Terms of service

3.1Account

“Account” means the account created by a Customer or User to access and use the Services, including associated authentication credentials, settings, permissions and configuration information.

3.2Authorised User

“Authorised User” means an individual who has been authorised by a Customer to access and use the Services under the Customer's account or workspace.

Authorised Users may include:

• employees;
• contractors;
• managers;
• administrators;
• HR personnel;
• finance personnel;
• other representatives authorised by the Customer.

The Customer remains responsible for all activity performed by Authorised Users.

3.3Customer

“Customer” means the individual, organisation, business, employer or other entity that:

• creates an Account;
• accesses the Services;
• purchases a subscription;
• enters into an Order Form; or
• otherwise uses PaperThread.

Where a Customer acts on behalf of an organisation, the Customer represents that it has authority to bind that organisation.

3.4Customer Data

“Customer Data” means any data, information, content or materials submitted, uploaded, connected, transmitted, generated or otherwise made available to PaperThread by or on behalf of a Customer or Authorised User through use of the Services.

Customer Data may include:

• employee information;
• HR information;
• payroll-related information;
• documents;
• policies;
• workflow information;
• approval records;
• requests;
• communications;
• system data;
• Thread information.

3.5Customer Personal Data

“Customer Personal Data” means Personal Data contained within Customer Data that PaperThread processes on behalf of a Customer in providing the Services.

For Customer Personal Data:

• the Customer acts as controller;
• PaperThread acts as processor.

3.6Personal Data

“Personal Data” means any information relating to an identified or identifiable individual, as defined under applicable data protection laws.

3.7Applicable Data Protection Laws

“Applicable Data Protection Laws” means all privacy and data protection laws applicable to the processing of Personal Data under these Terms, including where relevant:

• UK GDPR;
• Data Protection Act 2018;
• EU GDPR;
• applicable local privacy laws in jurisdictions where the Services are used.

3.8Services

“Services” means the PaperThread software platform and related functionality, including:

• AI-powered PeopleOps capabilities;
• workflows;
• automation features;
• integrations;
• connectors;
• dashboards;
• Threads;
• documentation;
• support services;
• related features made available by PaperThread.

3.9Workspace

“Workspace” means the Customer environment within PaperThread where Customer Data, Users, permissions, configurations, workflows and integrations are managed.

3.10Thread

“Thread” means the record created within PaperThread that captures relevant activity associated with work performed through the Services, including where applicable:

• questions asked;
• information retrieved;
• evidence considered;
• approvals;
• decisions;
• actions;
• workflow history;
• timestamps.

3.11AI Output

“AI Output” means any information, response, recommendation, classification, summary, draft, suggestion, workflow recommendation or other generated content produced by PaperThread's AI functionality.

AI Output may require human review and verification before reliance or action.

3.12Automated Action

“Automated Action” means any action performed by PaperThread automatically or semi-automatically based on:

• Customer configuration;
• permissions;
• workflow rules;
• approved instructions;
• connected system capabilities.

Automated Actions do not include decisions independently made by PaperThread outside Customer-authorised settings.

3.13Customer Configuration

“Customer Configuration” means settings, permissions, workflow rules, approval requirements, integrations, instructions and other choices configured by or on behalf of a Customer.

The Customer remains responsible for ensuring Customer Configuration is appropriate.

3.14Connected Systems

“Connected Systems” means third-party platforms, applications, software, databases or services connected to PaperThread by or on behalf of a Customer.

Connected Systems may include:

• HR systems;
• payroll systems;
• applicant tracking systems;
• communication platforms;
• document systems;
• other workplace tools.

3.15Integrations

“Integrations” means connectors, APIs, authentication mechanisms, data connections or technical methods used to connect PaperThread with Connected Systems.

3.16Third-Party Services

“Third-Party Services” means services, software, infrastructure, APIs, models or platforms provided by third parties and used in connection with the Services.

Examples may include:

• cloud infrastructure providers;
• AI providers;
• payment providers;
• authentication providers;
• integration providers.

3.17AI Systems

“AI Systems” means artificial intelligence technologies used by PaperThread to provide functionality including:

• information retrieval;
• classification;
• summarisation;
• drafting;
• workflow assistance;
• action preparation.

3.18Sensitive Information

“Sensitive Information” means information requiring additional protection due to its nature, including where applicable:

• HR confidential information;
• payroll information;
• compensation information;
• employee relations information;
• wellbeing-related information;
• other confidential workplace information.

3.19Confidential Information

“Confidential Information” means information disclosed by one party to the other that:

• is marked confidential;
• should reasonably be understood to be confidential given its nature; or
• relates to business, technical, financial or operational information.

3.20Documentation

“Documentation” means any user guides, technical materials, instructions, descriptions or support materials provided by PaperThread relating to the Services.

3.21Fees

“Fees” means amounts payable by Customer for access to and use of the Services, including subscription charges, usage charges or other agreed charges.

3.22Subscription Term

“Subscription Term” means the period during which Customer is authorised to access and use paid Services.

