Terms of service

1. Who you are dealing with

stillworks.watch is operated by Tomáš Pilař, a sole trader (self-employed natural person) registered in the Czech Republic, identification number (IČO) 88527069, with registered business address at Škroupova 564, 537 01 Chrudim – Chrudim III, Czech Republic (the Operator). The Operator is a natural person conducting business under a Czech trade licence, not a company entered in the Commercial Register.

Operator

Tomáš Pilař, a sole trader (self-employed natural person) registered in the Czech Republic

Identification number (IČO)

88527069

Registered business address

Škroupova 564, 537 01 Chrudim – Chrudim III, Czech Republic

Register

Czech Trade Licensing Register (živnostenský rejstřík); competent trade licensing authority: Městský úřad Chrudim

VAT status

Not currently registered for VAT or as an identified person

Legal and contractual matters

legal@stillworks.watch

Support

support@stillworks.watch

Privacy requests

privacy@stillworks.watch

Anything else

hello@stillworks.watch

2. Definitions

Service

stillworks.watch: the website, the application, the checks and probes it runs, the alerts it sends, and every related feature the Operator provides under these Terms.

You, Customer

The business or professional that holds the account, and the person acting on its behalf. If you create an account for a company or another legal person, you confirm that you are authorised to bind it.

Watched Application

A website or application you add to the Service as a project, together with the checks, probes and settings you configure for it.

Customer Data

Everything you submit to the Service and everything the Service collects from a Watched Application on your instruction: project definitions, checks, recordings, screenshots, network traces, page content, credentials, visitor-error events and inbound email data.

DPA

The data processing agreement, which forms part of this agreement and governs personal data the Operator processes on your behalf.

Terms

This document, in the version effective on the date shown at the top.

3. Business use only

stillworks.watch is provided for business and professional use only. By creating an account or purchasing a subscription you confirm that you are acting in connection with your trade, business, craft or profession and not as a consumer. The Operator does not offer the Service to consumers, and consumer-protection rules that apply only to consumer contracts do not apply to this agreement.

You do not need a Czech identification number or a particular legal form to be a business customer. A sole trader, a partnership, a company or a public body anywhere in the world may use the Service, provided it is used for that organisation's own professional purposes.

4. The agreement and how it is accepted

This agreement consists of these Terms, the DPA and any paid plan you order through the Service. The privacy notice describes how the Operator handles your own personal data and is not a contract term. If these documents conflict, the DPA prevails for personal data processed on your behalf and these Terms prevail for everything else.

You accept these Terms and the DPA by ticking the acceptance box the first time you sign in. The Service records the moment of acceptance and the version of the DPA you accepted, and asks again, by name and by version, whenever a new revision of the DPA takes effect. You cannot create a project, add a recipient or start a check before accepting.

5. What the Service does, and what it does not promise

The Service opens the addresses you give it in a real browser, on the schedule you choose and after each deploy it detects, performs the steps of each check, and verifies the conditions you configured. It also runs probes, such as certificate and domain expiry checks, that measure exactly what they say they measure. When a check breaks twice in a row, the Service alerts the recipients you have verified, with a screenshot and, where available, a recording of the failure. It reads your application from the outside, the way a visitor would, with no access to your servers, your database or your source code.

A check verifies the flow and the conditions you configured, and a probe verifies only what it measures. The Service cannot and does not guarantee that it will detect every possible defect in your application, every browser-specific issue, or every failure that depends on data, timing or a particular user's state. It is not a backup service, a security audit, a vulnerability assessment or a complete business-continuity arrangement, and you should not rely on it as your only safeguard against any of those risks.

One promise is made without qualification: a passing result means the Service actually verified what it reports. A run the Service could not complete because of a fault on its own side is reported as such, is never shown as passing, and never counts as a failure of your application.

Where the Service shows you how fast your application answered, those figures are what the Operator's own browser saw on the Operator's own machine while it ran your check. They are an observation, not a promise: they are not a service level, they commit nobody to any particular speed in future, and they are not what your visitors experienced. Someone on a different device, a different network or a different continent can see something quite different.

The Operator works to keep the Service available and dependable, but the subscription does not include a contractual uptime percentage, a service-level agreement or service credits. Planned maintenance, a deploy of the Service or an incident on the Operator's side may delay or skip a run; where that happens the Service says so rather than presenting a green result.

