DRAFT FOR COUNSEL REVIEW - not legal advice - counsel review is planned after launch

Lumioh Cloud Terms of Service (draft)

Draft 0.2, updated 14 October 2026. See README.md for the placeholder list and the open legal questions.

These terms are drafted from the product rules in 15 - billing and entitlements, 22 - open questions, 06 - WordPress connector protocol, 12 - external crawler and 32 - data inventory. Prices, plan limits, support targets and retention periods are the owner's decisions of 14 October 2026. Where a rule is described that the product does not yet enforce, the closing section says so.

1. Who we are and what these terms cover

[COMPANY LEGAL NAME], ABN [ABN], of [REGISTERED ADDRESS] ("Lumioh", "we", "us") provides Lumioh Cloud at https://app.lumioh.com (the "Service"). By creating an account, accepting an invitation, connecting a site or otherwise using the Service you agree to these terms and to the Privacy Policy. If you use the Service for an organisation, you confirm you may bind it, and "you" includes that organisation. If you are an agency, these terms also apply to the people and clients you add.

Lumioh Cloud is an optional service. The free Lumioh SEO WordPress plugin works without it, and a Cloud trial, plan or payment state never disables the plugin's local features. The Lumioh SEO plugin, the Lumioh Cloud Connector and the Lumioh SEO Pro add-on are licensed under their own licences, not these terms.

2. Open beta

The Service is in an open beta. Anyone who meets section 3 may sign up; there is no cap on the number of accounts. The Service is provided as it is:

1. Features, limits, screens, data formats and prices can change (sections 7 and 19).
2. There is no uptime commitment and no round-the-clock support. Our support and response targets are in section 13 and are targets, not promises.
3. Backups are not switched on at launch. Until Lumioh tells you they are, there is no guarantee that data can be recovered after a failure or a mistake. Do not rely on the Service as the only record of anything important. Use the export feature (Privacy Policy, section 11) to keep your own copy.
4. Sections 6 and 18 still apply during the beta.

3. Accounts, workspaces and people

1. You must provide a working e-mail address and verify it. You must keep your password and sessions secure and tell us promptly of misuse. You are responsible for what happens under your account.
2. Work happens in a workspace (an Individual workspace, or an Organisation or Agency workspace). A workspace has an Owner (billing, deletion, ownership transfer), and may have Admins, SEO Managers, Technicians, Reporters and Client Viewers. Owners and Admins invite people; only an Owner can grant the Admin role; ownership moves only through the confirmed transfer flow. Each person's access is limited to their role and, for Technicians and Client Viewers, to assigned sites or clients.
3. If you are an Owner or Admin you are responsible for the people you invite, for the access you give a Client Viewer, and for removing people who should no longer have access.
4. A person may belong to many workspaces. One 90-day trial is allowed per person, once (section 5).
5. You must be at least 18 and have authority to agree on behalf of any organisation you represent.

4. What the Service does

The Service reads data that you approve from your connected WordPress sites, crawls those sites, reads your Google Search Console data if you connect it, and shows you findings, changes, alerts and reports. It does not change your site unless you use the optional write feature (section 11), which is not available in the beta.

5. Trial

1. A new Owner may start one 90-day trial, once per person. Invited users and additional workspaces cannot start another. A trial claim stays with its workspace and ownership transfers do not restart it.
2. No payment card is needed to start. The trial does not turn into a paid subscription unless the billing Owner explicitly starts and authorises payment. We do not charge you when a trial ends.
3. If an erased account or workspace had a trial, we keep a one-way hash of the verified e-mail address for 24 months so that a second free trial is refused (see the Privacy Policy). This is a deterrent and does not identify you.
4. The limits that apply to a trial are shown in the product and can be lower than those of a paid plan. We may refuse or end a trial if we reasonably believe it is being abused, for example through several accounts for one person.
5. When the trial ends without payment, section 8 applies.

