Terms and Conditions.

1. Who we are

BowerVault ("BowerVault," "we," "us," "our") is a trading name of Tinybox Creative Ltd, a company registered in England and Wales (Company No. 15747529, VAT No. GB470161908), registered office at Henleaze House Business Centre, 13 Harbury Road, Henleaze, Bristol, UK, BS9 4PN.

These Terms and Conditions ("Terms") govern your access to and use of the BowerVault platform at app.bowervault.co.uk and all tools available through it (each a "Tool," collectively the "Service"). By creating an account, you agree to be bound by these Terms.

2. The Service

2.1. BowerVault is a subscription web application for UK professional services firms. You choose one Tool from our library, brand it, and add a short code snippet to your own website. The Tool then appears on your page inside an iframe served from app.bowervault.co.uk.

2.2. A visitor to your website who completes the Tool gives their name and email address. BowerVault scores their answers, writes a short personalised report, emails it to them as a PDF under your business's name, and records them as a lead in your dashboard.

2.3. You hold one live Tool at a time. Choosing a different Tool from the library is a swap, not an addition: your branding, approved domains, and existing leads stay with your account, and only the questionnaire and report content change.

2.4. What a Tool asks and what its report contains is decided per Tool. Different Tools may ask different questions and cover different industries.

3. Data roles

3.1. Three parties are relevant to how personal data is handled through the Service:

• Tinybox Creative Ltd is the controller of your own account data (your business details, login, billing), and the processor of the data your leads submit.
• You (the subscriber) are the controller of the lead data your Tool collects. It is your data, collected for your business.
• A lead is a visitor to your website who completes your Tool. They are the data subject. They do not have a BowerVault account and never sign in.

3.2. Full detail on how we process lead data on your behalf is set out in our Privacy Policy and in our Data Processing Agreement, which you agree to when you sign up.

4. Signing up

4.1. Signup has two parts. First, you tell us about yourself and your business (first name, last name, email address, company name, country, company telephone, sales email address, the website domains your tool may load on, the address of your own privacy policy, and your industry, all required, together with a regulatory statement where your industry needs one), choose a Tool and a plan, and pay via Stripe Checkout. You can also opt in, optionally and unticked, to hear when new Tools are released. Then, after payment, you set a password, confirm your email address via a signed link, choose your branding (logo, typefaces, colours, corner style and brand voice), which you can also leave until later, and are shown your embed snippet.

4.2. Your account record, your first approved domain, and your user record are created when you reach the payment step, before payment is taken, so that checkout can be attached to them. Until payment succeeds the account is not active: no Tool serves, and you cannot sign in. If you abandon checkout, that record remains dormant and you can return and complete it with the same email address.

4.3. The website domain you give at signup becomes the first domain approved for your embed. You can add more later (clause 12).

4.4. The telephone number and sales email address you provide are shown in the footer of every report your leads receive, as the call and email contact details for your business.

4.5. Before a lead can receive a report they must tick a consent box, which is not pre-ticked. It names your business rather than BowerVault, and reads: "I am happy for [your business name] to contact me about this report, and to send me occasional marketing emails. You can opt out at any time." Immediately above it, a short paragraph tells them where their details go, how long they are kept, and that their report is general guidance rather than professional advice specific to them (worded appropriately to the Tool, for example "not financial advice" for the Mortgage Readiness Report), and links to your privacy policy. Without the tick, no report is produced and no lead is recorded.

4.6. The date and time a lead gives that consent are recorded against them, together with a reference to the exact version of the wording they were shown, so the consent can be evidenced afterwards. Both appear on the lead in your dashboard and in your CSV export.

4.7. The marketing consent box at signup is optional and is not pre-ticked. Whether you tick it determines which of our own mailing lists you're added to. Everyone who subscribes receives our onboarding messages regardless, since these relate directly to the product you've bought.

5. Accepting these Terms

5.1. Before payment is taken, you must tick three separate boxes: one confirming you have read and understood our Privacy Policy, one confirming you agree to our Data Processing Agreement, and one confirming you agree to these Terms. Each is required, and none is pre-ticked for you.

5.2. The date you accept each of these documents, and the version of each you accepted, are recorded against your account separately.