6. Your account

One account belongs to one Customer. You are responsible for everything done under your account, including anything done by a person who obtained your sign-in link or your session. Keep sign-in links and connected sign-in providers under your control and tell the Operator promptly if you believe your account has been accessed without authorisation.

Alerts are only ever sent to recipients who have confirmed that they want them. You may only nominate recipients who are entitled to receive information about your Watched Application, and you are responsible for what those recipients see, including screenshots of your application.

7. Authorisation and acceptable use

You may add a Watched Application only if you own it or are expressly authorised by its owner to have it checked in this way. Adding somebody else's site so that the Service sends traffic at it is a material breach of this agreement.

In particular, you must not use the Service for:

• adding or checking a site or application that you do not own and are not authorised to check in this way;
• using the Service to generate load or stress against any site, or to run more checks against a host than the Service itself schedules;
• attacking, exploiting, scanning for vulnerabilities in, or bypassing the access controls of any system, including a system you own;
• supplying credentials, session material or email addresses that you are not entitled to use, or that belong to a person who has not agreed to their use;
• attempting to access, probe or interfere with the private or internal infrastructure of stillworks.watch, including its runners, storage, queues and internal endpoints;
• evading or attempting to evade rate limits, project or check limits, the refusal of protected categories of sites, a domain owner's opt-out, or any other safety control;
• using the Service in a way that is unlawful, that infringes the rights of a third party, or that causes the Operator to breach an obligation owed to a third party.

The Service enforces technical limits of its own regardless of who asks: it runs at most one check against a given host at a time, refuses addresses that resolve to private or internal ranges, refuses banks, public administration, healthcare and other protected categories of sites, respects robots.txt when it follows links, and applies per-account and per-domain limits. These controls are part of the Service and you may not attempt to work around them.

The domain owner has the final say. If the owner of a domain asks the Operator not to check it, that request overrides your instructions, even if you added the site and even if you believe you are authorised. The Operator will stop checking that domain and will not reinstate it at your request alone. Reporting abuse explains how an owner makes that request and what happens then.

8. Credentials and email steps

Some checks sign in to your application or wait for an email your application sends. Where you configure credentials or an email step, you confirm that you are entitled to use them for this purpose and you remain responsible for their lawful use. The Operator recommends a dedicated account in your application for the Service, with the narrowest permissions that let the check run.

Stored credentials are encrypted at rest and are opened only inside the isolated runtime that needs them for one run. A run that carries a credential or an email step does not record video or a network trace, blanks sign-in fields out of step screenshots, and is never offered to the visual fallback described in section 12. The security page describes these measures in more detail; the DPA makes them binding.

9. Special categories of personal data

The Service is not designed for the intentional or targeted processing of special categories of personal data within the meaning of Article 9 GDPR, such as health, biometric or genetic data, or data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, sex life or sexual orientation. You must not deliberately configure a check so that the Service collects such data unless you have an appropriate lawful basis and the processing is necessary for the check.

Incidental capture can nevertheless occur, for example where a screen of your application displays such information at the moment a screenshot or recording is taken. The Operator does not claim that incidental capture is technically impossible. You remain responsible for the lawful operation of your application and for what it displays; the Operator's obligations for what it captures on your instruction are set out in the DPA.

10. Fees, billing and taxes

Every account starts with a seven-day trial of the Service with no card required. You may choose and pay for a plan during the trial or after it ends. At the date of these Terms the paid plans are Small at $12 a month, Growing at $24 a month and Portfolio at $59 a month. Each can be paid for a year instead, at $120, $240 and $590 respectively: a year costs the price of ten months. The pricing page states what each plan includes and is the authoritative description of the plans offered on the day you order.

Prices are denominated in United States dollars. Fees are billed in advance for each billing period through Stripe, the Operator's payment processor, and the subscription renews for successive periods of the same length until it is cancelled. There is no permanent free plan and there are no usage-based charges beyond the plan price.

Where applicable law requires the Operator to charge, collect or account for value added tax or a similar tax on the fees, that tax is added to or collected with the fees as required, and you agree to provide the business identifiers the Operator or its payment processor reasonably needs for that purpose. The Operator's current statement of how the listed prices relate to VAT is: Prices exclude VAT and similar taxes.