6. Plans, fees and payment

The plans are:

1. Plans. All prices are in Australian dollars (AUD) per month and are shown without GST in the first row. There is no per-seat charge: members, invited users and Client Viewers do not change the price. Foundation includes a monthly recurring crawl schedule. The plan limits in the table are proposals that we are testing against real usage during the beta (section 7).
2. GST. We add GST of 10% to the prices above where GST applies, and issue a tax invoice.
3. Payment. Plans are billed monthly through Stripe, by the workspace's billing Owner. We do not store card numbers. Stripe's terms apply to payments. We do not offer annual billing.
4. Foundation offer. The first 100 eligible users receive 50% off the Foundation price (A$14.50 a month without GST) for their first 12 paid months, not for life. From the 13th paid month the full price applies. Eligible means a person who has claimed a trial and then starts a paid Foundation plan while the offer is open. The offer is for one person once, applies to the Foundation plan only, cannot be combined with another discount, stays with the workspace if its ownership is transferred, and ends if the subscription ends. We count the first 100 in the order in which paid Foundation plans start, and we may close the offer once 100 are reached.
5. Hard caps, no automatic overages. Each plan has included amounts. If you reach a cap we warn you and stop or defer the work; we do not charge extra automatically. If we later offer extra packs, they will be offered separately and need your approval first.
6. Cancellation. An Owner can cancel a subscription at any time. It then ends at the end of the period already paid, and section 8 applies from that point. Until the billing portal is available, ask us at support@lumioh.com.
7. Refunds. We do not refund part-used periods, except where the Australian Consumer Law or another law requires it, or where we end your plan without a breach by you (then we refund the unused part of the period you paid for). We may offer a refund as a courtesy.
8. Price changes. We will give Owners at least 30 days' notice of a price change. A change applies from the next billing period after the notice, and you can cancel before it takes effect. A price change does not alter the Foundation offer in section 6.4 for people who already have it.
9. Failed payments. While a payment is overdue we pause paid work and the workspace shows a payment problem. If the payment is not recovered after Stripe's automatic retries have run out, the subscription is cancelled and section 8 applies. Paying the overdue amount before then restores access.

7. Fair use and quotas

1. The Service limits resources, for example how many pages the crawler may visit per month, how many runs may be active, how often a manual crawl may be run for a site, and how many PDF reports you can generate. Limits are set per plan and are shown in the product.
2. The plan limits in section 6.1 are proposals that we will test against real usage and may adjust. We will give Owners at least 30 days' notice of a change that reduces a limit you already have, unless the change is needed at once to protect the Service.
3. A page counts once toward your crawl allowance when it is admitted to a crawl. Retries, robots.txt and sitemap requests count toward our own cost, not your allowance. Pausing, cancelling and scheduling are yours to control.
4. We may slow or refuse requests that exceed limits or threaten the Service.

8. When access ends (trial end, cancellation or non-payment)

When the trial ends without payment, a subscription is cancelled or ends, or payment fails (the "entitlement" ends):

1. Paid work stops. Plugin sync writes (snapshots, event batches, command results), new and in-progress crawls and Search Console reading stop; a crawl or ingestion already running is stopped and its later results are discarded. Alert and digest e-mails stop, and anything queued is cancelled. A request already on its way to Google, to your site or to an e-mail provider cannot always be recalled.
2. For 30 days you can read and export. The workspace becomes read-only: you can view your data, download exports, disconnect a site, and use the Owner's privacy and deletion request tools. Other changes (including acknowledging alerts and editing settings) are blocked. Billing and access recovery stays available.
3. After the 30 days you can no longer view or export in the product, apart from the Owner's privacy and deletion request tools. We keep the locked workspace for up to 12 months after the 30 days end. Before we delete it, we e-mail the Owner at least 30 days ahead. You can ask us to delete it sooner, or restore access by paying. When the 12 months are up we may delete the workspace's data as the Privacy Policy (section 12) describes. You can ask for deletion at any time.
4. If you restore payment, access is restored (unless the data has been deleted).
5. Your WordPress site and the Lumioh SEO plugin carry on working locally.

9. Your data

1. Ownership and licence. As between you and us, you keep your rights in your customer site data and in the reports you generate from it. You give us the licence needed to host, process, display, back up and transmit it to provide the Service and as the Privacy Policy and the DPA describe.
2. Roles. For customer site data the agency or site owner decides the purposes and we act on its instructions as processor under the DPA, which forms part of these terms when you use the Service for data about other people or businesses. For account, billing, security and operations data we are responsible as described in the Privacy Policy.
3. Your responsibilities. You must have the right to connect each site and to give us the data; give any notices and obtain any consents required from your clients, site owners and visitors; and make sure your use is lawful. You are responsible for what you put in free-text fields (client names, contact line, mute reasons) and for your brand logo (you must own it or have permission).
4. What we do not do with it. We do not sell it, use it for advertising, use it to train AI models, or send it to an AI provider. We keep internal counters (requests, bytes, durations) with no page addresses to plan capacity and cost, and we measure how the product is used with the analytics the Privacy Policy describes.
5. Deletion and its limits. You can delete a site, a client, a workspace or your account as the Privacy Policy describes. We do not guarantee that every copy is removed: audit records, logs, backups, payment-provider records and copies you exported can remain for the periods stated, and a restore from backup could bring data back. A legal hold set by us can pause an erasure.

