Terms of Service

These Terms of Service (“Terms”) are an agreement between BrieflyLog (“we”, “us”) and the business or other organization that uses BrieflyLog (the “Customer”, “you”). The person who accepts these Terms for the Customer confirms that they are authorized to bind it.

If the Customer has signed a separate written agreement or order form with us, that document prevails over these Terms where they conflict. Our Privacy Policy explains how we handle personal information.

• Service: the BrieflyLog platform, including its web application, exports, and any API or integration features we make available.
• Users: individuals the Customer allows to access the Service under its workspace, including admins, temporary admins and team members.
• Customer Data: all information the Customer or its Users enter into, upload to or generate in the Service, including personal data about staff, clients and other people.
• Integration: any connection that lets a Third-Party Service access Customer Data, including API keys or credentials issued from the Customer's workspace.
• Third-Party Service: any software, platform, AI agent or service not provided by us, including those operated by the Customer's own vendors.

We will provide the Service to the Customer under these Terms. We may improve, change or remove features over time. If a change materially reduces core functionality the Customer relies on, we will give reasonable advance notice where practical.

Pilot and free access. Where we provide the Service or any feature free of charge, including during a pilot, it is provided as an accommodation. We may change, limit or end that free access, or start charging for it, as described under Fees.

• The Customer controls who has access to its workspace, including which Users are admins, which have temporary admin access, which locations each User can see, and who holds HR access. The Customer is responsible for these choices and for removing access when a User no longer needs it.
• The Customer is responsible for its Users' compliance with these Terms and for all activity under their accounts.
• Users must keep their credentials confidential and must not share accounts. The Customer must tell us promptly about any unauthorized access it becomes aware of.

Ownership. The Customer owns its Customer Data. The Customer grants us a limited right to host, process, transmit and display Customer Data only as needed to provide, secure and support the Service, and as the Customer instructs, including through Integrations it enables.

Controller responsibilities. The Customer is the data controller of the personal data in its Customer Data. The Customer is solely responsible for:

• having a lawful basis under the Kenya Data Protection Act, 2019 and any other applicable law to collect, record and share that personal data, including sensitive information such as identity numbers, pay and next-of-kin details;
• giving the people concerned (staff, clients, next of kin and others) any required notices and obtaining any required consents;
• the accuracy, quality and legality of Customer Data, and deciding what to record in the Service;
• responding to requests from individuals about their personal data, with our reasonable assistance.

As the Customer's data processor, we will:

• process Customer Data only on the Customer's documented instructions;
• keep Customer Data separate from other customers' data and confidential;
• maintain reasonable technical and organizational security measures appropriate to the nature of the data;
• ensure our service providers are bound by obligations at least as protective as these Terms;
• notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data;
• not sell Customer Data or use it to train artificial-intelligence models.

Our Data Processing Agreement forms part of these Terms and sets out these commitments in more detail.

Off by default. Integrations and API access are optional. They are enabled only when an authorized administrator of the Customer creates them or asks us in writing to create them, and they can be limited to specific data and revoked at any time.

The Customer's choice and responsibility. By enabling an Integration, the Customer instructs us to make the authorized Customer Data available to the Third-Party Service. The Customer:

• is solely responsible for choosing the Third-Party Service and for its agreement with it;
• confirms it has a lawful basis to share that data, including any transfer outside Kenya, and that its agreement with the Third-Party Service protects that data adequately;
• is responsible for how the Third-Party Service, and any of its own subprocessors such as AI model providers, accesses, stores, uses or discloses that data;
• must keep API keys and credentials confidential and must tell us immediately if one may have been compromised.

Our role ends at the hand-off. We are responsible for delivering authorized data securely through the Integration. Once Customer Data leaves the Service through an Integration, we do not control it and are not responsible for what happens to it.

AI outputs. Third-Party Services, particularly AI agents, can misread data or produce inaccurate, incomplete or out-of-date answers. The Customer is responsible for reviewing those outputs before relying on them, including before contacting clients about payments.

Controls. We may apply rate limits, require the Third-Party Service to accept our Developer Terms, and suspend or revoke an Integration if it threatens the security, stability or lawful operation of the Service. Where practical, we will tell the Customer first.

Fees. Integrations and API access are premium features and may be subject to additional fees as described under Fees, separate from any fee for the core Service.

The Customer and its Users must not:

• use the Service in breach of any law, including data protection law;
• try to access another organization's data, or any data or feature their permissions do not allow;
• probe, scan or test the Service's security, or interfere with its operation, except with our written permission;
• scrape the Service or access it by automated means other than an Integration we provide;
• resell, sublicense or provide the Service to third parties;
• upload malicious code or content that infringes others' rights.