3.23Usage Data

“Usage Data” means technical information relating to use of the Services, including:

• performance information;
• feature usage;
• operational metrics;
• security information;
• system logs.

Usage Data does not include Customer Data that identifies individual employees unless processed as part of providing the Services.

3.24Aggregated Data

“Aggregated Data” means information derived from operation of the Services that has been combined, anonymised or de-identified so that it does not identify Customer, Users or individuals.

3.25Security Incident

“Security Incident” means an event involving unauthorised access, disclosure, alteration, loss or destruction of Customer Data.

3.26Intellectual Property Rights

“Intellectual Property Rights” means all rights in intellectual property, including:

• copyrights;
• trademarks;
• patents;
• trade secrets;
• know-how;
• database rights;
• software rights;
• design rights;
• other proprietary rights.

3.27Business Day

“Business Day” means a day other than Saturday, Sunday or public holiday in England when banks are generally open for business.

12.1Unlawful or unauthorised use

• use PaperThread in breach of applicable laws or regulations;
• use PaperThread for any unlawful, fraudulent, deceptive or harmful purpose;
• access or process information without appropriate authority;
• connect systems, accounts or data sources without permission from the relevant owner;
• use PaperThread to process personal data where the Customer does not have an appropriate legal basis or required permissions;
• use PaperThread to create employment decisions or recommendations intended to circumvent applicable employment laws or required human review;
• use PaperThread to discover or gain access to the source code for the software underlying the Services or reverse engineer, decode, modify, decrypt, extract, disassemble or decompile such software (including in order to (1) build a competitive product or service; (2) build a product using similar ideas, features, functions or graphics of the Services; or (3) copy any ideas, features, functions or graphics of the Services).

12.2Employee surveillance and prohibited monitoring

Customers must not use PaperThread to:

• conduct covert employee surveillance;
• monitor employees without appropriate notice, transparency or lawful basis;
• infer employee emotions, mental health conditions or personal characteristics;
• monitor employees based solely on communication activity, message tone or behavioural signals;
• create employee rankings, scores or classifications intended to measure employee worth, loyalty or value.

12.3Employment decision restrictions

Customers must not use PaperThread as the sole basis for:

• hiring decisions;
• candidate rejection decisions;
• termination decisions;
• redundancy decisions;
• promotion decisions;
• compensation decisions;
• disciplinary decisions;
• legal employment decisions.

Customers remain responsible for ensuring appropriate human review and compliance with applicable employment laws.

12.4Security and access restrictions

Customers and Users must not:

• attempt to gain unauthorised access to PaperThread or connected systems;
• bypass authentication, permissions or security controls;
• attempt to access another Customer's workspace or data;
• share credentials between unauthorised Users;
• upload credentials, private keys, access tokens or secrets into inappropriate fields;
• attempt to extract system prompts, security configurations or confidential platform information;
• interfere with security monitoring or logging.

12.5Malicious activity

Customers and Users must not:

• introduce malware, viruses, malicious code or harmful content;
• attempt to disrupt, overload or degrade the Services;
• perform penetration testing, vulnerability testing or security assessments without written approval;
• scrape, copy or systematically extract data from the Services except through authorised functionality;
• reverse engineer, decompile or attempt to discover source code or underlying models.

12.6AI misuse

Customers and Users must not:

• intentionally submit misleading information to manipulate AI outputs;
• use AI outputs without appropriate review where review is reasonably required;
• represent AI-generated content as guaranteed factual, legal or professional advice;
• configure workflows that intentionally bypass required approval controls;
• use PaperThread to automate actions beyond the authority granted by the Customer.

Customers acknowledge that AI systems may produce inaccurate or unexpected outputs and remain responsible for determining appropriate oversight.

12.7Data restrictions

Customers must not upload, connect or process:

• data they are not authorised to process;
• unlawfully obtained personal information;
• malicious files;
• information that violates third-party rights;
• confidential information belonging to another party without permission.

Customers remain responsible for ensuring that connected systems and data sources are appropriately authorised.

12.8Third-party systems

Customers must not:

• connect third-party systems without appropriate authority;
• misuse third-party APIs;
• violate third-party provider terms;
• attempt to circumvent limitations imposed by connected platforms.

Customers acknowledge that PaperThread depends on third-party systems and that functionality may vary based on permissions and API capabilities.

12.9Competitive misuse

Customers and Users must not:

• access PaperThread to build a competing product;
• copy PaperThread workflows, designs, documentation or functionality;
• use the Services for benchmarking intended to create competitive intelligence without consent;
• disclose confidential PaperThread information.

12.10Abuse prevention

PaperThread may restrict, suspend or terminate access where it reasonably believes:

• the Services are being misused;
• security is at risk;
• Customer Data is being accessed unlawfully;
• the Customer breaches these Terms;
• continued access could harm PaperThread, other customers or third parties.

