Terms of Service

These Terms are an agreement between you and Michal Jatczak, a sole trader registered in Malta who trades as ITSailor ("we", "us"). ITSailor is a trading name, not a separate legal entity.

Registered address: Level 1, Unit 60, Door No 63, Connecticlub Business Center, Triq Il-Ballut (Zona Industrijali, Mosta), MST 4001, Mosta, Malta. VAT MT32760411. Email: legal@itsailor.io. Phone: +356 9912 1061.

These Terms apply to your use of itsailor.io, our free tools and the client panel, and to anything you buy from us without signing a separate contract: workshops, eBooks and software licences. They also apply to a managed automation package, which you order by accepting our written quote in writing, by email or signature; the accepted quote counts as an Order Form below. The Refund Policy forms part of them.

Where documents conflict, this order applies, highest first:

1. a signed Statement of Work, Order Form or Master Services Agreement, for the services it covers;
2. the CSP Marketplace Terms, for software licences;
3. these Terms;
4. the Refund Policy.

The Privacy Policy and the Cookie Policy explain how we handle personal data. They are information, not contract terms.

Most of what we sell is sold to businesses. If you accept these Terms for a business, you confirm that you may bind it. If you are a consumer, meaning a person acting mainly outside your trade, business or profession, your statutory consumer rights apply and nothing in these Terms reduces them. Clauses that apply only to business customers say so.

Sectors we do not serve. We do not take on work for organisations in a small number of sectors, and our free tools must not be connected to a tenant, subscription or account of such an organisation. We do not list those sectors here. If you are not sure whether your organisation is in one, ask us at legal@itsailor.io before you connect a tool or order, and we will tell you. If we learn that an organisation is in one of them, we may decline its order or end the affected service, we delete any data a tool or service holds for it, and we refund what was paid for any part not yet performed.

• Free tools and resources. Diagnostic tools and downloads on itsailor.io, free of charge and provided as they are. Some tools connect to a Microsoft 365 or Google Workspace tenant with read-only consent from an administrator, or read an Azure subscription on which an administrator gives our application the Reader role. Connect only a tenant or subscription you are authorised to connect.
• Workshops. Live sessions by video call, delivered by Michal Jatczak. The Architecture & Security Design Workshop includes a written deliverable pack due within 5 business days of the session. If the pack is late, the fee is refunded in full under the Refund Policy.
• eBooks. PDF files sent by email straight after payment, readable on any device with a PDF reader. No DRM; each copy carries a licence line naming the buyer.
• Software licences. Microsoft and other vendor licences, bought through us from our distributor Pax8. The CSP Marketplace Terms and the vendor's own terms apply (for Microsoft, the Microsoft Customer Agreement), and the vendor's rules decide what can be cancelled and when.
• Consulting and implementation. Scoped and priced in a Statement of Work, which governs the engagement together with these Terms.
• Managed automation packages. Workflows we build and run for you on our own automation server, sold to businesses only. Your written quote states the package, the setup and monthly fees, the term and the notice period for ending it. Section 14 covers the personal data a package handles and what happens to it when you leave.
• Client panel. Customers can use an account at itsailor.io/dashboard to order licences, follow projects and manage billing. Keep your sign-in details secure; you are responsible for what is done through your account.

We commit to the delivery terms stated for each offer in these Terms, the Refund Policy and the CSP Marketplace Terms. We do not offer an uptime or response-time service level unless a signed document states one.

How ordering works. You choose an offer, enter your details at checkout and can correct them before you pay. The contract is concluded when your payment succeeds. We confirm it by email, with these Terms, the Refund Policy and the model withdrawal form attached. Contracts are concluded in English, and we keep a record of your order. After buying a workshop you book your session, for a date within 30 days of purchase.

Prices. Prices are in euro and exclude VAT unless the offer says otherwise. EBooks and the Architecture & Security Design Workshop are priced including VAT; a business buyer under the reverse charge pays the same total, with no VAT charged. The total is shown before you pay. EU business customers outside Malta with a VAT number we can verify in VIES are invoiced under the reverse charge.

Payment. One-time purchases are paid at checkout through Stripe, or by invoice where we agree it, in which case the invoice is due within the period stated on it. Licence billing follows the CSP Marketplace Terms. Cancellations, refunds and the consumer right of withdrawal are set out in the Refund Policy.

• Our material. Methods, templates, tools and know-how we had before working with you, or develop outside your engagement, remain ours.
• What we deliver. Documents, configurations, code, runbooks and the Exit Kit we deliver under a workshop or engagement ("Deliverables") are licensed to you once paid for: perpetually, irrevocably, worldwide and royalty-free. You may use, change and keep them inside your organisation, and pass them to a successor supplier without asking us. A Statement of Work may instead assign specific material to you; it then controls for that material.
• Third-party components. Open-source and third-party components in a Deliverable stay under their own licences and are outside our warranty and indemnity.
• eBooks. For the buyer's own use, or the buying organisation's internal use. No resale, redistribution or public posting.
• Free tools. You keep your inputs and your report. We may keep anonymised, aggregate statistics to improve the tools.