10. Connecting sites and Google

1. Sites. You may connect a WordPress site only if you own it or have authority from its owner. The Connector asks for each permission separately, shows what will be sent, sends only what you approve, and can be revoked on the site or in Cloud. Cloud never sends code, shell commands, SQL or scripts to your site.
2. Search Console. If you connect it, you authorise us to read your Search Console data with Google's read-only permission, using your Google account. You must have the right to do so. Google's terms apply to the data it supplies. You can disconnect at any time.
3. Credentials. The credential for a site and any Google token are stored encrypted and never shown again. If you think one has leaked, disconnect and tell us.

11. The optional write feature

The Service can, in a later release, change one SEO metadata field on your site after you approve it. This feature is not available in the beta and is not part of the Lumioh SEO plugin that is listed on WordPress.org. When it is released it will be in a separate add-on, the Lumioh SEO Pro add-on, and these terms will be updated before it is used. The rules below are the intended design.

1. The feature is off by default. It only works if the site administrator installs the add-on, turns on the setting "Allow Cloud SEO writes" on the site, and approves the write permission when pairing. Turning the setting off, or disconnecting, stops it.
2. A change is limited to one SEO metadata field at a time on an existing item; it cannot create or delete items, edit post bodies or titles, or change generic options, redirects, code or database content. You see a preview of the exact before and after values. An active Owner, Admin or SEO Manager must approve; a Technician can carry out changes only on assigned sites. The site checks its own permissions and refuses if the item changed since the preview.
3. You are responsible for checking each change before you approve it and for keeping your own backups. We do not promise SEO results.

12. Acceptable use

You must not, and must not let others:

1. break the law or infringe anyone's rights, send malware, or interfere with or disrupt the Service or other customers' data;
2. access data you are not allowed to see, probe or test our security without our written permission, bypass limits, quotas or the bot check, or share credentials in a way that avoids role limits;
3. copy, resell or build a competing service from the Service, or reverse engineer it;
4. upload unlawful, deceptive or infringing content (for example a logo you do not have rights to);
5. use the Service to send spam or to collect personal information about people other than for the purposes the Service is designed for;
6. open accounts to get more than one free trial, or to avoid a suspension.

Crawling.

7. The crawler may be pointed only at sites you own or are authorised to crawl, which you have connected to your workspace. Do not connect, or ask us to crawl, a competitor's or third party's site. Competitor crawling is not offered.
8. The crawler identifies itself (LumiohCloudCrawler/1.0, with a documentation address) and follows the robots.txt rules for that name on your site; if it cannot read robots.txt reliably it does not crawl. If you want it to crawl a path, change your robots.txt; do not ask us to override it.
9. The crawler only fetches public web addresses over HTTP or HTTPS and never private or internal network addresses, loopback, link-local, cloud-metadata, file or other schemes; each redirect is re-checked. You must not configure a site, DNS record or redirect to point the crawler at an internal or third-party system, or try to use the crawler to attack or overload any system.
10. The crawler limits its page count, depth, speed and size and backs off on 429 and 503 responses. If it causes a problem, tell us and we will pause it. You can pause scheduling and cancel runs yourself. We may pause crawling at any time to protect a site or the Service.
11. The crawler's outgoing address can change. If you use an allowlist, check the documentation address in the crawler's user-agent string for the current address.

13. Support, response targets and security reports

These are targets that we work to, not promises, and they do not create a service level agreement. They are best effort; the Service is run by a very small team.

