Internal draft — not published

This document is a working draft (v0.2, September 2026) and requires legal review before publication. Bracketed items await business decisions.

ProjectSend Cloud — Terms of Service

DRAFT v0.2 — September 2026. Internal working draft. Have this reviewed by qualified US counsel before publication. Bracketed items require business decisions.

Effective date: [DATE]

These Terms of Service ("Terms") govern your access to and use of ProjectSend Cloud (the "Service"), operated by Gallifrey AI Inc., a Delaware corporation ("Company", "we", "us"). By creating an account or using the Service, you agree to these Terms. If you are using the Service on behalf of an organization, you represent that you have authority to bind that organization, and "you" refers to that organization.

The Service is a hosted offering built on the ProjectSend open source software. These Terms apply only to the hosted Service at projectsend.cloud, projectsend.site and app.projectsend.cloud. The open source software available at projectsend.org and GitHub is licensed separately under the GNU GPL v2 and is not covered by these Terms.

1. The Service

ProjectSend Cloud provides two things. On paid plans (Pro, Business and Enterprise), a hosted, branded client portal of your own that allows you (the "Customer") to exchange files with the individuals and organizations you invite ("End Users"). On the Free plan, a personal file-sharing account on a shared ProjectSend site that we run (Section 4). We provision, host, maintain, back up, and update the Service. We do not access, review, or monitor the content of files stored in your account except as described in Section 8 (Acceptable Use), Section 10 (Copyright Policy), or as required by law.

2. Accounts and eligibility

You must be at least 18 years old and provide accurate account information. You are responsible for safeguarding your credentials, for all activity under your account, including activity by tools and assistants you connect to it (Section 9), and for the activity of End Users you invite to your portal. You must notify us promptly at [[email protected]] of any unauthorized use. We may limit the number of Free plan accounts one person or organization holds.

3. Plans, billing, and usage-based charges

3.1 Paid plans. Paid plans are billed in advance, monthly, via our payment processor (Stripe). [Annual billing, if offered, will be stated at checkout.] Fees are non-refundable except as required by law or as expressly stated. Taxes are your responsibility where applicable. If payment fails, we may suspend the Service after [14] days' notice.

3.2 Included allowances and usage. Some plans include allowances (for example a number of active client accounts, an amount of storage and a number of team seats) and charge for use beyond them at the rates published at projectsend.cloud/plans. Our measurements of your use are the authoritative record for billing. Usage charges are billed [in arrears, with your next monthly invoice]. [Spend cap: describe the default cap and what happens when it is reached; see docs/transfer-egress-model.md — the intended behaviour is to slow, never to block, downloads.]

3.3 Price changes. We may change prices and included allowances with at least 30 days' notice; changes apply at your next renewal.

3.4 No trials; promotional arrangements. We do not offer time-limited trials of paid plans; the Free plan (Section 4) is how you try the Service. Early-access and other promotional arrangements are governed by their own written terms, which prevail over this Section where they conflict.

4. The Free plan

4.1 What it is. The Free plan is a personal account on a ProjectSend site that we run and that is shared with other Free plan accounts (today, files.projectsend.site), with the storage allowance published at projectsend.cloud/plans and a private link for every file you upload. It does not include a portal of your own, your branding, client accounts, team seats, API tokens or an account on the customer portal. Your files are private to you and to whoever holds a link you created.

4.2 Files are kept for 30 days. Files uploaded to a Free plan account are kept for 30 days after they are uploaded and are then deleted, together with their links. We send you an email reminder [three] days before files are deleted, where email notifications are on. Download anything you want to keep before then. A paid plan keeps your files for as long as your subscription lasts.

4.3 Keeping the account. Sign in, or use your account through an assistant or tool you connected (Section 9), at least once a month. Accounts nobody signs in to are paused and, after further notice, removed together with their files. [Confirm the schedule for shared-site accounts with the platform team: warning at day 30, pause at day 60, removal at day 90 is the schedule for instances.] Paused accounts can be brought back by signing in until they are removed.

4.4 A shared site. Because the site is shared, the Acceptable Use Policy (Section 8) applies with particular force, and we may limit the resources, requests and number of accounts available to any one person. The Free plan comes with no service level commitment and with community support only.

4.5 Moving to a paid plan. You can move to a paid plan at any time by registering for one. We move the files of your Free plan account to your new portal [on request, as described on the Service; automated migration, if offered, will be described there].

4.6 Changes. We may change the Free plan's limits with at least 30 days' notice, and we may withdraw the Free plan with at least 60 days' notice, during which your files remain exportable.

5. Customer Content

5.1 Ownership. You retain all rights to files, data, and materials you or your End Users upload to your account ("Customer Content"). We claim no ownership.

5.2 License to us. You grant us a limited, non-exclusive license to host, store, transmit, display, and back up Customer Content solely as necessary to operate and provide the Service.