6. Your account

6.1. One account exists per subscribing business, with a single set of login credentials. The system does not currently support multiple users on one account.

6.2. We apply reasonable security measures to protect your account, including password strength requirements and optional two-factor authentication.

6.3. Password resets are handled by email link. Certain sensitive actions, including billing changes, adding a domain, and closing your account, require you to re-enter your password.

6.4. Changing your account email requires confirmation at the new address before it takes effect, and is reflected in your Stripe billing record.

7. Plans and payment

7.1. Payment is taken by Stripe. We store a reference to your Stripe customer record but never see or store your card details. UK VAT is calculated by Stripe and added to the prices below.

7.2. Invoices are raised by Stripe and available from your billing screen as a downloadable PDF. The billing address shown is the one collected at checkout, and can be edited by you at any time.

7.3. The annual plan can be cancelled for a full refund within 14 days of the upfront charge. After that 14-day cooling-off period, the annual plan is non-refundable. To ask for a refund within those 14 days, email hello@bowervault.co.uk: cancelling from your dashboard does not issue one by itself. You must tick an explicit acknowledgement of this before buying or switching to an annual plan.

7.4. We do not currently offer a free trial on either plan.

8. Changing your plan

8.1. Both plans include the same Tool and the same usage allowance. Only the billing frequency differs. A change takes effect immediately.

8.2. Switching from monthly to annual: you are charged the annual price immediately, less credit for the days already paid for in your current monthly cycle. Before you confirm, you are shown the exact figure Stripe will charge, taken directly from Stripe's own invoice preview. Your renewal date becomes one year from the date of the switch.

8.3. Switching from annual to monthly: whatever is left of your paid year is held as credit on your account and used to pay your monthly bills until it runs out, after which normal monthly billing resumes. No refund is issued to your card for this switch (the 14-day cooling-off period in clause 7.3 is the only circumstance in which a card refund is given).

9. Cancelling

9.1. You can cancel at any time from your account dashboard. This requires re-entering your password, asks you for a reason, and requires you to tick an acknowledgement of when your Tool will stop working.

9.2. Your Tool keeps running until the end of the period you've already paid for: to the end of your current billing month if you're on the monthly plan, or to the end of your current year if you're on the annual plan.

9.3. No refund is issued on cancellation of either plan (outside the 14-day annual cooling-off period described in clause 7.3).

9.4. Your leads remain readable and exportable as a CSV file for 90 days after your subscription lapses. After that, they are permanently deleted. This is subject to clause 19.2, which deletes an individual lead two years after they completed your Tool whether or not your subscription is still running.

9.5. You can resume your subscription at any point before your paid period ends, and this restores it unchanged. Once the period has ended, coming back means choosing a plan again, though your branding, domains, and settings will still be there.

10. If a payment fails

10.1. Payment retries are handled entirely by Stripe on its own schedule. We do not attempt separate charges of our own.

10.2. You'll be emailed when a payment first fails, telling you the amount owed and when Stripe will try again. A banner also appears on your dashboard linking to a Stripe-hosted page where you can settle the invoice, including with a different card.

10.3. Your Tool keeps working throughout this process. Access only ends once your paid period has genuinely lapsed (roughly 30 days after your last successful payment for the monthly plan). Once payment succeeds, you'll get a confirmation email and the dashboard banner clears.

11. Add-ons

11.1. Add-ons are one-off purchases, invoiced separately from your subscription at the point of purchase, via Stripe Checkout.

11.2. Add-ons that are delivered by hand require you to be reachable for artwork approval or a setup call. Turnaround times run from that approval or call, not from the date of payment.

12. Your embedded Tool

12.1. Your Tool loads only on domains you've approved. Adding a domain requires your password again, and you're emailed whenever a domain is added or removed.

12.2. If your Tool is loaded on a domain that isn't approved, visitors see a short explanatory page rather than a blank space.

12.3. Your Tool can be in one of four states: not installed (the snippet has never loaded on your site; you'll get reminder emails 3 and 10 days after paying), live (loaded on an approved domain), paused (stopped by you or by us; nothing is deleted, and you can make it live again yourself), or cancelled (keeps serving until your paid period ends, then stops).