1. Support. Write to support@lumioh.com. We answer on business days (Monday to Friday, Australian Eastern time), normally within one business day.
2. Severity targets. For a security report or suspected data exposure (S1) we aim to acknowledge within one hour, on any day of the week. For a service outage (S2) we aim to respond by the next business day. For other problems and questions (S3) we aim to respond within 5 days.
3. How to report a security problem. Write to support@lumioh.com with SECURITY in the subject. Do not include passwords, tokens or customer data in the message. Please give us a reasonable time to fix a problem before you publish it. We will not take action against a good-faith report that follows these rules, does not harm others' data, and does not disrupt the Service. Testing that breaks section 12 is not covered.
4. Recovery targets. Once backups are switched on, our aim is to lose no more than 24 hours of data (recovery point) and to restore service within 8 hours (recovery time). These figures apply only once backups exist. Until then there is no recovery target.
5. Status. We will tell you about a significant outage by e-mail to Owners where we reasonably can. We do not run a public status page.

14. Security and breach

We apply the security measures described in the DPA, Annex 2. You must tell us promptly if you suspect misuse of your account or credentials. If we suspect a data breach affecting your data we will begin an assessment straight away and finish a first assessment within 72 hours of becoming aware. If it is likely to result in serious harm, we will tell you and the Office of the Australian Information Commissioner as soon as practicable, and never later than 30 days after we became aware, as the Notifiable Data Breaches scheme and the DPA require.

15. Intellectual property

We and our licensors own the Service. We grant you a limited, non-exclusive, non-transferable right to use it during your access under these terms. If you give us feedback we may use it freely.

16. Third-party services

The Service uses and connects to services we do not control, including Stripe, Google (Search Console and Google Cloud), Supabase, Resend, Cloudflare and PostHog (see subprocessors-draft.md). Their own terms and outages are not ours.

17. Suspension and ending these terms

1. You can stop using the Service at any time and ask us to delete your data (the Privacy Policy explains how).
2. We may suspend or end access if you breach these terms, if it is needed to protect the Service or other users, if the law requires, or if payment fails. We will give notice where we reasonably can, and where the breach can be fixed we will allow 7 days to fix it, unless we need to act at once to protect the Service, other people or the law.
3. Sections that by nature continue (data, payment, liability, governing law) survive.

18. Warranties, liability and indemnity

1. Consumer law. Nothing in these terms excludes, restricts or modifies a right or remedy that you have under the Australian Consumer Law or another law and that cannot lawfully be excluded. Our goods and services come with guarantees under the Australian Consumer Law that cannot be excluded.
2. Beta service. Subject to section 18.1, we provide the Service as it is and do not promise that it will be uninterrupted, error-free or fit for your particular purpose, or that using it will improve your search rankings or traffic.
3. Limit. Where the law allows, our total liability to you for all claims connected with the Service in any 12-month period is limited to the greater of the fees you paid for the Service in the 12 months before the claim arose and A$100. Where a consumer guarantee applies and the law allows us to limit our liability, we limit it to supplying the service again or paying the cost of having it supplied again.
4. Excluded loss. Where the law allows, we are not liable for indirect or consequential loss, or for loss of profit, revenue, business, goodwill, search rankings or traffic.
5. What the limits do not cover. Sections 18.3 and 18.4 do not limit liability for fraud, for death or personal injury, or for anything that cannot lawfully be limited.
6. Your indemnity. You indemnify us against claims by third parties, and our reasonable costs, that arise from your connecting a site you had no authority to connect, from content you supply, or from your breach of section 12, to the extent that you caused the loss.

19. Changes to these terms

We may change these terms. We will e-mail Owners and post the change in the product at least 30 days before a material change takes effect. If you do not agree, stop using the Service and ask us to delete your data. A change to the draft status of these terms, or a correction that does not reduce your rights, can take effect when posted.

20. General

1. Governing law. These terms are governed by the law of [GOVERNING LAW STATE], Australia, and each party submits to the courts of that State and the Commonwealth courts sitting in it.
2. Entire agreement. These terms, the Privacy Policy and (where it applies) the DPA are the whole agreement about the Service. If they conflict, the DPA prevails on personal information, then these terms.
3. Notices. We may give notice by e-mail to the address on the account or by posting in the product. You may give notice to support@lumioh.com.
4. Assignment. You may not assign these terms without our written consent. We may assign them to a buyer of the business.
5. Severability and waiver. If a term is unenforceable, the rest continues. A right is not waived by not using it.
6. Force majeure. Neither party is liable for delay caused by events beyond its reasonable control, including outages of an internet, cloud or payment provider.
7. Disputes. Before starting proceedings, each party will first try in good faith to settle a dispute by writing to the other.
8. Contact. support@lumioh.com. Postal address: [REGISTERED ADDRESS].

