KIST / LEGAL

Terms of service

Last updated 26 September 2026

1. Who these terms are between

These terms are between Grapeworks Ltd, company number SC782424, registered office Studio One, 89 Middlesex Street, Glasgow, G41 1EE, and the business that signs up for Kist. Where an agency buys Kist to serve its own clients, the agency is the customer under these terms, and its client relationships are the agency’s own.

Data protection sits in a separate data processing agreement, and that agreement takes precedence over these terms on anything to do with personal data.

2. What Kist is

Kist takes the marketing and business data a company already has, spread across advertising platforms, analytics, search, a CRM and an accounting system, puts it in one place, and produces analysis a person can act on.

It is an internal tool made available to businesses that want the same thing. Access is per account, on credentials we issue.

3. What Kist is not

Worth stating plainly, because these are the assumptions that cause arguments later.

• It is not a replacement for your own record-keeping. It reads from your platforms; it is not the system of record for anything.
• It is not advice. Kist produces recommendations. Whether to act on one is a commercial decision that stays with you.
• It is not a guarantee of a result. We can work through the data faster than a person can and surface things a person would miss. Nobody can promise what your market does next.
• It is not an audit or an assurance service, and nothing it produces is a regulated opinion.

4. Your account

You are responsible for who you give access to and for what they do with it. Tell us promptly if an account is compromised.

You must not attempt to circumvent the isolation between accounts, probe the service for vulnerabilities without our written agreement, resell access unless we have signed a separate reseller agreement with you, or use the service to process data you have no lawful basis to process.

We may suspend an account immediately where continuing would breach the law or put other customers’ data at risk. For anything short of that, we will tell you what the problem is and give you a reasonable chance to fix it before we suspend anything.

5. Fees

Charges, billing period and notice are set in your order form or engagement letter, which sits alongside these terms. Fees are exclusive of VAT. Where a charge depends on usage, the measure is stated in the order form rather than here.

Price changes take effect at the next renewal and are notified in advance.

6. Connecting your data

You give us access to your platforms, or your client’s, using credentials you delegate. You confirm that you are entitled to do that.

Where you are an agency connecting a client’s data, you confirm three things, and they are the precondition of us being lawfully engaged at all: that you hold a compliant data processing agreement with that client, that the client has authorised sub-processing, and that our data processing agreement with you is signed before the first connection.

No client data moves before that agreement is signed. The connector step is the gate.

You can disconnect a source at any time. We return or delete the data within thirty days and confirm in writing.

7. What we owe you on the service

We will run the service with reasonable skill and care, keep the security measures described in the privacy policy and the data processing agreement, give you thirty days notice before we add or replace a sub-processor, and tell you about planned maintenance that will interrupt the service.

We do not commit to an uptime percentage. When something goes wrong we tell you what happened, what it affected and when it was fixed.

8. Intellectual property

Your data stays yours. We claim no ownership of anything you connect or upload.

Kist, its software, models, and the analysis logic stay ours. You get a non-exclusive, non-transferable right to use the service for the term.

Reports and outputs Kist produces for you are yours to use in your business and with your clients.

We may use aggregated, anonymised information about how the service is used to improve it. This never includes your client data and never produces a figure attributable to you or your clients.

9. Warranties

We provide the service as described in these terms and run it with reasonable skill and care.

Kist produces recommendations from third-party data we do not control. Beyond what this section says, we do not warrant that any analysis is correct, complete or fit for a particular decision.

10. Liability

Our total liability to you under these terms is capped at the fees you paid us in the twelve months before the claim. We are not liable for indirect or consequential loss, or for lost profit or savings arising from a commercial decision you took on the back of an analysis. Nothing here limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be limited.

11. Indemnities

You indemnify us where you connected data you had no right to connect, or instructed us to do something that breached data protection law after we told you it would.

We indemnify you where we breach our own obligations of confidentiality or security.

12. Term and ending it

The term is set in your order form. Either side can end it for material breach that is not fixed within thirty days of written notice, or immediately on insolvency.

On termination your access stops, and we return or delete your data within thirty days and confirm in writing.

Sections that should outlive the contract do: confidentiality, the data protection obligations, intellectual property, and sections 9 to 11.

13. Confidentiality

Each side keeps the other’s confidential information confidential and uses it only for the contract. This does not cover information that is already public, was already known without obligation, or has to be disclosed by law.

14. Audit

You may audit our compliance with the data processing agreement once in any twelve-month period, on thirty days written notice, at your cost, and without disrupting other customers. Shorter notice applies where there has been a breach or a regulator asks. We may answer with a recent third-party report or a completed security questionnaire where that genuinely covers the question.

15. Changes to these terms

We will give reasonable notice of a change and will not make a material change mid-term without telling you. If a change materially disadvantages you, you can end the contract at that point without penalty.

16. General

Neither side may assign without the other’s consent, except to a successor of the whole business.

No third party has rights under these terms. Nobody other than you and Grapeworks can enforce them, including under the Contract (Third Party Rights) (Scotland) Act 2017. In the reseller chain, an agency’s client is not a beneficiary of this contract and takes its rights against the agency.

Force majeure applies to events genuinely outside a party’s control, and does not cover a failure to pay.

Notices go to euan@grapeworks.ai and to the address on your order form.

17. Governing law

Scots law, exclusive jurisdiction of the Scottish courts.