Terms of Service

DRAFT — NOT YET IN EFFECT. This document is a working draft prepared for review by an attorney. It has not been approved, is not legal advice, and does not bind anyone in its current form. Text in square brackets, such as [LEGAL ENTITY NAME], is a placeholder that still has to be filled in.

These Terms of Service (“Terms”) are an agreement between [LEGAL ENTITY NAME], a [STATE OF ORGANIZATION] [ENTITY TYPE] with its address at [ADDRESS] (“we”, “us”, “our”), and the business that creates an account for Tick Tack Timetrack (“Customer”, “you”, “your”). They cover the Tick Tack Timetrack web application, its kiosk mode, its public API and webhooks, and any related support we provide (together, the “Service”).

1. Accepting these Terms

1.1 How you accept. The sign-up form shows a statement next to the sign-up button saying that by signing up you agree to these Terms and to our Privacy Policy. By clicking the sign-up button, the person signing up accepts these Terms on behalf of the Customer named in the form.

1.2 Authority. The person who signs up confirms that they are authorised to bind the Customer to these Terms. If they are not, they must not sign up, and they are personally responsible for any use of the Service they make without that authority.

1.3 Related documents. These Terms incorporate the following documents, each as published at the address shown on the day you accept:

• the Data Processing Addendum (“DPA”), which governs how we process personal data on your behalf;
• the Acceptable Use Policy;
• the Subprocessor list.

Our Privacy Policy, Cookie Policy and Security overview describe our practices and are provided for information. If documents conflict, the DPA governs personal data processing, and otherwise these Terms govern.

1.4 Business use only. The Service is for businesses and other organisations, not for consumers acting for personal or household purposes.

1.5 Records of acceptance. When an administrator accepts these Terms, we record which version was accepted, when, by which user, and from which IP address and browser. We keep each version of these Terms published, unchanged, at its own address.

2. The free beta

2.1 Beta status. The Service is currently offered as a free beta. During the beta:

• the Service is provided “as is” and “as available”, without any service level commitment, and may contain errors, be interrupted, or lose functionality;
• features, limits, and the user interface may change, be added, or be removed at any time, with or without notice;
• we charge no fees for the Service.

2.2 End of the beta and paid plans. We will give the Customer’s administrators at least [BETA NOTICE PERIOD, e.g. 30] days’ notice by email before any paid plan applies to the Customer. That notice will describe the plans and prices available. Paid use begins only if the Customer chooses a paid plan; if it does not, it may stop using the Service and export its data as described in section 9.

2.3 Beta feedback. You are not required to give us feedback. If you do, we may use it to improve the Service without any obligation to you.

3. Accounts and users

3.1 Administrators. The Customer’s administrators control the account: they invite users, assign roles, configure features such as GPS, photos, kiosks, payroll, retention, single sign-on, API keys, and webhooks, and accept updated versions of these Terms for the Customer. Anything an administrator does in the Service is done on the Customer’s behalf.

3.2 Users. The Customer may allow its employees, contractors, and advisers (such as an accountant) to use the Service under its account (“Users”). The Customer is responsible for its Users’ compliance with these Terms and for all activity under its account.

3.3 Credentials. Users must keep their passwords, authenticator apps, recovery codes, passkeys, kiosk PINs, and API keys confidential. The Customer must tell us promptly about any unauthorised use it becomes aware of.

3.4 Accurate information. The Customer must keep its account information, including an administrator email address that is monitored, accurate and current. We send legal and security notices to that address.

4. Customer responsibilities as employer

4.1 Notices and consents to workers. The Customer decides whether to turn on features such as location capture at punch time, real-time location tracking, geofences, and punch photos. The Customer is responsible for giving its workers any notice, and obtaining any consent, that applicable law requires before using those features, and for using them only for lawful purposes.