12.11Customer responsibility

Customers remain responsible for:

• User activity within their workspace;
• configuration choices;
• workflow approvals;
• connected-system permissions;
• decisions made using information generated through PaperThread.

13.1Ownership of PaperThread Services

PaperThread and its licensors own and retain all right, title and interest in and to:

• the PaperThread platform;
• software;
• source code;
• object code;
• AI systems;
• models;
• workflows;
• interfaces;
• designs;
• architecture;
• documentation;
• methodologies;
• processes;
• trademarks;
• trade names;
• logos;
• improvements;
• enhancements;
• derivative works;
• all related intellectual property rights.

Except for the limited rights expressly granted under these Terms, no rights, title or ownership interest in the Services are transferred to the Customer.

13.2Customer Access Rights

Subject to Customer compliance with these Terms and payment of applicable fees, PaperThread grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right during the applicable subscription period to:

• access and use the Services;
• permit authorised Users to access the Services;
• use available documentation and functionality solely for Customer's internal business purposes.

The Customer may not use the Services for any purpose outside the scope expressly permitted by these Terms.

13.3Customer Data Ownership

The Customer retains all ownership rights, title and interest in and to Customer Data. Subject to applicable law and third-party rights, Customer may use AI Outputs generated through authorised use of the Services for its internal business purposes. Customer acknowledges that AI Outputs may not be unique and PaperThread does not guarantee that AI Outputs will not be similar to outputs generated for other customers or users.

Nothing in these Terms transfers ownership of Customer Data to PaperThread.

Customer grants PaperThread a limited, worldwide, non-exclusive licence to access, process, store, transmit and otherwise use Customer Data only to the extent necessary to:

• provide the Services;
• maintain and support the Services;
• secure the Services;
• prevent misuse;
• comply with legal obligations;
• perform obligations under these Terms.

13.4Customer Responsibility for Data Rights

Customer represents and warrants that it:

• owns or has sufficient rights to provide Customer Data;
• has obtained all necessary permissions, consents and authorisations;
• has lawful authority to connect third-party systems;
• has lawful authority to instruct PaperThread to process Customer Data.

Customer remains solely responsible for the legality, accuracy and appropriateness of Customer Data.

13.5Feedback and Suggestions

If Customer provides suggestions, ideas, recommendations, feature requests or other feedback relating to PaperThread, Customer grants PaperThread a worldwide, perpetual, irrevocable, royalty-free right to use, modify and incorporate that feedback into the Services.

PaperThread has no obligation to use, implement or compensate Customer for feedback.

13.6Aggregated and De-identified Data

PaperThread may create and use aggregated, anonymised or de-identified information derived from the operation of the Services, provided that such information:

• does not identify Customer;
• does not identify individual employees or Users;
• does not reveal Customer confidential information.

PaperThread may use such information for:

• analytics;
• service improvement;
• security;
• operational optimisation;
• benchmarking;
• research and development.

13.7Restrictions on Use

Customer must not, and must not permit any third party to:

• copy, modify or create derivative works of the Services;
• reverse engineer, decompile or attempt to extract source code;
• attempt to discover underlying models, algorithms or architecture;
• remove proprietary notices;
• access the Services to build a competing product;
• use PaperThread intellectual property outside the authorised purpose.

13.8Third-Party Intellectual Property

The Services may include third-party software, integrations, APIs, models or technology.

Such third-party components remain owned by their respective providers and may be subject to additional terms.

PaperThread does not grant ownership rights to third-party services.

13.9Reservation of Rights

All rights not expressly granted under these Terms are reserved by PaperThread and its licensors.

15.1Security Commitment

PaperThread maintains technical and organisational measures designed to protect Customer Data against unauthorised access, disclosure, alteration, loss or destruction.

Security measures may include:

• access controls;
• authentication controls;
• permission management;
• encryption;
• monitoring;
• logging;
• vulnerability management;
• backup processes;
• incident response procedures;
• employee confidentiality obligations.

15.2Customer Security Responsibilities

Customer is responsible for:

• maintaining secure account credentials;
• enabling appropriate user permissions;
• restricting access to authorised Users;
• ensuring Users protect login information;
• configuring integrations appropriately;
• maintaining security of connected systems.

PaperThread is not responsible for security failures caused by Customer actions, Customer negligence or unauthorised access resulting from Customer-controlled systems.

PaperThread is not responsible for security failures resulting from Customer failure to implement reasonable security practices.

15.3Security Does Not Guarantee Absolute Protection

Customer acknowledges that:

• no software system can guarantee absolute security;
• internet-based services involve inherent risks;
• security controls reduce risk but cannot eliminate all possible threats.

PaperThread does not warrant that the Services will be immune from:

• cyber attacks;
• unauthorised access attempts;
• malware;
• vulnerabilities;
• service interruptions.

15.4Service Availability

PaperThread targets a monthly availability level of 95% uptime for the core Services.

Availability calculations exclude:

• scheduled maintenance;
• emergency maintenance;
• Customer configuration issues;
• Customer systems;
• third-party platform failures;
• API failures;
• internet service provider failures;
• events outside PaperThread's reasonable control.