Every consulting engagement and every Architecture & Security Design Workshop ends with an Exit Kit: documentation, configuration baselines, infrastructure-as-code, runbooks and a map of the credentials the delivered work depends on, so that your own team or another supplier can run it without us. The credentials map records where each credential is kept and who holds it. It never contains the secrets themselves, and we recommend rotating them at handover.

For an engagement under a Statement of Work, the Exit Kit is delivered within 24 hours of the engagement closing. For the workshop it is part of the deliverable pack.

You are responsible for:

• running your own cloud accounts and environments, and reviewing any change we recommend before you apply it;
• your credentials and access policies, and backups of your own data;
• checking AI-written output before acting on it. Some of our tools use third-party AI models to draft reports. The output can be wrong and is not professional advice;
• meeting the legal and regulatory obligations that apply to your organisation. We give technical and architectural advice. We are not your lawyer, auditor or compliance officer, and nothing we deliver is a legal opinion or a certification.

Do not use our site, tools or client panel unlawfully; test the security of our systems or load-test them, except as our vulnerability disclosure policy allows; reverse engineer our tools, except where the law allows it; overload our tools through automated or excessive use; or connect a tenant or system you are not authorised to connect.

The vulnerability disclosure policy in our Trust Center is Michal Jatczak's written permission to test our systems within its limits. Testing within those limits, and good-faith reports to security@itsailor.io, are not a breach of these Terms. Testing beyond them needs separate written permission from Michal Jatczak. We may suspend access to stop a breach of this section, and we will tell you why.

We perform paid services with reasonable skill and care, in line with good industry practice. Otherwise, to the extent the law allows, our site, free tools and Deliverables are provided without other warranties, express or implied, and we do not promise that they will be uninterrupted or error-free.

If you are a consumer, this section does not apply to you. You keep your statutory rights, including the legal guarantee for digital content such as an eBook: it must match its description and work as normally expected. If it does not, we fix it free of charge; if we do not, you may get a price reduction or, unless the fault is minor, end the contract.

• Neither party is liable for indirect or consequential loss, or for lost profits, revenue, savings, goodwill or data.
• A signed Statement of Work or Master Services Agreement may set a limit of liability for the services it covers.
• Nothing limits liability for fraud, wilful misconduct, gross negligence, death or personal injury caused by negligence, or anything else the law does not allow to be limited.
• If you are a consumer, this section does not apply to you and your statutory rights are unaffected.

• You will cover us against third-party claims arising from your breach of these Terms, from systems you operate (including with our Deliverables), or from data you process unlawfully.
• We will defend you against a third-party claim that a Deliverable we authored infringes that party's intellectual property, and pay damages finally awarded or agreed in a settlement we approve. This does not cover third-party or open-source components, vendor products, your changes, combinations with anything we did not supply, or material built to your specification. If such a claim arises, we may modify or replace the Deliverable, or refund what you paid for it.
• The party seeking cover notifies the other promptly and lets it control the defence.

Each party keeps the other's confidential information confidential and uses it only for the work between us. Architecture documents, code, credentials and audit findings are confidential. The Privacy Policy explains what we do with personal data as controller.

When a free tool reads your Microsoft 365 or Google Workspace tenant or your Azure subscription, when we run a managed automation package for you, or when we work inside your systems under an engagement, we process personal data for you as your processor. This section is our contract for that processing under Article 28 GDPR. An administrator who connects a tenant, or gives our application a role on a subscription, accepts it for their organisation; for a managed package, your accepted quote incorporates it and its processing annex names the data the package handles.