Facts to verify with counsel

1. Whether the Privacy Act, the Australian Consumer Law and, if relevant, GDPR or UK GDPR apply, and how the liability, warranty and indemnity clauses (section 18) should be drafted for agencies, including the small business unfair contract terms rules.
2. Section 8: whether keeping a locked workspace for up to 12 months, then deleting it after 30 days' notice, is acceptable, and what happens to a request for a copy of data after the export window (README question 7).
3. Section 6.4: the Foundation offer rules (eligibility, the first-100 count, closing the offer, transfer on ownership change, effect of cancellation), written here as recommended defaults.
4. Sections 6.7 and 6.9: the refund and failed-payment rules, and whether the 30 days' notice in sections 6.8, 7.2 and 19 is the right period.
5. Sections 5.3 and 9.5: the trial marker (a salted hash of the verified e-mail kept 24 months) and the statement that deletion is not complete (README questions 6, 9).
6. Section 12 (crawling): whether "only sites you control" with plugin pairing is a sufficient control, whether honouring robots.txt should be a contractual term, and our exposure for a site paired by someone without authority (README question 12).
7. Section 11: warranty, responsibility and consent wording for the optional write feature (README question 13), and whether it should be in the beta terms at all while it is unavailable.
8. Section 13: whether the good-faith security report wording is acceptable, and whether publishing targets (not promises) creates a duty.
9. Section 17: the suspension reasons and the 7-day cure period.
10. Whether 18+ is the right age gate, and whether "sole trader" individuals are treated as consumers.
11. Whether the DPA is incorporated into the terms as drafted in sections 9.2 and 20.2.
12. Whether the company gives any commitment about backups (section 2.3) that counsel would word differently.

Facts this draft assumes that the code may not yet implement

• No checkout or billing portal exists. Stripe is wired to local and test mode only; the hosted Stripe wiring is scheduled (Q88). A migration that loads the paid plan catalog is in progress. The plan, renewal, cancellation, refund and payment-failure terms describe the intended design. Today only a Stripe active status produces paid entitlements, and the exact payment-failure transition that ends entitlement is open (doc 15 section 5).
• "Explicit paid checkout before the trial ends" (Q18) is a decision, not a feature, and a trial does not renew into a paid subscription (doc 15 section 6).
• Foundation first-100 tracking is decided but no counter or migration for it exists in the repository (B7). The 50% and 12-month rules in section 6.4 are the owner-approved numbers; the eligibility, one-per-person, transfer and closing rules are recommended defaults.
• The plan limits (section 6.1) are the owner's proposal to validate with npm run ops:crawl-usage. The quota period (UTC month or billing period) is undecided, and the paid price-to-profile catalog is not yet loaded.
• Entitlement-end enforcement (Q16) passed in a local, isolated stack for expired trial and cancelled subscription (the 29-day read/export and 31-day privacy-only flows). Hosted behaviour, other data sources, payment-failure triggers and customer notices are not verified or built.
• Lifecycle e-mails (trial ending, cancellation, payment failure, the notice before a locked workspace is deleted) are not built.
• Locked-workspace deletion. No job deletes a workspace 12 months after the export window ends; it would be done by hand.
• Support. The support address, the targets in section 13 and the 7-day on-call (best effort, owner only, no backup person) are the owner's adopted defaults. No public status page or paging exists. Backups and point-in-time recovery are deferred by the owner until 10 paying users (C1), so the recovery targets in section 13.4 do not apply yet.
• The crawler's fixed outgoing address and robots handling are designed and tested locally; hosted behaviour and varied robots failure modes are not accepted (doc 12). Verified-site scope depends on plugin pairing and the "verified site host set".
• The write feature is disabled for new pairings (doc 06 section 4); Cloud command delivery is off. The Pro add-on that would carry it is planned (doc 36).
• Hosted environment. The service is deployed to the hosted environment from the owner's approvals of 14 October 2026; the first production deploy and acceptance are not done.
• Public API and webhooks (ADR-089) are proposed only and not covered by these terms; separate terms would be needed.
• Workspace erasure and account erasure are built and tested locally but not enabled on a hosted environment (E7). Section 9.5 assumes they will be available at open beta.