The Operator may change the plan prices. A price change takes effect for an existing subscription only from the next billing period that starts at least 30 days after the Operator notified you of it by email. If you do not accept the new price you may cancel before it takes effect.

11. Cancellation, refunds and failed payments

You may cancel your subscription at any time from your settings or through the billing portal. Cancellation takes effect at the end of the billing period you have already paid for: the Service keeps checking until that date and does not charge you again. Cancelling does not delete your account or your data by itself; deletion is described in section 14. Deleting your account ends the subscription immediately rather than at the end of the period, and the rule on refunds below applies to the period already started.

Fees for a billing period that has already started are, as a rule, not refunded. The Operator refunds a duplicate or erroneous charge, and may handle an exceptional case individually on request to the legal contact above. Nothing in this section removes a right that applicable law grants you and that cannot be waived. The Operator's current summary of this policy is: Fees for a billing period that has already started are not refunded. A duplicate or erroneous charge is refunded, and an exceptional case is looked at individually. Cancelling takes effect at the end of the period you have already paid for, and checks keep running until then.

If a renewal payment fails, Stripe retries it and notifies you. Your paid entitlement continues while Stripe reports the subscription as past due and its retries are ongoing. If Stripe finally reports the subscription as unpaid or cancelled, the account moves into the same frozen state as an expired trial: checks stop, your projects and history stay readable, and the data is deleted 30 days later unless you subscribe again before then. Changing to a smaller plan does not delete your data.

12. Use of AI models

The Service uses an AI model in exactly two places and nowhere else: to propose checks when you add a project, based on the server-rendered content of your home page and the links on it; and, as a last resort, to locate an element that every deterministic method has failed to find, based on a screenshot and the accessibility structure of the page. You may opt out of the second use for your account at any time by writing to the support address in section 1, in which case the step fails instead; a run that carries a credential or an email step is never offered to it in any event. The model never decides whether your application is broken, never creates a finding, and never analyses visitor-error data.

Requests are routed through OpenRouter, Inc., a United States company, to the inference provider pinned in the Operator's configuration, with retention and training denied at request level. The current chain, the maker of the model and the party running it, is shown on subprocessors. The Operator does not use Customer Data to train any model and grants no such right to anybody.

13. Customer Data and intellectual property

As between you and the Operator, you own and retain all rights in your Watched Application and its content, in the project definitions and checks created for your projects, in the content the Service captures from your application, and in every other item of Customer Data. You grant the Operator a non-exclusive, worldwide, royalty-free licence to host, copy, process, transmit and display Customer Data solely to the extent necessary to provide the Service to you and to perform the processing described in the DPA. The licence ends when the Customer Data is deleted.

The Operator owns and retains all rights in the Service, including its code, design, platform, algorithms, locator and healing technology, documentation and brand. You receive a non-exclusive, non-transferable right to use the Service during the term of this agreement in accordance with it, and nothing else. You must not copy, modify, reverse engineer or resell the Service, or remove or obscure any notice of the Operator's rights. The Operator may use suggestions you send about the Service without any obligation to you.

14. Term, suspension and termination

This agreement runs from the moment you accept it until your account is deleted. You may end it at any time by deleting your account from the product, which also ends your subscription; the privacy notice states how, and what is deleted when.

The Operator may suspend a project or an account immediately, without prior notice, where that is reasonably necessary because of abuse of the Service, a credible indication that you are not authorised to check a Watched Application, a security risk to the Service or to a third party, a legal requirement, an actual or alleged infringement of a third party's rights, or a valid opt-out by a domain owner. Where reasonably possible the Operator will tell you the reason and give you the opportunity to remedy it; advance notice is not promised where urgent security or legal action is required.

The Operator may terminate this agreement on notice if you materially breach it and do not remedy the breach within two weeks of being told, or immediately if the breach cannot be remedied. The Operator may also stop offering the Service altogether, in which case you will receive at least 30 days' notice by email and a pro-rated refund of any prepaid fees for the period after the Service stops. On termination for any reason, sections 3, 9, 13, 15, 16, 17 and 19 continue to apply, and Customer Data is deleted according to the DPA and the privacy notice.