4.2 Pay and legal compliance. The Service calculates hours, overtime, and estimated gross pay from the rules and rates the Customer configures. It does not calculate tax withholding, deductions, or net pay, and it does not pay anyone or move any money. The Customer remains solely responsible for paying its workers correctly and on time, for its wage-and-hour, overtime, meal and rest break, recordkeeping, and tax obligations, and for checking the results the Service produces. The Service is a tool, not legal, payroll, accounting, or tax advice.

4.3 Record keeping. Laws may require the Customer to keep time and pay records for a minimum period. The Customer is responsible for choosing retention settings and exporting data so that it meets those requirements.

5. Customer Data

5.1 Ownership. As between the parties, the Customer owns all data that it and its Users submit to the Service, including time punches, locations, photos, schedules, time-off records, pay rates, and payroll results (“Customer Data”).

5.2 Our use of Customer Data. The Customer grants us a limited right to host, copy, process, transmit, and display Customer Data only as needed to provide, secure, support, and maintain the Service, to prevent abuse, and to comply with law, in each case as described in the DPA. We do not sell Customer Data and we do not use it to advertise.

5.3 Aggregated information. We may create statistics about how the Service is used (for example, counts of punches or response times) that do not identify the Customer, any User, or any individual, and use them to operate and improve the Service. [ATTORNEY: confirm whether to keep this right at all.]

5.4 Personal data. For personal data inside Customer Data, the Customer is the controller (or “business”) and we are its processor (or “service provider”). The DPA applies to that processing.

6. Our responsibilities

6.1 We will provide the Service in line with these Terms and the DPA, and protect Customer Data with the safeguards described in our Security overview.

6.2 We may use the subprocessors listed on our Subprocessor list and will give notice of changes as described there and in the DPA.

6.3 We will notify the Customer of a security incident affecting its Customer Data as set out in the DPA.

7. Acceptable use and API

7.1 The Customer and its Users must follow the Acceptable Use Policy.

7.2 API and webhooks. API access is subject to published rate limits. When the Customer configures a webhook, the Service sends Customer Data to the endpoint the Customer chooses. That endpoint and whatever receives data from it are the Customer’s responsibility, not our subprocessors.

7.3 Third-party services. If the Customer chooses to connect a third-party service (for example, single sign-on with a Google, Microsoft, or Apple account), that service’s own terms govern its use, and we are not responsible for it.

8. Intellectual property

8.1 We and our licensors own the Service, including its software, design, documentation, and trademarks. These Terms give the Customer a non-exclusive, non-transferable right to use the Service during the term for its internal business purposes. All other rights are reserved.

8.2 The Customer must not copy, modify, resell, sublicense, reverse engineer, or build a competing product from the Service, except where the law expressly allows it despite this restriction.

8.3 Copyright complaints. We respond to notices of alleged copyright infringement sent to our designated agent: [DMCA AGENT DETAILS].

9. Term, suspension, cancellation, and your data

9.1 Term. These Terms start when the Customer signs up and continue until the account is cancelled.

9.2 Cancellation by the Customer. An administrator may cancel the account at any time.

9.3 Termination or suspension by us. We may suspend or end the Customer’s access:

• immediately, if needed to prevent harm to the Service, other customers, or any person, or if required by law;
• if the Customer materially breaches these Terms and does not fix the breach within [CURE PERIOD, e.g. 15] days of our notice;
• for any reason during the beta, with at least [BETA TERMINATION NOTICE, e.g. 30] days’ notice, so that the Customer can export its data.

9.4 Exporting data. Administrators can download an export of the Customer’s records as CSV files at any time, including while the account is paused or cancelled and during the retention window described next. The Privacy Policy lists what the export contains.

9.5 After cancellation. We keep Customer Data for [CANCELLED RETENTION DAYS, currently planned: 90] days after the end of the Customer’s last active period, so that the Customer can export it or reactivate. After that, we delete it from the live Service. Copies in backups are overwritten on our normal backup cycle of [BACKUP RETENTION PERIOD]. [ATTORNEY/OWNER: this period is still an open owner decision; confirm before publishing.]

