Terms of Service

Effective: [effectiveDate]

1. Who we are

The service is provided by Kristian Mandrup, a sole proprietorship (enkeltmandsvirksomhed), CVR [cvr], Dr. Priemesvej 5, 3tv, 1854 Frederiksberg C, Denmark, email admin@blueforge.studio ("we", "us"). The proprietor is personally the contracting party. "You" is the person or organisation that signs up.

2. The service and who it is for

2.1 We provide a platform for hosting and running web applications, with storage for the environment variables and secrets they need, deployments, and sign-in for your applications' users (the "Service"), in plans called Free and Pro and any others we publish (the "Plans").

2.2 The Service is for businesses and professional use only. By signing up you confirm that you act in the course of a trade, business or profession, or on behalf of one. It is not offered to consumers (forbrugere). If you are a consumer, please do not sign up.

2.3 You must be at least 18 and able to enter a binding contract. If you sign up for an organisation, you confirm that you may bind it.

3. Your account

3.1 Give accurate details and keep them current. You are responsible for everything done through your account and for keeping your credentials, API keys and tokens safe. Tell us promptly at admin@blueforge.studio if you suspect misuse.

3.2 We may require two-factor authentication or other safeguards, and may rotate or revoke tokens we believe are compromised.

4. Plans, fees and payment

4.1 Free. Free is provided without charge, within the limits shown on our pricing page, which we may change. We may modify, limit or end Free at any time, giving at least 14 days' notice where reasonably possible.

4.2 Pro. Pro costs DKK 369 / €49 per month excluding VAT (moms), billed in advance through our payment provider Stripe. Pro renews automatically for the same period until cancelled. You can cancel at any time in your account; cancellation takes effect at the end of the paid period. Fees paid are not refundable except where mandatory law requires or we state otherwise in writing.

4.3 Prices are shown in Danish kroner (DKK) and euro (EUR) for convenience; the amount charged is the amount stated on your invoice and checkout. Prices exclude VAT, which we add where required. We may change prices on 30 days' written notice; a change applies from the next renewal and you may cancel before it takes effect.

4.4 If a payment fails we may suspend Pro features after notice and move the account to Free limits.

5. Acceptable use

You must not, and must not let anyone, use the Service to:

• break the law or infringe anyone's rights, including intellectual property and privacy;
• host or distribute malware, phishing or spam, or content that is unlawful, sexually exploits children, or incites violence;
• attack, probe or disrupt the Service or others (including denial of service and port scanning), or evade limits and security measures;
• mine cryptocurrency or run workloads unrelated to the applications you host, or resell the Service without our written agreement;
• use more than a fair share of shared resources, or in a way that degrades the Service for others;
• store or process data you have no right to process, or special-category data (for example health data) or payment-card data, unless we have agreed in writing that the Service is suitable for it.

We may investigate suspected breaches and act under section 6.

6. Your content, our hosting role, and removal

6.1 Your content is yours. You keep all rights in your applications, code, data and the content of your applications ("Content"). You give us a limited licence to host, copy, process and transmit Content only as needed to run the Service for you.

6.2 You are responsible for your Content and your applications, including their lawfulness, accuracy, security and backups, and for the legal basis and notices for the personal data they process.

6.3 Notices. To report content you believe is illegal, write to admin@blueforge.studio with a clear explanation of why, the exact location (URL), your name and email address (unless the report concerns child sexual abuse material), and a statement that you believe the report is accurate and complete. This address is also our single point of contact for authorities and for recipients of the Service under the EU Digital Services Act.

6.4 Removal and suspension. We may remove content, disable an application or suspend an account if we reasonably believe it breaches these terms or the law or is a security risk, or if an authority requires it. Where we remove content or restrict an account we will tell you why and how to object, unless the law or a security emergency prevents it.

7. Secrets and credentials you store with us

7.1 You decide what secrets (API keys, passwords, tokens, certificates) you put in the Service. Store only what your applications need.

