unpaid, we stop producing and publishing new work: no

new posts, adverts, LinkedIn drafts or reports. **Nothing you already have is

touched.** Every post, image, report and document stays in your account and

stays downloadable, anything already published stays published, and you can

still sign in and use your account normally. Your website stays live.

3. After a further 7 days, if you have a website with us, we give you seven

days' written notice that it will come offline.

4. After 14 days from the pause, the website is taken offline. It is not

deleted: the pages, the text, the photographs and your domain settings all

remain exactly as they are.

Paying at any point in that sequence restores everything immediately, including

putting the website back, with nothing lost and nothing to set up again. We

never delete your content because of an unpaid invoice; deletion happens only

on cancellation, and then only after the 90 days set out in section 6.

If the problem is money rather than the card, tell us. We would rather move you

to a smaller plan for a while than lose you.

Prices may change; we give at least 30 days' notice, and changes never apply

to a period you have already paid for.

Statutory cancellation: where a 14-day cooling-off right applies to you, you

may cancel within 14 days of first subscribing for a refund, less a

proportionate charge for service already delivered with your agreement.

4. What we need from you

The Service needs truthful information about your business, access you choose

to grant (for example your website platform or social accounts), and materials

you upload. You confirm that whatever you provide is yours to provide: that

uploads don't infringe anyone's rights, and that connected accounts are yours

to connect. You remain responsible for your business's own legal compliance

(for example, the accuracy of claims about your own products).

5. Content the Service produces

Content generated for you (posts, articles, reports) is yours to use once your

subscription for the relevant period is paid. You are responsible for content

you approve for publication: the Service drafts and, where you enable it,

publishes, but it acts under your standing instruction, and you can pause

publishing or switch to approve-first mode at any time.

6. Your data, deletion, and the recovery window

You can delete any file you upload. Deleted files disappear from your

account immediately. **For your protection they are retained by us, marked

for deletion, for 90 days** (so an accidental deletion can be reversed on

request) and are then erased permanently and automatically. You may

request immediate permanent erasure instead, and we will honour it.

On cancellation, your data is retained for 90 days (so you can return or

export), then erased, except records we must keep by law (for example

invoices) and the signed copy of these Terms.

Full details of how we handle personal data are in the Privacy Policy, which

forms part of this agreement.

7. Acceptable use

You may not use the Service for anything unlawful, deceptive, or harmful:

including sites or content promoting illegal goods or services, infringing

others' rights, or attempting to manipulate the Service itself. We may decline

or stop serving content or sites that would put us in breach of law, platform

rules (for example Meta's terms), or advertising standards, and will tell you

why.

8. Service availability and changes

We aim for continuous operation but do not promise uninterrupted availability.

We back up data daily. We may improve or change features; if a change

materially reduces what you pay for, you may cancel and receive a

proportionate refund for the unused paid period.

Feedback and suggestions. We welcome ideas through your account or by

email. By sending a suggestion you agree we may use it, in whole or part,

without restriction or payment; you keep no rights in what we build. Where we

adopt an idea we may, at our sole discretion, thank the suggester with a

discount or credit; this is a gesture, not an entitlement, and similar or

duplicate suggestions carry no claim.

9. Liability

Nothing in these Terms excludes liability that cannot lawfully be excluded

(including for death or personal injury caused by negligence, or fraud).

Subject to that:

We are not liable for indirect or consequential loss, loss of profit, or

loss of business opportunity.

Our total liability arising from or connected with the Service in any

12-month period is capped at the amount you paid us in that period.

We are not liable for decisions of third parties (including search engines

ranking or de-ranking pages and social platforms restricting accounts),

though we will always work within their published rules.

10. Governing law and jurisdiction

These Terms are governed by the law of England and Wales, and its courts have

exclusive jurisdiction: **wherever you subscribe from, you agree the Service

operates under UK law and regulation.** If you subscribe as a consumer in a

jurisdiction giving you mandatory local rights, those rights are unaffected.

11. Changes to these Terms

We may update these Terms; material changes are notified by email at least 30

days before they take effect, and the version you signed remains available,

unaltered and verifiable, in your account.

12. Data protection: who is responsible for what

Two different things happen in this Service and the law treats them

differently.

Your account. For your own account (your name, your email, your business

details, your payment record, your sign-ins) we are the controller. We

decide what to hold and why, and the Privacy Policy explains it.

Your customers. For personal data about your customers, staff or

contacts that you put into the Service (a customer's name and contact details

entered for a review request, people who appear in photographs you upload,

anyone you name in material you give us to publish) **you are the controller

and we are your processor**. It is your data about your people. You decide who

goes in and why; we hold it, work on it and hand it back, and we act on your

instructions and nobody else's.

That distinction has consequences that are good for you. We only do what you

tell us to with that data. We do not use it for our own purposes, and we do not

use it to train anything. You can have it back or have it erased. And the terms

that govern it are set out in Schedule 1, which is part of this agreement and

satisfies Article 28 of the UK GDPR, so you do not need a separate contract

from us.

The obligations run both ways. Because you are the controller of that data, it

is you who must have a lawful basis for holding it and for contacting the

people concerned, and you who must answer them if they ask what you hold. The

Service asks you to confirm that basis at the point you enter someone, and

gives you a one-click erasure for every record, precisely so those duties are

possible to meet rather than theoretical.