Fees for the Service, and for optional features such as Integrations and API access, are as set out in an order form or as otherwise agreed in writing. Unless agreed otherwise, fees are payable in Kenya Shillings, exclude applicable taxes such as VAT, and are due within 30 days of invoice.

Where the Service or a feature is currently provided free of charge, we may introduce fees by giving the Customer at least 30 days' written notice. Before those fees take effect, the Customer may stop using the affected feature or end these Terms without charge.

We may suspend the Service, after notice, if undisputed fees remain unpaid for more than 30 days after their due date.

We own the Service, including its software, design and documentation, and all improvements to it. These Terms do not transfer any of those rights to the Customer, other than the right to use the Service during the term. If the Customer gives us feedback or suggestions, we may use them without obligation.

Each party will keep the other's non-public information confidential, use it only to perform under these Terms, and share it only with people who need to know it and are bound by similar duties. This does not apply to information that is public through no fault of the receiving party, or that must be disclosed by law, provided that the other party is notified where lawful.

We aim to keep the Service available and to fix problems promptly, but unless a written agreement says otherwise, we do not guarantee any particular uptime or response time. Planned maintenance will be scheduled to minimize disruption where possible. The Customer should keep its own exports of data it cannot afford to lose.

Except as expressly stated in these Terms, the Service is provided “as is” and “as available”, without warranties of any kind, whether express or implied, including warranties of merchantability, fitness for a particular purpose and non-infringement, to the fullest extent permitted by law.

The Service is a record-keeping and reporting tool. Its calculations, summaries and exports depend on the data entered and are not accounting, payroll, legal or professional advice. The Customer remains responsible for its own compliance with employment, tax and other laws.

To the fullest extent permitted by law:

• neither party is liable for any indirect, incidental, special, consequential or punitive damages, or for loss of profits, revenue, goodwill or data, however caused;
• each party's total liability arising out of or relating to these Terms is limited to the greater of (a) the fees paid or payable by the Customer to us in the 12 months before the event giving rise to the claim, and (b) KES 100,000;
• we are not liable for any loss arising from a Third-Party Service, from an Integration the Customer enabled, from Customer Data after it leaves the Service through an Integration, or from compromised credentials the Customer or its Users failed to protect.

These limits do not apply to the Customer's payment obligations, to the Customer's obligations under Customer indemnity, or to liability for fraud or any other liability that cannot be limited by law.

The Customer will defend, indemnify and hold harmless BrieflyLog and its officers, employees and contractors from and against all claims, regulatory actions, fines, losses and reasonable costs, including legal fees, arising from:

• Customer Data, including the Customer's lack of a lawful basis to process or share it;
• the Customer's breach of these Terms or of data protection law;
• any Integration the Customer enabled, and any Third-Party Service's access to or use, storage or disclosure of Customer Data;
• misuse of the Service by the Customer's Users.

We will notify the Customer promptly of any such claim and give reasonable cooperation, at the Customer's expense.

These Terms apply from when the Customer first uses the Service until they are ended. Either party may end them for convenience with 30 days' written notice, or immediately if the other party materially breaches them and does not fix the breach within 14 days of notice.

We may suspend access immediately, in whole or in part, including any Integration, if needed to prevent a security incident, unlawful use or serious harm to the Service or others. We will restore access once the issue is resolved.

After termination, the Customer may request an export of its Customer Data for 30 days. We will then delete Customer Data within 90 days, except where the law requires us to keep it. Unpaid fees and the sections on Customer Data, confidentiality, disclaimers, limitation of liability, indemnity and governing law survive termination.

We may update these Terms. We will give Customer administrators at least 30 days' notice of material changes. Continued use of the Service after changes take effect means the Customer accepts them. If the Customer does not agree, it may end these Terms before the changes take effect.

• Governing law. These Terms are governed by the laws of Kenya. The parties will first try in good faith to settle any dispute by negotiation. Failing that, the courts of Kenya have exclusive jurisdiction.
• Entire agreement. These Terms, together with any order form or data processing agreement, are the entire agreement between the parties about the Service.
• Assignment. Neither party may assign these Terms without the other's consent, except to a successor in a merger, acquisition or sale of substantially all of its relevant business.
• Force majeure. Neither party is liable for delays caused by events beyond its reasonable control, such as outages of internet or hosting providers.
• Severability and waiver. If any provision is unenforceable, the rest remains in effect. Failing to enforce a provision is not a waiver of it.
• Notices. Notices to us go to legal@brieflylog.app. Notices to the Customer go to the email address of its permanent administrators.