Service availability commitments are targets only unless expressly agreed otherwise in a separate written service level agreement signed by PaperThread.

15.5Maintenance and Changes

PaperThread may:

• update the Services;
• modify features;
• improve functionality;
• release security updates;
• change technical architecture.

PaperThread may perform maintenance that temporarily affects availability.

Where reasonably practical, PaperThread will provide advance notice of planned maintenance.

15.6Third-Party Infrastructure

Customer acknowledges that PaperThread relies on third-party providers, including:

• cloud infrastructure providers;
• AI providers;
• integration providers;
• authentication providers;
• payment providers.

PaperThread is not responsible for failures, outages, changes or limitations caused by third-party providers.

15.7AI System Limitations

Customer acknowledges that AI functionality:

• may produce inaccurate outputs;
• may require human review;
• may not identify every relevant factor;
• may interpret information incorrectly.

Customer remains responsible for reviewing outputs before relying on them for material decisions.

15.8Data Backup and Recovery

PaperThread maintains backup processes designed to support service continuity and recovery. However:

• backup availability does not guarantee recovery of every individual data element;
• recovery times may vary depending on circumstances;
• Customer remains responsible for maintaining appropriate copies where required.

15.9Security Incidents

If PaperThread becomes aware of a security incident affecting Customer Data, PaperThread will:

• investigate the incident;
• take reasonable mitigation steps;
• provide notifications where required by applicable law.

PaperThread is not responsible for incidents caused by:

• Customer misuse;
• compromised Customer credentials;
• Customer-controlled systems;
• third-party systems outside PaperThread's control.

17.1Limited Service Warranty

PaperThread warrants that:

• it will provide the Services substantially as described in the applicable documentation;
• it will perform its obligations with reasonable care and skill;
• it will comply with governing laws in England and Wales that are directly applicable to PaperThread's provision of the Services.

17.2Customer Acknowledgement of Software Limitations

Customer acknowledges that:

• software may contain defects;
• AI-generated outputs may contain errors;
• integrations may change;
• third-party systems may fail;
• Services may evolve over time.

PaperThread does not warrant that the Services will be:

• completely error-free;
• uninterrupted;
• permanently available;
• compatible with every third-party system;
• suitable for every Customer use case.

17.3AI Output Disclaimer

Customer acknowledges that PaperThread uses artificial intelligence technologies.

AI outputs may:

• contain inaccuracies;
• omit relevant information;
• require interpretation;
• require human review.

Customer remains responsible for:

• evaluating outputs;
• making decisions;
• obtaining professional advice where appropriate;
• ensuring compliance with applicable laws.

17.4No Professional Advice

PaperThread does not provide:

• legal advice;
• employment advice;
• tax advice;
• immigration advice;
• payroll advice;
• medical advice;
• financial advice.

Any information provided through PaperThread should not be treated as a substitute for professional advice.

17.5No Guarantee of Business Outcomes

PaperThread does not guarantee:

• cost savings;
• productivity improvements;
• compliance outcomes;
• payroll accuracy;
• employee satisfaction;
• reduction of HR workload;
• successful completion of business objectives.

Results depend on:

• Customer configuration;
• data quality;
• User behaviour;
• connected systems;
• workflows enabled by Customer.

17.6Disclaimer of Certain Warranties

To the maximum extent permitted by law, PaperThread disclaims all warranties not expressly stated in these Terms, including implied warranties of:

• merchantability;
• fitness for a particular purpose;
• non-infringement;
• uninterrupted availability.

17.7Beta and Preview Features

Any beta, preview or experimental functionality:

• may contain errors;
• may change;
• may be withdrawn;
• may not operate as expected.

Beta features are provided without additional warranties unless expressly stated.

17.8Customer Acceptance of AI Automation

By enabling AI-powered workflows and automation, Customer acknowledges that:

• automation involves judgement regarding appropriate configuration;
• Customer determines the authority granted to PaperThread;
• Customer remains responsible for oversight and governance of automated processes.

18.1Liability Principles

To the maximum extent permitted by applicable law, the parties acknowledge that the allocation of risk set out in these Terms reflects the nature of the Services, the subscription fees payable, the use of third-party technologies, and the limitations inherent in AI-powered software.

PaperThread's liability is limited as expressly set out in this Clause 18.

18.2Liability Cap

Subject to the exclusions and exceptions in these Terms, PaperThread's total aggregate liability arising out of or relating to these Terms, the Services, or the relationship between the parties shall not exceed the lesser of:

• (a) £100; or
• (b) 50% of the fees actually paid by the Customer to PaperThread during the 12 months immediately preceding the event giving rise to the claim.

Where the Customer has used the Services for less than 12 months, the maximum liability shall be calculated based on fees paid during that shorter period. Customer acknowledges that the fees reflect the allocation of risk between the parties.

18.3Multiple Claims

Multiple claims arising from the same event or series of connected events shall be treated as one claim for the purposes of calculating PaperThread's liability cap.