5.3 Your responsibility. You are solely responsible for Customer Content. You represent and warrant that you have all rights necessary to upload and share Customer Content and that its collection, storage, and sharing through the Service complies with applicable law (including intellectual property, privacy, and confidentiality obligations you owe to your own clients).

5.4 Export and deletion. You may export Customer Content at any time during your subscription. Upon termination of a paid plan, we will make Customer Content available for export for [30] days, after which it will be deleted from active systems and, within [90] days, from backups. [Align both numbers with the real backup retention.] Files on the Free plan are deleted 30 days after upload as described in Section 4.2, independently of this Section. Because the underlying software is open source, you may migrate your data to a self-hosted ProjectSend instance at any time.

6. Privacy and data protection

Our Privacy Policy describes how we process personal data, and its AI connectors section describes what happens when you connect an assistant to your account. For Customer Content containing personal data, you are the controller (or a processor for your own clients) and we act as your processor/service provider. A Data Processing Addendum is available upon request for customers subject to GDPR or similar laws. [NOTE: DPA to be prepared and published before actively targeting EU customers; see docs/legal-readiness.md §2.1.]

7. Confidentiality and security

We implement industry-standard technical and organizational measures, including encryption in transit and at rest and access controls. On paid plans, each portal runs with its own database, and its files are stored under credentials scoped to that portal alone. On the Free plan, accounts share one site; each account's files are private to that account and to whoever holds a link the account holder created. No system is perfectly secure; you are responsible for configuring sharing permissions appropriately, for the strength of your users' credentials, and for the credentials you hand to tools and assistants (Section 9). We will notify affected customers without undue delay after becoming aware of a personal data breach affecting their Customer Content.

8. Acceptable Use Policy

You may not use the Service, and may not permit your End Users, tools or assistants to use the Service, to:

  • upload, store, share, or distribute content that infringes any copyright, trademark, trade secret, or other intellectual property right of any person;
  • store or distribute child sexual abuse material (CSAM) of any kind — we report apparent CSAM to the National Center for Missing & Exploited Children (NCMEC) as required by 18 U.S.C. § 2258A;
  • engage in or promote sex trafficking, sexual exploitation, or any activity prohibited by 18 U.S.C. §§ 1591, 2421A;
  • distribute malware, ransomware, viruses, or any code designed to harm systems or exfiltrate data;
  • conduct phishing, fraud, or impersonation, or store data obtained illegally;
  • harass, threaten, or defame any person;
  • violate export control or sanctions laws;
  • resell, sublicense, or provide the Service to third parties as a standalone file-hosting service, or use the Service as a general-purpose public content distribution network, backup target or archive (private and public link features are intended for sharing your own business files with your clients);
  • create accounts in bulk or by automated means, or hold more Free plan accounts than we allow;
  • exceed the fair use of transfer, storage and computing resources that your plan includes, or the request limits we publish or signal for the API and the AI connector, or use them in a way that degrades the Service for others [transfer fair use: describe the included allowance and that we slow, never block, downloads beyond it — see docs/transfer-egress-model.md];
  • probe, scan, or test the vulnerability of the Service, or circumvent authentication or usage limits (good-faith security research reported to [[email protected]] is welcome).

We do not monitor Customer Content, but we may investigate credible reports of violations. We may remove content and suspend or terminate accounts that violate this Section, with notice where practicable. Anyone may report abuse to [[email protected]].

9. AI assistants, API tokens and integrations

9.1 Delegation. You may let software act on your account: an AI assistant connected through our AI connector, an automation tool or a program of your own using an API token, or any other integration we offer. Everything such software does in your account is your action, with the same effect as if a person on your team had done it, including uploading, sharing, sending and deleting files and creating client accounts.

9.2 You stay the owner. Software never owns an account. Ownership is established by you, through the email you verified; what you give an assistant or a token is a revocable delegation. You can revoke it at any time from your account, and you are responsible for the credentials and approvals you grant, as you are for the passwords of your team.

9.3 What the connector does. Our AI connector lets an assistant operate your account after you approve it on your own ProjectSend site, choosing what it may do. It works with file names, sizes, links, download records and, on paid plans, client details; it does not return the contents of your files to the assistant. It is part of the hosted Service on every plan and is not included in the open source software. We may limit the number of requests a connection can make.

9.4 Confirmations are not guarantees. Confirmation steps for sensitive actions (for example deleting a file or revoking a link) are features of the Service, offered to help you; they are not a guarantee that any assistant or tool will behave correctly, and we are not responsible for what software you authorised does with your account, or for the assistant's own errors, omissions or advice.

9.5 Your AI provider. The assistant's replies are produced by the AI provider you chose, under that provider's terms. That provider is not our subprocessor. On paid plans, sharing your End Users' data with an AI provider through the connector is your decision as the party responsible for that data.