15. Warranties and disclaimers

The Operator warrants that the Service will be provided with reasonable skill and care and substantially as described on this site. Except for that warranty and anything that cannot be excluded under applicable law, the Service is provided as it is and as available, and the Operator gives no other warranty, express or implied, including as to fitness for a particular purpose, uninterrupted or error-free operation, or the detection of any particular defect in your application.

The Operator does not hold and does not claim any certification, such as SOC 2, ISO 27001 or HIPAA compliance, and does not represent that the Service satisfies any regulatory scheme that applies to you. The security page describes the measures the Service actually takes; that description is what you may rely on.

16. Limitation of liability

The aggregate liability of the Operator to you under or in connection with this agreement, whether in contract, in tort or on any other basis, is limited to the higher of (a) USD 100 and (b) the fees you actually paid to the Operator for the Service during the twelve months immediately preceding the event giving rise to the claim.

To the maximum extent permitted by applicable law, the Operator is not liable for lost profits, lost revenue, loss of business opportunity, loss of goodwill, loss of or damage to data that you could reasonably have kept elsewhere, indirect or consequential loss of any kind, or any loss arising from your reliance on the Service as your only backup, security or business-continuity measure, including a loss caused by a defect in your application that the Service did not detect or detected late.

Nothing in this agreement limits or excludes liability where applicable law does not permit it to be limited or excluded, including liability for damage caused intentionally or through gross negligence, for death or personal injury, or for a breach of a mandatory provision of law. The limitations in this section apply to the same extent to the Operator's liability under the DPA.

17. Indemnity

You will compensate the Operator for damage, reasonable costs and reasonable legal fees that the Operator suffers because of a third-party claim or a regulatory action arising from your knowing lack of authorisation to have a Watched Application checked, your unlawful use of the Service, your infringement of a third party's rights through the Service, or your provision or use of data or credentials that you were not entitled to use. The Operator will notify you of such a claim promptly, will not settle it without your consent, which you will not unreasonably withhold, and will let you take over its defence at your cost where that is practical.

18. Confidentiality and force majeure

Each party will keep confidential the non-public information it receives from the other in connection with this agreement, use it only for the purposes of this agreement, and disclose it only to persons who need it and are bound to keep it confidential, or where the law requires disclosure. For personal data processed on your behalf, the DPA applies in addition.

Neither party is liable for a failure to perform an obligation, other than an obligation to pay, that is caused by circumstances beyond its reasonable control, such as a failure of the public internet or of a hosting, email or payment provider, a natural disaster, war, or an act of a public authority, provided it tells the other party without undue delay and resumes performance as soon as it reasonably can. A fault in the Operator's own runners or software is not such a circumstance; it is reported as an error of the Service and treated as section 5 describes.

19. Changes to these Terms

The Operator may change these Terms. A material change is notified to you by email at least 30 days before it takes effect, and the date at the top of this page always states which version you are reading. If you do not accept a material change you may cancel before it takes effect; continuing to use the Service after that date means you accept the changed Terms. A change required by law or by an urgent security need may take effect earlier, in which case the notice says so and explains why.

A correction that does not change the substance of these Terms, such as a typographical fix or a clarification of wording, may be made without notice. A new revision of the DPA is always asked for again, by name and by version, the next time you sign in.

20. Governing law, courts and general provisions

Governing law

the laws of the Czech Republic

Competent courts

the courts of the Czech Republic, with local jurisdiction determined under applicable procedural law

This agreement is governed by the law stated above, excluding its conflict-of-laws rules and the United Nations Convention on Contracts for the International Sale of Goods. Disputes are heard by the courts stated above. A mandatory rule of the law of the country where you are established that grants you protection which cannot be contracted out of is not affected.

This agreement is the entire agreement between you and the Operator about the Service and replaces any earlier understanding. If a provision is held invalid, the rest remains in force and the invalid provision is replaced by a valid one that comes closest to its purpose. A failure to enforce a provision is not a waiver of it. You may not assign this agreement without the Operator's written consent; the Operator may assign it to a successor of the business that assumes the Operator's obligations, on notice to you. Notices to the Operator go to the legal contact in section 1; notices to you go to the email address on your account. This agreement is concluded in English.