Schedule 1: Data processing terms

*These terms apply where we process personal data on your behalf, as described

in section 12. They are the terms required by Article 28(3) of the UK GDPR.

Where this Schedule conflicts with the rest of these Terms on a data protection

question, this Schedule wins.*

1. The processing, described

Subject matter	Provision of the ArcGabriel marketing service
Duration	For as long as your subscription runs, plus the retention periods in paragraph 8
Nature and purpose	Storing, organising, drafting from, displaying back to you, backing up and erasing personal data you enter or upload, so that the Service can prepare marketing material and review requests for you to use
Types of personal data	Names and contact details (email address or mobile number); a short note of work done for a person; the drafted message addressed to them; any personal data appearing in files you upload or in text you give us to publish, including images of identifiable people
Categories of data subject	Your customers and prospective customers; your staff; anyone else you choose to include in material you give us
Special category data	None is asked for and none should be entered. The Service is not built for it and you should not use it for it

2. We act only on your instructions

We process that personal data only on your documented instructions, which are:

these Terms, the choices you make in the Service, and anything else you ask us

in writing. That includes any transfer of the data out of the UK. If we are

ever required by law to process it otherwise, we will tell you first unless the

law forbids us from saying so.

If we think an instruction of yours breaks data protection law, we will tell

you straight away and we may decline to carry it out until it is resolved.

We will not use your customers' personal data for our own purposes, will not

sell or share it, and will not use it to train artificial-intelligence models,

ours or anyone else's.

3. Confidentiality

Everyone we allow near that data is bound to keep it confidential, whether by

their employment contract or by a written undertaking. Access is limited to

those who need it to run the Service for you.

4. Security

We keep the technical and organisational measures required by Article 32. As at

this version those include: encryption in transit throughout; credentials for

your connected accounts encrypted at rest with a key held outside the database

and outside every backup; passwords stored using a modern memory-hard hash;

two-factor authentication on the administrative account, and available to every

person on your account from the Security page of the portal; strict separation of one

client's data from another's, enforced in the data layer rather than left to

individual queries; an append-only activity log; daily encrypted off-site

backups with a documented and rehearsed restore; and least-privilege access,

with the only person holding administrative access being the company's sole

director.

Security measures change as threats do. We may vary them, provided the

protection does not fall below the level described above.

5. Sub-processors

You give us general authorisation to use the sub-processors listed in the

data protection terms on each of them no less protective than these, and we

remain fully liable to you for what they do.

If we intend to add or replace one, we will tell you at least 30 days before it

starts. If you object on reasonable data protection grounds within that period

we will try to accommodate you; if we cannot, you may cancel your subscription

for the affected part of the Service and we will refund the unused paid period.

6. Helping you meet your obligations

Taking into account the nature of the processing, we will help you:

respond to a person exercising their rights (access, correction, erasure,

restriction, portability or objection). The Service is built so you can do

most of this yourself, immediately, without asking us;

keep the data secure, notify breaches, and carry out a data protection impact

assessment or prior consultation if you ever need one.

If a person contacts us directly about data you control, we will not answer

them on your behalf. We will tell you promptly and let you deal with it.

7. Personal data breaches

If there is a breach affecting personal data we process for you, we will tell

you without undue delay and in any event within 24 hours of becoming aware

of it, with what we know: what happened, who and what is affected, what the

likely consequences are and what we are doing about it. We will keep you

updated as we learn more. The duty to notify the ICO or the individuals is

yours as controller; we will give you what you need to discharge it.

8. Return and deletion

You can export your data at any time from your account: one file with every

record and every document we hold for you, built on demand and downloaded

straight away. Erasure is asked for from the same page, by the account holder,

and we carry it out without delay; the request is recorded, we confirm it by

email when it is done, and nothing is deleted while you can still change your

mind. When your subscription ends, we keep your data for 90 days so you can

return or export it, and then erase it, except where the law requires us to

keep something (for example, invoices, and the signed copy of these Terms).

Closed review request records are erased automatically 12 months after they are

closed, because keeping a customer's name and mobile number after the request

has run its course is storage without a purpose.

Backups follow their own cycle and are overwritten in rotation; anything

erased from the live Service disappears from backups as that rotation

completes, and is not restored.

9. Audit

We will make available the information you reasonably need to show that we are

meeting these obligations, and will allow and contribute to audits, including

inspections, by you or an auditor you appoint, on reasonable notice, no more

than once a year unless a breach or a regulator gives cause. In practice, and

for a business of your size, we expect a written questionnaire to be the

sensible way to do this and we will answer one properly.

10. International transfers

Your customers' personal data is stored in the United Kingdom or the European

Economic Area. Where a sub-processor is outside the UK, the transfer is covered

by UK adequacy regulations or by the International Data Transfer Addendum to

the EU Standard Contractual Clauses, together with a transfer risk assessment.

We will not move the processing outside the UK or the EEA without telling you

first.

ArcGabriel Ltd, registered in England and Wales, company no. 17389329.

Registered office: Carlile Institute Business Centre, 54 Huddersfield Road, Meltham, Holmfirth HD9 4AE.

Questions: hello@arcgabriel.com.