9.6 The record. Your account's activity log records each action with its origin (web, API or AI assistant) and the name of the token or assistant that performed it. That log is the record of what happened in your account.

10. Copyright Policy (DMCA)

We respect intellectual property rights and comply with the Digital Millennium Copyright Act (17 U.S.C. § 512).

10.1 Notices. If you believe content hosted on the Service infringes your copyright, send a notice to our Designated Agent containing: (a) identification of the copyrighted work; (b) identification of the material claimed to be infringing and information reasonably sufficient to locate it (URL); (c) your contact information; (d) a statement that you have a good-faith belief that the use is not authorized by the copyright owner, its agent, or the law; (e) a statement, under penalty of perjury, that the information in the notice is accurate and that you are authorized to act on behalf of the owner; and (f) your physical or electronic signature.

Designated Agent: [NAME / "Copyright Agent"], Gallifrey AI Inc., [EMAIL: [email protected]], [PHONE]. (Must match the registration filed in the U.S. Copyright Office DMCA Designated Agent Directory — file at dmca.copyright.gov, USD 6, renew every 3 years.)

10.2 Takedown and notification. Upon receipt of a valid notice, we will expeditiously remove or disable access to the identified material and notify the account holder.

10.3 Counter-notice. If you believe material was removed by mistake or misidentification, you may send a counter-notice including: identification of the removed material and its prior location; a statement under penalty of perjury of your good-faith belief that removal was a mistake; your name, address, and phone number; consent to the jurisdiction of the U.S. federal district court for your district (or, if outside the U.S., the District of Delaware); and your signature. Unless the original claimant notifies us that it has filed a court action, we will restore the material in 10–14 business days.

10.4 Misrepresentation. Under 17 U.S.C. § 512(f), any person who knowingly materially misrepresents that material is infringing, or that it was removed by mistake, may be liable for damages.

10.5 Repeat infringers. We will terminate, in appropriate circumstances, the accounts of users who are subject to repeated substantiated infringement notices. [Internal policy: log every valid notice per account; ≥3 substantiated notices within 6 months triggers termination review. The policy must actually be enforced — see BMG v. Cox.]

11. Term, suspension, and termination

You may cancel at any time, effective at the end of the billing period. We may suspend or terminate for material breach (including AUP violations) with notice where practicable, or immediately where required by law or to prevent harm. Free plan accounts are also paused and removed as described in Section 4.3. Sections 5.4, 9.1, 13, 14, 15, and 16 survive termination.

12. Features in development

We may offer features labelled beta, early access or coming soon, and we may announce features before they are available. Announced features are not commitments; beta and early-access features may change or be withdrawn, and are excluded from any service level commitment [and from Section 13 warranties].

13. Disclaimers

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE." TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE. [If an SLA is offered on higher tiers, it will be a separate document; see docs/legal-readiness.md §5 for the proposed commitments per plan.]

14. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR LOSS OF PROFITS, REVENUE, OR DATA. OUR AGGREGATE LIABILITY ARISING OUT OF THESE TERMS WILL NOT EXCEED THE AMOUNTS YOU PAID US IN THE [12] MONTHS BEFORE THE CLAIM [OR, FOR THE FREE PLAN, USD [100]]. THESE LIMITS DO NOT APPLY TO YOUR PAYMENT OBLIGATIONS, YOUR INDEMNIFICATION OBLIGATIONS, OR EITHER PARTY'S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT.

15. Indemnification

You will defend and indemnify the Company against third-party claims arising from Customer Content, your use of the Service in violation of these Terms or applicable law, the actions of tools and assistants you authorised (Section 9), or your violation of any third party's rights, including intellectual property and privacy rights.

16. Governing law and disputes

These Terms are governed by the laws of the State of Delaware, without regard to conflict-of-laws rules. [OPTION A: Disputes will be resolved by binding arbitration under the AAA Commercial Rules, on an individual basis; class actions waived. / OPTION B: Exclusive jurisdiction and venue in the state and federal courts of [COUNTY, STATE].] [Decide with counsel; arbitration clauses require careful consumer-law drafting.]

17. Changes to these Terms

We may update these Terms. For material changes we will give at least 30 days' notice by email or in-app notice. Continued use after the effective date constitutes acceptance. The version you accepted, and when, is recorded with your account.

18. Miscellaneous

These Terms plus any order form are the entire agreement. If a provision is unenforceable, the remainder stands. We may assign these Terms in connection with a merger or sale; you may not assign without consent. Notices to us: [[email protected]]. No waiver is implied by delay.

ProjectSend is open source software licensed under GPLv2. ProjectSend Cloud is operated by Gallifrey AI Inc. "ProjectSend" and the ProjectSend logo are [trademarks of / used under license from] Gallifrey AI Inc. [Adjust once trademark registration proceeds.]