7.2 We apply the measures described in section 9. No system is perfectly secure. You remain responsible for rotating credentials, limiting their scope, and for the third-party systems those credentials open. If we tell you of a suspected exposure, treat the affected secrets as compromised and rotate them.

8. Personal data

8.1 Our own data about you (account, billing, usage) is handled as set out in our Privacy Policy.

8.2 Personal data in your applications (for example your own users' logins and profiles) is processed by us as your processor under the data processing terms in Annex 1, which form part of these terms. You are the controller. You confirm that you have a lawful basis and have given the notices the GDPR requires.

9. Security

9.1 Environment variables and secrets you store with us are stored encrypted at rest. Access to your workspace requires your credentials, and requests are checked against the account they belong to.

9.2 We run nightly backups as described in section 10.2. We do not promise that the Service is free of vulnerabilities or that unauthorised access will never occur. We will notify you without undue delay if we become aware of a personal data breach affecting your Content (Annex 1).

10. Availability, support and no service levels (Free and Pro)

10.1 The Service is provided "as is" and "as available". On Free and Pro we give no uptime commitment, no service level, no response time and no guarantee that the Service will be uninterrupted, error-free, secure or fit for your particular purpose. Downtime, maintenance, incidents and changes will happen, and we may not give notice of them. Do not run anything on Free or Pro whose failure would cause you serious loss unless you have your own redundancy.

10.2 Backups and data loss. For our own disaster recovery we take nightly backups of the platform's control-plane database (which holds account and configuration data and your encrypted secrets) and of our source repositories, and keep recent copies (currently about two weeks) on a second server. These backups exist so that we can rebuild the platform. They are not a service to you: we do not promise to restore your individual data, to restore it within any time, or that any backup will be available. You are responsible for keeping your own copies of your code, data and secrets.

10.3 Support is by email on a reasonable-efforts basis, with no response time. A separate written agreement with a service level may be offered for other plans; nothing in these terms creates one.

10.4 We may change, add or remove features and update the Service at any time. We will try to give notice of changes that materially reduce what a paying Pro customer has paid for.

11. Limitation of liability

11.1 What this section covers. This section limits our liability to you under or in connection with these terms and the Service, whatever the legal basis (contract, tort or otherwise), to the extent Danish law allows.

11.2 No liability for indirect loss. We are not liable for indirect loss or consequential loss (indirekte tab og følgetab), including loss of profit, revenue, goodwill, business opportunity or savings, loss of or damage to data, or the cost of re-creating data or of substitute services.

11.3 Cap. Our total liability to you for all claims in connection with the Service is limited to: (a) on Pro, the fees you paid us for the Service in the 12 months before the event giving rise to the claim, but not less than DKK 1,000; and (b) on Free, DKK 500.

11.4 What is not limited. Nothing in these terms limits or excludes liability that cannot be limited or excluded under mandatory law, including liability for intent or gross negligence (forsæt eller grov uagtsomhed), for death or personal injury, and any liability under mandatory product-liability or consumer law.

11.5 Your risk. You acknowledge that the Service is offered at the price of Free or Pro, that we give no uptime or backup commitment (section 10), and that you are better placed than we are to judge the value of your own data and the cost of an interruption to you, and to insure against it.

11.6 Time limit. To the extent the law allows, claims must be notified to us in writing within 3 months of when you became aware, or ought to have become aware, of the cause, failing which they lapse. This does not apply to liability under section 11.4.

11.7 Third-party claims. If a third party brings a claim arising from your Content, your applications or your use of the Service, you will defend and indemnify us against it (including reasonable legal costs) to the extent it results from your breach of these terms or of the law.

12. Suspension and termination

12.1 You may stop using the Service and close your account at any time. For cancelling Pro, see section 4.2.

12.2 We may terminate or suspend your account immediately for material breach, security risk, non-payment or legal requirement. Otherwise we may terminate on 30 days' notice for Pro and 14 days' notice for Free. A Free account that has been inactive for 90 days may be deleted.

12.3 After termination. For 30 days you may export your Content. After that we may delete it and are not required to keep it. Sections that by nature survive (liability, indemnity, governing law, fees due) continue to apply.