12.4. Your Tool will not serve at all until you have given us the address of your own privacy policy, which is shown to every visitor before they answer. You are responsible for that policy covering what the Tool collects. We provide a ready-written section for you to add to it, reachable from your Tool's page.

13. Usage allowance

13.1. Your subscription includes up to 150 completed reports per calendar month. Your dashboard shows how many you have used, and warns you once you pass 80%.

13.2. Going over this allowance does not stop your Tool working, except as described in clause 13.3, and does not result in an automatic extra charge. If your usage stays well above your allowance, we'll get in touch to agree how to handle it.

13.3. We may suspend a Tool or an account where usage reaches a level indicating automated or abusive submissions rather than genuine visitors. Suspension and restoration are both carried out by us, by hand, and we will let you know when either happens. While a Tool is suspended your website visitors see a message that it is temporarily unavailable, and any leads already collected are unaffected. We may also pause a Tool automatically where usage is far beyond any genuine level, and will be in touch when we do.

13.4. A "completed" report is a finished questionnaire that produced a report. Someone who starts but doesn't finish your Tool does not count.

14. Leads and reports

14.1. Each Tool asks a fixed set of questions or inputs, ending with a step collecting the lead's name and email address. The exact format varies by Tool: some, like the Mortgage Readiness Report, use multiple-choice questions from fixed bands with no free-text fields and no exact figures; others may ask for exact figures or other input types where that's what the Tool needs to work. What a specific Tool asks for is described on that Tool's own page.

14.2. A lead who completes your Tool receives their report immediately on screen, and by email as a PDF attachment, sent under your business's name and address, with our own name not appearing in that message. The report also carries call and email buttons and a footer showing your business's contact details.

14.3. The report is also reachable afterwards at a private link requiring no sign-in, which stays live for as long as the underlying data is retained. This is in addition to the emailed PDF, not a replacement for it.

14.4. You receive an email for each lead giving their name, email address, which Tool they completed, and when. It does not carry their answers, their score, or the report itself. All of those, including the report as a PDF, are in your dashboard, and everything except the PDF is exportable as a CSV file.

14.5. You may delete any individual lead from your dashboard at any time. This removes their name, email address, answers, consent record, and report from our live systems immediately and permanently, and cannot be undone. Our database is backed up daily and each backup is kept for 30 days, so a copy taken before the deletion holds the record until that backup expires. Nothing is read from a backup in the meantime, and if a backup is ever restored, deleted leads are deleted again automatically. If that lead has already been passed to your own connected CRM, you will need to delete them there as well.

15. How reports are generated

15.1. A lead's score and category are calculated using fixed rules we've set, not by AI.

15.2. The written commentary in the report is generated by Anthropic's AI models from the lead's answers, written in your chosen brand voice. The lead's name and email address are not sent to Anthropic for this purpose, only their answers and your brand context. Anthropic's commercial terms prohibit it from training its models on data submitted through its API, which is how BowerVault uses it.

15.3. Every report carries a disclaimer that it is general guidance based on the answers given, not professional advice specific to your circumstances. Where a Tool relates to a regulated activity, such as the Mortgage Readiness Report, its report also carries the specific disclaimer that activity requires, for example that it is not financial advice and does not constitute an offer of credit, and any figures shown are described as indicative estimates. What a given Tool's report says is described on that Tool's own page.

15.4. The commentary in every report is generated automatically and is not reviewed by a person before it reaches your lead. You are responsible for the content of the reports your Tool produces, since they're sent in your name, carry your branding, and invite the lead to contact you directly. You're responsible for satisfying yourself that your Tool's output is suitable for your business and for any regulatory obligations that apply to you, before putting it live on your website.

15.5. You can complete your own Tool at any time to see exactly what a lead would receive, including the emailed PDF. Doing so counts as one of your 150 monthly reports.

16. Your leads belong to you

All data collected through your Tool from your website visitors belongs to you, as described in clause 3. Other than delivering the report a lead has asked for, we will never contact, market to, or otherwise use your leads' contact details for any purpose, at any time, whether your subscription is active or has ended.