18.4Exclusion of Indirect and Consequential Loss

To the maximum extent permitted by law, PaperThread shall not be liable for any:

• indirect losses;
• consequential losses;
• special losses;
• exemplary losses;
• punitive damages;
• loss of profits;
• loss of revenue;
• loss of anticipated savings;
• loss of business opportunity;
• loss of goodwill;
• loss of reputation;
• loss of contracts;
• loss arising from business interruption.

18.5Loss of Data

PaperThread shall not be liable for loss, corruption or alteration of Customer Data except where directly caused by PaperThread's breach of its express obligations under these Terms.

PaperThread shall not be liable for:

• Customer deletion of data;
• Customer configuration errors;
• failures of connected systems;
• third-party service failures;
• Customer failure to maintain appropriate backups or records where required.

18.6AI-Specific Liability Limitations

Customer acknowledges that PaperThread uses artificial intelligence technologies that may produce:

• inaccurate outputs;
• incomplete responses;
• incorrect classifications;
• unexpected recommendations;
• unsuitable workflow suggestions.

Customer remains responsible for:

• reviewing outputs;
• approving sensitive actions;
• determining appropriate automation levels;
• ensuring compliance with applicable laws.

PaperThread shall not be liable for losses arising solely from Customer reliance on AI-generated outputs without appropriate review.

18.7Customer Configuration Liability

Customer acknowledges that PaperThread operates according to:

• Customer permissions;
• workflow settings;
• integrations;
• approval rules;
• instructions provided by authorised Users.

PaperThread shall not be liable for actions performed in accordance with Customer-configured settings or authorised workflows.

18.8Third-Party Services Liability

PaperThread relies on third-party services including:

• cloud infrastructure providers;
• AI providers;
• authentication providers;
• payment providers;
• integration providers.

PaperThread shall not be liable for:

• third-party outages;
• API failures;
• changes to third-party functionality;
• third-party security incidents;
• third-party data processing practices.

18.9Security Incident Liability

PaperThread maintains security measures designed to protect Customer Data. However, Customer acknowledges that no technology system can guarantee absolute security.

PaperThread shall not be liable for security incidents caused by:

• Customer negligence;
• compromised Customer credentials;
• unauthorised Customer access;
• Customer systems;
• third-party systems outside PaperThread's control.

18.10Employment, Payroll and Professional Decisions

Customer acknowledges that PaperThread is not responsible for decisions made by Customer relating to:

• employees;
• contractors;
• candidates;
• payroll;
• compensation;
• disciplinary matters;
• employment actions;
• legal compliance.

PaperThread provides workflow support and information assistance, not professional judgement or decision-making authority.

18.11Customer Indemnity

Customer shall indemnify, defend and hold harmless PaperThread, its affiliates, officers, employees and contractors against claims, losses, liabilities and expenses arising from:

• Customer Data;
• Customer's unlawful processing activities;
• Customer's breach of applicable law;
• unauthorised use of the Services;
• unauthorised integrations;
• Customer-configured workflows;
• Customer decisions made using the Services.

18.12Intellectual Property Claims

If PaperThread provides any intellectual property indemnity, it shall be subject to:

• prompt written notice;
• PaperThread controlling the defence;
• Customer cooperation;
• no settlement imposing liability on PaperThread without consent.

18.13Exceptions to Liability Cap

Nothing in these Terms limits or excludes liability that cannot legally be limited, including:

• fraud;
• fraudulent misrepresentation;
• death or personal injury caused by negligence;
• any liability which applicable law prohibits from being excluded.

18.14Exclusive Remedy

To the maximum extent permitted by law, Customer's sole remedies for dissatisfaction with the Services are:

• requesting remediation under the issue resolution process;
• terminating future renewal;
• discontinuing use of the Services.

18.15Additional Liability Terms

No Reliance on Professional Advice. PaperThread provides software functionality, workflow assistance and AI-enabled outputs. PaperThread does not provide legal, tax, payroll, immigration, medical, employment or professional advice. Customers remain solely responsible for obtaining appropriate professional advice where required and for decisions made using information generated through the Services.

AI Output Disclaimer and Customer Verification. Customers acknowledge that AI-generated outputs may contain errors, omissions or inaccuracies. Customers must independently verify outputs before relying on them for operational, employment, payroll, financial, legal or compliance decisions. PaperThread shall not be responsible for losses arising from Customer reliance on unverified AI-generated information.

Customer Configuration and Permission Liability. Customers are responsible for configuring permissions, workflows, integrations, approval settings and automation rules within their workspace. PaperThread shall not be responsible for actions performed in accordance with Customer-configured permissions, instructions or workflow settings.

Third-Party Services Disclaimer. PaperThread relies on third-party providers, integrations, APIs and infrastructure providers. PaperThread is not responsible for failures, downtime, changes, inaccuracies or limitations caused by third-party services outside PaperThread's reasonable control.