13. Intellectual property and feedback

We and our licensors own the Service, its software and its branding. You get a non-exclusive, non-transferable right to use the Service during your subscription. Feedback you give us may be used by us freely without obligation to you. These terms give no rights in each other's trademarks.

14. Confidentiality

Each of us will keep the other's non-public information confidential and use it only for the Service, except where disclosure is required by law or an authority, is made to professional advisers under a duty of confidentiality, or is made to our sub-processors as needed to deliver the Service. This does not apply to information that is public, already known to the recipient, or independently developed.

15. Third-party services

The Service depends on third parties, listed in Annex 1 (hosting, payments, email, backup storage). Their failures or terms can affect the Service. We are not responsible for third-party services you choose to connect, and your use of them is governed by their terms.

16. Changes to these terms

We may update these terms. For material changes we will give at least 30 days' notice by email or in your account. If you do not agree, you may terminate before the change takes effect (for Pro, with a refund of any prepaid fee for the remaining period); continued use after the effective date means you accept the change.

17. General

17.1 Assignment to a successor. We may assign or transfer these terms, and our rights and obligations under them, to a company that takes over the business (for example a company (ApS) we form, or a buyer), on notice to you. You may not assign them without our written consent.

17.2 Force majeure. Neither of us is liable for failure or delay caused by events beyond reasonable control, including power or network failure, failure of upstream providers, cyberattack, or acts of authorities.

17.3 Entire agreement; severability. These terms (with the Annex and the Privacy Policy) are the whole agreement. If a provision is unenforceable, the rest stays in force and the provision is replaced by the nearest enforceable one.

17.4 Notices. We may notify you by email or in your account. You can reach us at the address in section 1.

17.5 Language. These terms are provided in Danish and English. If they differ, the Danish version prevails.

17.6 Governing law and venue. Danish law governs these terms, excluding its conflict-of-law rules and the UN Convention on contracts for the international sale of goods. Disputes are brought before Københavns Byret as the court of first instance. Nothing here limits mandatory rights of anyone who is, despite section 2.2, a consumer.

Annex 1: Data processing terms

These terms apply to personal data that we process on your behalf in the course of the Service (for example your own users' logins and profiles) and are intended to meet Article 28 of the GDPR.

1. Roles. You are the controller. We are your processor.
2. Subject matter and duration. Hosting and running your applications, storing your environment variables and secrets, and providing sign-in for your users, for the duration of your subscription and the export period in section 12.3.
3. Data and data subjects. Personal data that your applications and their users submit or that is generated by their use: for example names, email addresses, hashed credentials, session data and content. Special-category data is excluded unless agreed in writing.
4. Instructions. We process the data only on your documented instructions, which are these terms and your use of the Service, unless law requires otherwise, and we tell you if an instruction appears to infringe data-protection law.
5. Confidentiality. People authorised to process the data are bound by confidentiality.
6. Security. We apply the measures in section 9, appropriate to the risk (GDPR Article 32).
7. Sub-processors. You give general authorisation for the following sub-processors: Hetzner Online GmbH (hosting and storage; servers in [dataLocation]), Stripe (payments; for billing data only, not the data in your applications), and Resend (transactional email), and Cloudflare (backup copies of files held in our object storage). We give you 30 days' notice of any change so that you can object. We impose the same data-protection obligations on each sub-processor.
8. Transfers. We transfer personal data outside the EU/EEA only under a valid transfer mechanism (an adequacy decision or the EU standard contractual clauses).
9. Assistance. We help you respond to requests from data subjects and with your obligations under GDPR Articles 32 to 36, taking into account the nature of the processing.
10. Personal data breach. We notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information then available.
11. Deletion or return. On termination you can export your data for the period in section 12.3; afterwards we delete it, except where law requires us to keep it.
12. Audit. We provide the information needed to show that we comply with Article 28 and allow reasonable audits on notice, at your cost.
13. Liability. Section 11 applies between us. It does not affect the rights of data subjects.