What we promise — and what you agree to.

Use Sutrace to monitor anything you have authorisation (in writing) to monitor. Invite teammates, consume the API within your plan’s rate limit, export your data at any time in machine-readable form, self-host where the plan allows.

The details live in the Acceptable Use Policy. In short: no unauthorised scanning, no resale without a reseller contract, no interference with other tenants, no defeating security controls, no sanctioned end-uses.

You are responsible for actions taken under your account. Keep credentials confidential. Enable MFA; notify security@sutrace.io immediately if you suspect a compromise. Allowlist enforcement, App Check, and Firestore rules are real security boundaries — do not attempt to bypass them, even on your own account.

Paid plans are billed monthly or annually in advance in the currency on the order form. Past-due accounts may be suspended after 15 days’ notice. Fees do not include applicable VAT/GST — these are added where required. Refunds are issued pro-rata where Sutrace terminates without cause, and not issued where you terminate mid-term.

The Term is the period stated on your order form, or month-to-month if none. Either party may terminate for material breach with 30 days’ cure notice. Either party may terminate immediately for insolvency, illegality, or a confirmed sanctions breach. On termination you have 30 days to export data before deletion.

Free plan has no SLA. Paid plans follow the Service-Level Agreement. SLA credits are your sole and exclusive remedy for availability failures.

Sutrace owns the Service, including all software, documentation, and branding. You own your data and grant Sutrace a non-exclusive licence to host, process, and display it only as necessary to provide the Service. Feedback you provide is perpetually licensable by us without restriction.

We warrant that we will (a) provide the Service with reasonable skill and care, (b) not materially degrade functionality during the Term, (c) maintain the technical + organisational measures in our DPA. Except as expressly stated, the Service is provided “as is” to the maximum extent permitted by law.

Neither party is liable for indirect, incidental, consequential, or punitive damages. Each party’s aggregate liability is capped at the greater of (a) 12 months of fees paid by you in the 12 months before the event, or (b) €10,000. The cap does not apply to breach of confidentiality, IP infringement, indemnities, or payment obligations. Nothing in these Terms limits liability that cannot be limited by law (gross negligence, willful misconduct, personal injury).

Sutrace will defend and indemnify you against third-party IP claims that the Service as provided infringes a valid IP right. You will defend and indemnify us against claims arising from your data, your use of the Service in breach of the AUP, or your end-users’ use of your systems.

Processing of personal data is governed by the Privacy Policy and, on paid plans, by the Data Processing Addendum which takes precedence over these Terms for data-protection matters.

You represent that you are not located in, and will not use the Service from, a jurisdiction subject to comprehensive US / EU / UK sanctions, and that you are not on any denied-persons list. You will comply with applicable export controls (US EAR, EU Dual-Use Regulation 2021/821). Sutrace may refuse service or terminate for a sanctions / export breach without notice.

We may update these Terms with 30 days’ notice. Material changes are announced in-product and by email to billing contacts. Continued use after the effective date is acceptance. If you disagree you may terminate without penalty before the effective date.

Sutrace is observability, not control. Operational decisions taken on the basis of signals you see on Sutrace remain yours; the Service is advisory. Specifically: the Service is not a safety-critical or life-support system, must not be used as the sole trigger for kinetic action on industrial equipment without a human in the loop, and must not replace certified process-safety or control systems.

Luxembourg law (to be confirmed on entity finalisation). Exclusive jurisdiction of the courts of Luxembourg-ville, without prejudice to any mandatory local protections you enjoy as a consumer — but note these Terms apply only to businesses.

• Assignment: neither party may assign without consent, except to a successor in a merger / sale of all or substantially all assets.
• Force majeure: neither party liable for delays caused by events beyond reasonable control.
• Severability: if any clause is unenforceable, the remainder continues in force.
• No waiver: failure to enforce a right is not a waiver.
• Notices: legal notices to legal@sutrace.io or your signed order-form address; technical to support@sutrace.io.
• Entire agreement: these Terms, the DPA, the SLA, the AUP, and any order form form the entire agreement and supersede prior terms.