Data Accuracy and Customer Inputs. Customers are responsible for ensuring that information provided to PaperThread, uploaded into the Services or accessed through connected systems is accurate, complete and lawful. PaperThread is not responsible for errors caused by inaccurate, incomplete or outdated Customer Data.

No Guarantee of Business Outcomes. PaperThread does not guarantee specific business outcomes, cost savings, compliance outcomes, payroll outcomes, employee outcomes or operational improvements from use of the Services.

Beta Features and Experimental Functionality. PaperThread may provide beta, preview or experimental features. Such features may contain errors, limitations or changes and are provided without warranties unless expressly stated otherwise.

Force Majeure. PaperThread shall not be liable for delays, failures or interruptions caused by events outside its reasonable control, including failures of telecommunications networks, internet infrastructure, cloud providers, third-party systems, acts of government, natural disasters, cyber incidents, labour disputes or other force majeure events.

Limitation of Indirect Damages. To the maximum extent permitted by law, PaperThread shall not be liable for indirect, incidental, special, consequential, exemplary or punitive damages, including loss of profits, revenue, business opportunity, goodwill, anticipated savings or data, arising from or relating to the Services.

Customer Indemnity. Customer shall indemnify and defend PaperThread against third-party claims arising from Customer Data, Customer's unlawful use of the Services, unauthorised integrations, breach of these Terms or violation of applicable laws.

Security Incident Limitation. PaperThread maintains security measures designed to protect Customer Data. However, no technology system can guarantee absolute security. PaperThread shall not be liable for security incidents caused by factors outside its reasonable control, including Customer negligence, compromised credentials, third-party systems or unauthorised Customer actions.

19.1General Indemnity Principles

Each party agrees to be responsible for claims, losses, damages, liabilities, costs and expenses arising from its own acts, omissions, breach of these Terms or violation of applicable laws.

The indemnities set out in this Clause 19 are subject to:

• the liability limitations in Clause 18;
• the procedures set out below;
• applicable law.

PaperThread may assume exclusive control of the defence of any indemnified claim. Customer must not settle any claim without PaperThread's prior written consent.

19.2Customer Indemnity

The Customer shall defend, indemnify and hold harmless PaperThread, its affiliates, officers, employees, contractors and representatives against any third-party claims, damages, liabilities, costs and expenses arising out of or relating to:

Customer Data:

• the Customer's collection, use or processing of Customer Data;
• allegations that Customer Data was collected or provided unlawfully;
• failure to obtain required employee, contractor, candidate or third-party notices, permissions or consents.

Customer Instructions and Configuration:

• Customer-configured workflows;
• Customer-defined automation rules;
• Customer approval settings;
• Customer permissions;
• instructions provided by authorised Users.

This includes claims arising where PaperThread performs actions in accordance with Customer-authorised configurations.

Connected Systems. Claims arising from:

• unauthorised connections;
• misuse of third-party integrations;
• incorrect permissions granted to connected systems;
• Customer failure to maintain appropriate access controls.

Customer Use of AI Outputs. Claims arising from Customer:

• relying on AI-generated outputs without appropriate review;
• using outputs for prohibited purposes;
• making employment, payroll, legal or compliance decisions without appropriate human judgement.

Customer Legal Compliance. Claims arising from Customer's failure to comply with:

• employment laws;
• privacy laws;
• payroll obligations;
• tax obligations;
• immigration requirements;
• sector-specific regulations.

19.3PaperThread Intellectual Property Indemnity

Subject to this Clause 19, PaperThread shall defend Customer against third-party claims alleging that the unmodified PaperThread Services infringe a third party's intellectual property rights. This indemnity is subject to the liability limitations in Clause 18.

This indemnity does not apply where the claim arises from:

• Customer Data;
• Customer instructions;
• Customer modifications;
• combinations with third-party products;
• use outside the permitted scope of the Services;
• third-party integrations;
• Customer breach of these Terms.

19.4IP Claim Remedies

If a claim under Clause 19.3 occurs or is likely to occur, PaperThread may, at its discretion:

1. obtain the right for Customer to continue using the affected Services;
2. modify or replace the affected functionality;
3. provide substantially equivalent functionality;
4. terminate the affected portion of the Services and provide a pro-rated refund for prepaid unused fees.

This is Customer's exclusive remedy for intellectual property infringement claims.

19.5Indemnification Procedure

A party seeking indemnification must:

• promptly notify the indemnifying party of the claim;
• provide reasonable details of the claim;
• provide reasonable cooperation;
• allow the indemnifying party to control the defence and settlement.

The indemnifying party must not settle any claim in a way that admits wrongdoing by the indemnified party, imposes obligations on the indemnified party, or restricts the indemnified party's rights, without prior written consent.

19.6Customer Cooperation

The Customer must provide reasonable assistance where PaperThread is defending a claim, including:

• relevant information;
• access to documents;
• cooperation from Users;
• technical details relating to Customer configurations.

19.7No Double Recovery

A party may not recover the same loss more than once under:

• an indemnity;
• a limitation of liability claim;
• another contractual remedy.