17. Connecting your CRM

17.1. You may optionally connect your own Brevo account so that completed leads are added there as contacts. You do this by entering your Brevo API key, which we verify before saving.

17.2. Only your lead's first name, last name, email address, and any custom fields you've set up are sent to Brevo. Their score, category, which Tool they used, the completion date, their consent record, and their full answers all stay within BowerVault and are not sent.

17.3. You choose which Brevo list, if any, new leads are added to. Disconnecting your Brevo account deletes the stored key; your chosen list and field settings are kept in case you reconnect, and any contacts already sent to Brevo remain there.

17.4. If the connection stops working, your leads continue to be captured in BowerVault and queued for Brevo. You'll be emailed once to let you know, and the queue is sent once a working key is provided.

17.5. Your own Brevo account is entirely yours. We only ever write to it using the key you provide, and have no other access to it.

18. Nurture email sequence

18.1. Where purchased (see clause 11, currently not available), this add-on generates seven follow-up emails for leads who aren't ready to talk, written by AI in a tone you choose.

18.2. Each email can be regenerated up to three times, and can be hand-edited without limit. The finished sequence is exported as a plain text file for you to use in your own email system.

18.3. We never send or schedule these emails ourselves. Sending them, and obtaining any consent needed to do so, is entirely your responsibility.

19. How long we keep your data

19.1. How long we retain different categories of data, including your account data and your leads' data, is set out in our Privacy Policy. In summary, your leads' data is deleted 90 days after your subscription lapses, as described in clause 9.4. This applies to the data we hold; the lead notification emails you receive yourself (clause 14.4) are yours to keep for as long as you need, independently of our own retention period.

19.2. Separately from clause 19.1, an individual lead's record is deleted automatically two years after they completed your Tool, whether or not your subscription is still running. Where both periods apply, whichever falls first takes effect.

19.3. Your leads' data, meaning their names, email addresses, answers, consent records, and reports, is held in our database, hosted by Laravel Cloud in the United Kingdom, and is not stored outside it. No report document is stored anywhere: each PDF is produced at the moment it is needed. Uploaded brand assets such as your logo are held in Cloudflare R2 storage, provided through Laravel Cloud Object Storage, in the European Union, and no lead data is held there. Transfers between the two are lawful under the UK to EU data adequacy arrangement. Some of our other sub-processors (clause 21) may operate outside the UK and EU, and their own transfer safeguards apply to any data that reaches them.

20. Deleting your account

20.1. You can erase your account entirely from your settings screen at any time. This requires your password again and typing a confirmation phrase, and shows you exactly what will be deleted and how much of it before you confirm. This is immediate on our live systems and cannot be undone. Copies in our backups expire within 30 days, as described in clause 14.5.

20.2. This deletes every lead, report, and nurture email; your usage records; your Tool subscription; your approved domains; your CRM connection and its stored key; your add-on records; your uploaded logos; and the account itself.

20.3. Some things are not deleted: your Stripe customer record and invoice history (your subscription is cancelled immediately, but this billing history is kept by Stripe, since both of us may need it for accounting or tax purposes), a single audit entry recording that the deletion took place and when, and any contacts already delivered to your own connected Brevo account, since those live in your own system, not ours.

20.4. Cancelling your subscription and deleting your account are different things. Cancelling keeps your data for the 90-day window described in clause 9.4. Deleting your account does not wait for that window, it happens immediately.

21. Who else processes your data

21.1. We use a small number of third-party providers to run the Service, including for payments, hosting, application monitoring, generating report content, delivering email, and protecting forms against automated submissions. Full detail on who these providers are and what data reaches each of them is set out in our Privacy Policy.

21.2. Your own connected Brevo account (clause 17), where you choose to use it, is not one of our sub-processors. It's your own system, which we write to using the credentials you provide.

22. Security

22.1. We maintain appropriate technical and organisational measures to protect the Service and the data within it. Further detail on our security practices is available in our Privacy Policy and our Data Processing Agreement with you, or on request.

23. Support and administrative access

23.1. Our support staff can access certain account information to help you, including your account status, plan, and usage, and, when resolving a failed report or CRM sync, the name and email address of the lead concerned, and can take limited actions such as sending you a password reset link or pausing, resuming, suspending, or restoring your account or Tool.