• What and why: for the free tools, directory, account, sign-in and security data about your users and administrators, as listed at itsailor.io/trust/scopes, and for the Cost Review for Azure the cost, resource, Advisor and policy data of one subscription, which can include names in resource names and tags. For a managed package, the data of your customers, leads, bookings, orders or staff that the package needs, as its quote names. For an engagement, the data it requires. We process it only to produce the report, run the package or deliver the engagement you asked for, and only for as long as that takes. Free-tool scan results expire after 10 minutes, except that the Tenant Security Scorecard keeps the score and the state of each control for 180 days if you tick Remember this result; the Azure read is not stored.
• Your instructions: the consent or role your administrator grants and your use of the tool, your quote and the settings of your package, and any Statement of Work. We follow only those instructions, unless the law requires otherwise, in which case we tell you first where the law allows. We tell you if we think an instruction breaks data protection law.
• Confidentiality and security: we keep the data confidential. Only Michal Jatczak has access to it, and we protect it with the measures in section 9 of the Privacy Policy.
• AI tools in an engagement: we do not put data from your systems, such as configurations, tenant exports or personal data, into an AI tool. We use AI tools only on our own drafts and scripts, with no data from your systems in them. If a Statement of Work provides otherwise, it names the provider, and that provider is listed in the Subprocessor Register before it receives any data.
• Where a managed package runs: on our own automation server at Hetzner in Germany. AI steps send the text they work on to Mistral AI in France, on its EU endpoint; Mistral may keep it for a limited period to monitor abuse, under its own terms. Email we send for you goes through Resend, in the United States. Telegram carries only alerts and approval notices to you and to us: a reference, a count or a status and a link. It receives no personal data of your customers, and you read and approve a draft on our server, not in Telegram. Your own accounts that a package uses with credentials you give us, such as your shop, mailbox, calendar, booking tool, WhatsApp Business or Google account, stay your providers under your agreements with them.
• Retention in a managed package: the shared logs of sent messages, approvals, duplicate checks and errors are deleted after 90 days, and AI usage records, which hold token counts and cost but no message text, after 400 days. A package keeps the personal data in its own tables for the period your quote states. Records of consent and opt-out are kept while you use the package, because they prove a person's choice, and are handed to you when you leave. The automation software keeps no execution data of a successful run, and keeps that of a failed run for up to 14 days so it can be repaired.
• Other providers: we may use the providers listed in the Subprocessor Register, including outside the EEA under the safeguards in section 5 of the Privacy Policy, on terms that protect the data in the same way. Before a new provider begins processing your data, we tell you by email at least 30 days in advance. You may object; if we cannot meet the objection, you may end the affected service.
• Help and breaches: we help you answer data subject requests and meet your obligations under Articles 32 to 36 GDPR, and we tell you without undue delay after becoming aware of a breach affecting your data. If a person writes to us about data we process for you, we pass the request to you.
• Leaving a managed package: within 14 days after the package ends we send you an export of the data it holds for you, consent records included, in CSV or JSON, with the runbook for each workflow. We then delete your data from our automation server within 30 days after the end. Copies in our encrypted backups are overwritten as the backup cycle runs and are never restored into a live system except to recover from an incident.
• End and audits: when the processing ends we delete the data, unless the law requires us to keep it. We give you the information you need to show compliance, and allow audits on reasonable notice.

If you are a financial entity under Regulation (EU) 2022/2554 (DORA), these Terms alone do not contain the contractual terms its Article 30 requires. We agree them with you in a signed document before the service starts.

• We may suspend a service for non-payment after 7 days' written notice, or immediately where needed to deal with fraud, a security risk, a breach of section 9 or a legal requirement. We restore it once the cause is resolved.
• Either party may end a contract if the other commits a material breach and does not remedy it within 30 days of written notice.
• When a contract ends, fees for work already done remain payable, paid-for Deliverables stay licensed to you, and sections 6, 10 to 14, 19 and 20 continue to apply.

Neither party is liable for delay or failure caused by events beyond its reasonable control, such as natural disasters, war, epidemics, power or network failures, cyber-attacks or failures of third-party platforms. The affected party tells the other promptly and limits the impact. If the event lasts more than 30 days, either party may end the affected service, and we refund prepaid fees for any part not performed.

We change these Terms only for a valid reason: a change in the law, security needs, or a change to our services. The version in force when you placed an order governs that order. For an ongoing service, we email you about a material change at least 30 days before it takes effect; if you do not accept it, you may end the affected service before then without penalty, and we refund prepaid fees for the remaining period.

• These Terms are governed by Maltese law. Business customers submit to the exclusive jurisdiction of the courts of Malta.
• If you are a consumer living elsewhere in the EU, you also keep the protection of the mandatory consumer law of your country. You may bring proceedings either in Malta or in the courts where you live, and we can bring proceedings against you only in the courts where you live.
• Complaints: write to legal@itsailor.io. We acknowledge within 2 business days and reply in substance within 14 days. Consumers may also contact the Office for Consumer Affairs at the Malta Competition and Consumer Affairs Authority (MCCAA) or, if they live in another EU country, the European Consumer Centre there.

• Entire agreement. For business customers, the documents in section 2 are the whole agreement for the services they cover. This does not limit liability for fraud.
• Severability. If a provision is invalid, the rest stays in force.
• Assignment. Neither party may assign these Terms without the other's consent, except to a successor to the business, including a company formed to take it over. We will tell you if that happens.
• No waiver. Not enforcing a term is not a waiver of it.
• Notices. By email: to legal@itsailor.io, and to you at the address on your order or account. A consumer's withdrawal or complaint is valid in any clear form.
• Sanctions. Both parties comply with applicable EU, UK and US export control and sanctions law. We may refuse or suspend a service where providing it would breach them.
• Relationship. Nothing in these Terms creates a partnership, agency or employment relationship.

• Contracts and legal notices: legal@itsailor.io
• Billing and refunds: billing@itsailor.io
• Privacy: privacy@itsailor.io
• Security reports: security@itsailor.io
• Phone: +356 9912 1061

Post: Michal Jatczak, trading as ITSailor, Level 1, Unit 60, Door No 63, Connecticlub Business Center, Triq Il-Ballut (Zona Industrijali, Mosta), MST 4001, Mosta, Malta.