19.8Relationship With Liability Cap

Unless expressly stated otherwise:

• indemnity obligations are subject to the liability limitations in Clause 18;
• indemnities do not create unlimited liability;
• the parties' maximum exposure remains governed by Clause 18.

20.1Compliance With Data Protection Laws

PaperThread processes personal data in accordance with applicable data protection laws, including:

• the UK General Data Protection Regulation (UK GDPR);
• the Data Protection Act 2018;
• applicable European data protection laws where relevant.

PaperThread also aims to align its privacy practices with internationally recognised privacy principles, including applicable privacy requirements in jurisdictions where Customers operate.

20.2Roles of the Parties

The parties acknowledge that their roles depend on how PaperThread is used.

PaperThread as Controller. PaperThread acts as a controller where it processes personal data for its own purposes, including:

• operating the website;
• managing customer accounts;
• billing and subscription administration;
• providing customer support;
• maintaining security;
• preventing misuse;
• complying with legal obligations.

Customer as Controller. Where a Customer uses PaperThread to process information relating to individuals, including employees, contractors, candidates or other workplace users:

• the Customer determines the purposes and means of processing;
• the Customer decides what information is connected;
• the Customer controls User permissions;
• the Customer determines which workflows and automations are enabled.

The Customer acts as the controller of such information.

PaperThread as Processor. Where PaperThread processes personal data on behalf of a Customer, the Customer acts as controller and PaperThread acts as processor. PaperThread processes such data only:

• to provide the Services;
• according to Customer instructions;
• to maintain security;
• to support authorised workflows;
• to comply with applicable legal obligations.

20.3Customer Responsibilities

Customers are responsible for ensuring that:

• they have appropriate lawful grounds to process personal data;
• they provide required privacy notices to individuals;
• they have authority to connect systems and upload information;
• User permissions are appropriately configured;
• Customer Data is accurate and appropriately managed;
• their use of PaperThread complies with employment, privacy and other applicable laws.

PaperThread does not determine the Customer's employment, HR, payroll or regulatory obligations.

Customer acknowledges that AI functionality may process information to provide requested outputs and workflow assistance. Customers remain responsible for ensuring appropriate lawful conditions exist where sensitive or special category data is processed.

20.4Data Processing Addendum

Where PaperThread processes Customer Personal Data on behalf of a Customer, additional data processing terms may apply.

For enterprise Customers, PaperThread may enter into a Data Processing Addendum addressing matters including:

• processing instructions;
• categories of personal data;
• categories of individuals;
• security measures;
• subprocessors;
• international transfers;
• deletion or return of data;
• assistance with individual rights requests.

20.5Individual Privacy Rights

Individuals may have rights under applicable privacy laws, including:

• access to personal data;
• correction of inaccurate information;
• deletion of personal data where applicable;
• restriction or objection to certain processing;
• data portability where applicable;
• withdrawal of consent where processing relies on consent.

The availability of these rights depends on:

• the individual's location;
• the applicable law;
• whether PaperThread or a Customer acts as controller.

20.6Customer Workspace Requests

Where personal data is processed within a Customer workspace:

• the Customer is generally responsible for responding to individual privacy requests;
• PaperThread may direct individuals to the relevant Customer;
• PaperThread will provide reasonable assistance where required by applicable law.

20.7Sensitive and Confidential Information

Depending on Customer configuration, PaperThread may process sensitive or confidential workplace information, including:

• HR information;
• payroll-related information;
• employee relations information;
• workplace requests;
• policy acknowledgements;
• workflow and approval records.

Customers are responsible for ensuring appropriate access controls, permissions and lawful processing requirements are in place.

Following termination, PaperThread may delete Customer Data in accordance with applicable retention periods, Customer instructions and legal obligations.

20.8AI Processing and Privacy

PaperThread uses AI technologies to support:

• information retrieval;
• classification;
• summarisation;
• workflow preparation;
• routing;
• drafting;
• action preparation.

Customers determine the level of automation enabled through:

• permissions;
• workflow settings;
• integrations;
• approval rules.

PaperThread does not independently determine its own authority or expand the permissions granted by Customers.

AI outputs may contain errors or require review. Customers remain responsible for decisions made using information generated through the Services.

20.9International Data Transfers

PaperThread may use service providers operating across different jurisdictions.

Where required, PaperThread uses appropriate safeguards for international transfers, including recognised transfer mechanisms such as:

• adequacy decisions;
• contractual safeguards;
• other legally recognised transfer mechanisms.

20.10Privacy Contact and Complaints

Questions or concerns regarding privacy or personal data may be submitted to dpo@paperthread.ai.

PaperThread will review and respond to privacy requests and complaints in accordance with applicable law.

Individuals may also have the right to contact their relevant data protection authority.

20.11International Privacy Alignment

PaperThread is designed to support customers operating across multiple jurisdictions.

Where applicable, PaperThread considers relevant privacy requirements in regions where Customers operate, including applicable US privacy requirements.