23.2. Our staff cannot sign in as you, and cannot read your leads' answers or reports. Every administrative action taken on your account is logged, along with which staff member took it.

23.3. If your account is suspended, you'll be signed out and shown an explanation with how to get in touch. Your Tool stops serving while suspended.

24. What we don't promise

For clarity, the Service does not: give financial, legal, or other professional advice, or check the accuracy of anything a lead enters; guarantee any number of leads, or that your Tool will produce any at all; send or schedule nurture emails on your behalf (clause 18); review AI-generated report commentary before it reaches a lead (clause 15); write or maintain your own privacy policy for you (clause 12.4); or store your card details or process refunds directly, both of which are handled by Stripe.

25. Acceptable use

You agree not to:

• Use the Service for any unlawful purpose, or in a way that infringes the rights of any third party;
• Attempt to reverse engineer, scrape, or systematically extract the scoring logic or AI prompts behind any Tool;
• Circumvent or attempt to circumvent any rate limit, usage restriction, or security measure within the Service;
• Use the Service to collect data from individuals in a way that's misleading, or that doesn't comply with data protection and marketing law that applies where your website visitors are located;
• Embed a Tool on a domain you haven't approved, or that you don't have the right to publish content on;
• Resell, sublicense, or provide access to the Service to any third party without our written consent.

We may suspend or terminate your account if we reasonably believe you've breached this clause.

26. Intellectual property

26.1. The Service, including every Tool, its underlying software, scoring logic, and report generation systems, along with the BowerVault name and branding, belongs to Tinybox Creative Ltd. Nothing in these Terms transfers ownership of any of this to you.

26.2. You're granted a limited, non-exclusive, non-transferable licence to use the Service for your own business for the duration of your subscription.

26.3. You keep all rights in your own logo, colours, business name, and other branding you upload. You grant us a licence to display these solely to operate your Tool.

27. Liability

27.1. Nothing in these Terms excludes or limits our liability for death or personal injury caused by negligence, fraud, or anything else that cannot lawfully be excluded or limited.

27.2. Subject to clause 27.1, our total liability to you under or in connection with these Terms and the Data Processing Agreement will not exceed the total amount you've paid us in the 12 months before the claim arose.

27.3. We are not liable for indirect or consequential loss, including loss of profits or loss of anticipated leads, arising from your use of the Service.

28. Ending your access

We may suspend or terminate your account, with or without notice, if you breach these Terms, a payment fails and isn't resolved, we reasonably suspect fraudulent or abusive use, or we're required to by law.

29. Changes to these Terms

29.1. We may update these Terms from time to time. Where a change is material, we'll give you reasonable notice before it takes effect.

29.2. If you accepted an earlier version of these Terms, the updated version applies to you once it takes effect, and continuing to use the Service after that point means you accept it. If you don't agree to an update, you can cancel your subscription as described in clause 9.

30. Assignment

You may not transfer or assign your account or these Terms to anyone else without our prior written consent. We may transfer or assign these Terms, including as part of a sale or reorganisation of our business, provided this doesn't reduce the protections you're entitled to under these Terms.

31. Entire agreement

These Terms, together with our Privacy Policy and our Data Processing Agreement with you, form the entire agreement between us regarding the Service, and supersede any prior discussions, understandings, or agreements on the same subject. Nothing in this clause limits liability for fraud or fraudulent misrepresentation.

32. Severability

If any part of these Terms is found unenforceable or invalid by a court, that part will be limited or removed to the minimum extent necessary, and the rest of these Terms will remain in full effect.

33. Waiver

If we don't enforce a right or provision under these Terms on one occasion, that doesn't mean we've given it up, and we may still enforce it at a later date.

34. Notices

Any formal notice you need to give us under these Terms should be sent to support@bowervault.co.uk. Any notice we need to give you will be sent to the email address on your account.

35. Governing law

These Terms are governed by the laws of England and Wales, and any disputes are subject to the exclusive jurisdiction of the courts of England and Wales.

36. Contact

Questions about these Terms can be sent to support@bowervault.co.uk.