Terms of service

1. Who this is between

These terms are between Coysh Digital Ltd, registered in England and Wales, and the organisation that holds the subscription ("you").

They apply to the hosted service and this website. They do not apply to the open source control plane if you run it yourself: that is governed by its licence, and clause 10 covers the difference.

By creating an account you accept these terms. If you are accepting on behalf of a company, you confirm you are entitled to do so.

2. What the service does

Manager collects operational information from Craft CMS installations you connect to it, and presents it in one place. Concretely: Craft and plugin versions, available updates and whether a security release is outstanding, licence state, configuration findings, disk and queue health, counts of failed control panel sign-ins, and encrypted database backups when you authorise them per site.

3. What the service does not do

This clause is unusual in a terms document, and it is here because these are limits you are agreeing to rather than gaps we intend to close.

• Manager does not install updates. It reports that an update exists. Applying it remains your responsibility, through your own deployment process.
• Manager cannot change anything on a connected site. It cannot run a console command, evaluate PHP, run a query, or read or write a file. Three jobs exist and none of them takes a command, a path, a query or a URL.
• Manager does not restore backups. Retrieval is a command you run, against storage, with a key we do not hold.
• Manager is not an uptime monitor. It reports whether a site has been checking in with us. It makes no HTTP request to your site, so it cannot tell you whether a visitor could reach it.
• Manager does not monitor domain expiry, and does not group sites by client. See the roadmap. It does check TLS certificate expiry, which is the one thing it looks at from outside your site.

You should not rely on Manager as your only safeguard for anything. It is a tool that tells you things sooner; it is not a guarantee that you will be told.

4. Your account

• You are responsible for what happens under your account, including what the people you invite do with it.
• Keep your credentials to yourself. Everyone on the rota gets their own login, at no extra cost, because there is no seat count.
• Turn on a second factor. You can require it for everyone in your organisation, and we recommend you do.
• Tell us promptly if you think an account has been compromised.

5. Connecting sites

You confirm that you are entitled to connect each site you add and to receive the information it reports. If a site belongs to a client, that is between you and your client; we deal only with you.

Authorising backups for a site means a copy of that site's database is encrypted and stored with us. Where that database contains personal data, you are the controller and we are the processor. The privacy policy sets out what that means in practice, and we will sign a data processing agreement if you want one.

6. Acceptable use

Do not:

• Connect a site you have no right to connect, or use the service to gather information about somebody else's infrastructure.
• Attempt to access another organisation's data, or to circumvent the boundaries between organisations.
• Use the service to store or transmit anything unlawful.
• Resell access to the hosted service. Using it to look after your clients' sites is exactly what it is for and is not reselling.
• Deliberately overload the service, or automate against it in a way that degrades it for others.

Security research is welcome and is not a breach of this clause when it follows the security policy.

7. Payment

• £9.99 a month or £99 a year. Prices exclude VAT, which is added at checkout where it applies.
• Backup storage beyond 2 GB is £2 a month per additional 10 GB. Using your own S3-compatible bucket carries no charge from us.
• Payment is taken in advance by Stripe. We do not hold your card details.
• Cancel any time, keep access to the end of the paid period. We do not refund payments already made. The refund policy has the detail, including the two cases where we always put things right.
• At least 30 days' notice by email before a price change applies to you.

8. Availability

We do not offer a service level agreement, and we are not going to pretend otherwise. We aim for the service to be available and we treat an outage as urgent, but at £9.99 a month a contractual uptime guarantee would be a number invented for a page rather than one anybody is holding themselves to.

What we will do:

• Give notice of planned maintenance that will interrupt the service.
• Credit or refund a period of sustained unavailability if you ask.
• Tell you what happened.

An outage does not affect your sites. Manager only ever read from them, so they carry on exactly as before. Reports queue on the connector side and arrive when the service returns.

If you need a guarantee, run it yourself. The control plane is the feature-complete edition and its availability is then entirely in your hands.

9. Suspension and termination

We may suspend or close an account if:

• Payment fails and is not resolved. Suspension stops monitoring and backups and deletes nothing; stored backups are destroyed 30 days later, and we email you before that.
• The account is being used in breach of clause 6. Where it is safe to do so we will tell you first and give you a chance to put it right.
• We are required to by law.

You can close your account at any time from the console. Fetch any backups you want to keep before you do, using manager:backups:fetch. They are sealed to your keys, so this is something you can do without us and something we cannot do for you.

We may discontinue the hosted service. If we do, you get at least 90 days' notice, a refund of any period paid for beyond the closure date, and the ability to export your data. The control plane being public under AGPL-3.0-or-later means the software itself continues to exist whatever happens to us, which is one of the reasons it is published.

10. Open source, and what it means for you

The control plane is licensed under AGPL-3.0-or-later. The Craft connector, the wire protocol and the offline recovery tool are MIT. The hosted billing and key-wrapping layer is not published, and the source page says so plainly.

• You may run the control plane for yourself and for your clients, commercially, owing us nothing.
• The AGPL's only real obligation applies if you modify it and host your version for other people: those people are entitled to your source.
• Nothing in these terms restricts any right the AGPL or the MIT licence gives you. Where they conflict, the licence wins.
• These terms govern the hosted service only.

11. Intellectual property

Your data stays yours. We claim no rights over the information your sites report, over your backups, or over anything you put into the service, beyond what we need in order to run it for you.

The Manager name and branding are ours. The licences above cover the code, not the name: a fork is welcome and is why the source is public, but it needs its own name.

Manager is an independent product for Craft CMS and is not affiliated with or endorsed by Pixel & Tonic. Craft CMS is their trademark.

12. Liability

Nothing here limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be limited.

Subject to that, our total liability to you in connection with the service in any 12-month period is limited to the amount you paid us in that period. We are not liable for loss of profit, loss of business, loss of data, or any indirect or consequential loss.

In particular, we are not liable for the consequences of an update Manager did not tell you about, a site it did not report on, or a backup you did not take. Manager is a tool that helps you notice things. Keeping your clients' sites patched and backed up remains your job, and the service is provided as it is, without warranties beyond those the law implies.

13. Changes to these terms

We may update these terms. Material changes get at least 30 days' notice by email to account owners before they take effect, and continuing to use the service after that means you accept them. If you do not, cancel before they apply.

14. General

• If a clause turns out to be unenforceable, the rest still stands.
• Not enforcing something once does not waive it.
• You may not transfer these terms without our agreement. We may transfer them to a company acquiring the business, on the same terms.
• Nobody other than you and us has rights under this agreement.
• These terms are governed by the law of England and Wales, and its courts have exclusive jurisdiction.

15. Contact

[email protected], or the contact page.