However, Customers remain responsible for ensuring that their own use of PaperThread complies with the laws applicable to their organisation, employees and jurisdictions.

23.1Force Majeure Events

Neither party shall be liable for any failure, delay or interruption in performing its obligations under these Terms where such failure or delay results from events outside its reasonable control.

Such events may include:

• acts of government;
• changes in applicable laws or regulations;
• natural disasters;
• fire, flood, earthquake or other environmental events;
• war, terrorism, civil unrest or public emergencies;
• labour disputes;
• internet or telecommunications failures;
• cloud infrastructure failures;
• failures of hosting providers;
• failures of third-party service providers;
• cyber attacks or security incidents not caused by the affected party's breach of these Terms;
• other events beyond the reasonable control of the affected party.

23.2Effect of Force Majeure

Where a Force Majeure Event occurs:

• the affected party will use reasonable efforts to minimise the impact;
• performance obligations affected by the event will be suspended for the duration of the event;
• the affected party will resume performance as soon as reasonably practicable.

23.3Customer Payment Obligations

A Force Majeure Event does not relieve Customer of its obligation to pay Fees due under these Terms unless otherwise required by applicable law.

23.4Third-Party Dependencies

Customer acknowledges that PaperThread relies on third-party infrastructure, integrations and service providers.

PaperThread shall not be responsible for delays, interruptions or failures caused by third-party services outside PaperThread's reasonable control.

24.1Entire Agreement

These Terms, together with any applicable Order Form, Subscription details, Privacy Policy, and any applicable Data Processing Addendum, constitute the entire agreement between PaperThread and Customer relating to the Services.

These Terms supersede any previous discussions, communications, representations or agreements relating to the Services, whether written or oral.

24.2Order of Precedence

If there is any conflict between documents forming part of the agreement, the following order of priority applies:

1. Data Processing Addendum (for matters relating specifically to processing of Personal Data);
2. Order Form or subscription agreement;
3. these Terms of Service;
4. Documentation.

Any conflicting terms contained in Customer purchase orders or similar documents shall not apply unless expressly accepted in writing by PaperThread.

24.3Assignment

Customer may not assign, transfer, subcontract or otherwise dispose of any rights or obligations under these Terms without PaperThread's prior written consent.

PaperThread may assign or transfer these Terms without Customer consent in connection with:

• a merger;
• acquisition;
• corporate restructuring;
• sale of substantially all assets;
• transfer of the Services business.

24.4Amendments to These Terms

PaperThread may update these Terms from time to time where necessary to reflect:

• changes to the Services;
• legal or regulatory requirements;
• security requirements;
• operational changes;
• improvements to customer protections.

Where changes materially affect Customer rights or obligations, PaperThread will provide reasonable notice where practicable.

Continued use of the Services after the effective date of updated Terms constitutes acceptance of the updated Terms.

24.5Severability

If any provision of these Terms is determined to be invalid, unlawful or unenforceable:

• that provision shall be modified to the minimum extent necessary to make it enforceable;
• the remaining provisions shall continue in full force and effect.

The parties will work in good faith to replace any invalid provision with a valid provision that reflects the original commercial intent.

24.6Waiver

A failure or delay by either party to exercise any right or remedy under these Terms does not constitute a waiver of that right or remedy.

A waiver is only effective if provided in writing by the party granting it.

24.7Relationship Between the Parties

The parties are independent contractors.

Nothing in these Terms creates:

• a partnership;
• joint venture;
• agency relationship;
• employment relationship;
• fiduciary relationship.

Neither party has authority to bind the other party unless expressly agreed in writing.

24.8Third-Party Rights

Unless expressly stated otherwise, these Terms do not create rights enforceable by any third party.

No person other than PaperThread and Customer may enforce any provision of these Terms under the Contracts (Rights of Third Parties) Act 1999.

24.9Notices

Any formal legal notice relating to these Terms must be provided in writing.

Notices may be delivered by email, registered post or recognised courier service.

Notices should be sent to PaperThread Legal, email: legal@paperthread.ai.

Customer notices should be sent to the contact details associated with the Customer Account.

A notice sent by email shall be considered received when sent, provided no delivery failure notification is received.

24.10Survival

The following provisions survive termination or expiry of these Terms:

• Customer payment obligations;
• confidentiality obligations;
• intellectual property rights;
• data protection obligations;
• liability limitations;
• indemnities;
• disclaimers;
• restrictions on use;
• provisions intended by their nature to survive termination.

24.11Export and Sanctions Compliance

Customer shall comply with applicable export control, sanctions and trade compliance laws relating to use of the Services.

Customer shall not use the Services:

• in prohibited jurisdictions;
• for prohibited purposes;
• in violation of applicable sanctions restrictions.

24.12Publicity and Customer References

PaperThread may identify Customer as a customer and display Customer's name or logo only with Customer's consent.

Customer may opt out of publicity use by notifying PaperThread in writing within 7 days of starting their subscription.