9.6 Survival. Sections 4.2, 5, 8, 9.5, 10, 11, 12, and 13 survive the end of these Terms.

10. Warranties and disclaimers

10.1 Each party confirms that it has authority to enter these Terms.

10.2 Disclaimer. To the fullest extent the law allows, the Service, including any beta feature, is provided “as is” and “as available”. We disclaim all implied warranties, including warranties of merchantability, fitness for a particular purpose, title, and non-infringement. We do not promise that the Service will be uninterrupted or error-free, that location readings will be accurate (location depends on the User’s device and network), or that the Service’s calculations satisfy any particular law.

11. Limitation of liability

11.1 Excluded damages. To the fullest extent the law allows, neither party is liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, or goodwill, however caused, even if it was told they were possible.

11.2 Cap. To the fullest extent the law allows, each party’s total liability arising out of or relating to these Terms is limited to the greater of (a) the fees the Customer paid us in the 12 months before the event giving rise to the claim and (b) [LIABILITY CAP AMOUNT, e.g. US$100]. During the free beta, (a) is zero.

11.3 Exceptions. The limits in this section do not apply to the Customer’s payment obligations, to either party’s indemnity obligations, or to liability that cannot be limited by law. [ATTORNEY: consider whether data-breach liability should have a separate cap.]

12. Indemnity

The Customer will defend us against any third-party claim, including a claim by a worker or a government authority, arising from (a) Customer Data, (b) the Customer’s use of the Service in breach of these Terms or the law, including failing to give worker notices or obtain consents, or (c) how the Customer pays its workers, and will pay any resulting damages, fines, and reasonable legal costs awarded or agreed in settlement. We will give the Customer prompt notice of the claim, let it control the defence, and cooperate reasonably at its cost. [ATTORNEY: consider whether we should give a reciprocal IP-infringement indemnity.]

13. General

13.1 Governing law. These Terms are governed by the laws of the State of [GOVERNING LAW STATE], without regard to its conflict-of-laws rules.

13.2 Disputes. [ATTORNEY: choose between (a) exclusive jurisdiction of the state and federal courts in [VENUE COUNTY, STATE], or (b) binding individual arbitration with a class-action waiver, and draft accordingly.]

13.3 Changes to these Terms. We may publish a new version of these Terms. Each version has its own version date and stays available at /legal/terms/<version>/. We will notify administrators of material changes at least [CHANGE NOTICE PERIOD, e.g. 30] days before they take effect, except where a change is required by law or concerns a new feature. After a new version is published, an administrator is asked to accept it when they next sign in to the web app. Continued use of the Service after a version takes effect means the Customer accepts it. [ATTORNEY: see README question on whether continued use is enough when admins have not yet clicked accept.]

13.4 Notices. We send notices to the Customer’s administrators by email or in the Service. The Customer sends notices to us at [CONTACT EMAIL] and [ADDRESS].

13.5 Assignment. Neither party may assign these Terms without the other’s consent, except to a successor in a merger, acquisition, or sale of substantially all of its relevant assets, with notice to the other party.

13.6 Force majeure. Neither party is liable for a delay or failure caused by events beyond its reasonable control, such as outages at our hosting provider, internet failures, natural disasters, or government action. This does not excuse payment obligations.

13.7 Export and sanctions. The Customer must not use the Service in, or make it available to anyone in, a country or to a person subject to US sanctions. The Service is hosted in the United States and is intended for businesses with workers in the United States.

13.8 Entire agreement. These Terms and the documents they incorporate are the entire agreement about the Service and replace any earlier agreement on that subject. Purchase orders and other Customer forms do not change them.

13.9 Other terms. If a provision is unenforceable, the rest stays in force. A failure to enforce a provision is not a waiver. The parties are independent contractors. There are no third-party beneficiaries.

13.10 Contact. Questions about these Terms: [CONTACT EMAIL].