Articles of Association

The Services are offered to natural persons aged eighteen (18) or over, and to organisations that are either (a) registered in the United Kingdom or (b) lawfully entitled to engage in commerce within the United Kingdom. By creating an account, the Customer warrants that they meet these conditions and have the authority to bind the organisation, where relevant, to these articles.

The Customer shall maintain one (1) account per business or person, with accurate and current contact details. The Customer is responsible for the security of their account credentials and for all activity carried out under their account. The Company will never ask the Customer for their password.

The Customer pays a recurring subscription fee (the “Subscription”) for the Services, billed monthly or annually in advance, at the rates published on the pricing page. The Company may revise its rates with thirty (30) days' notice; existing Customers retain their original rate for the duration of any active Subscription.

• Build packs are charged at point of order and are non-refundable once generation begins.
• Site rescue is charged per page surveyed, billed before the modernise stage commences.
• Founder offer rates, where applied, are honoured for twelve (12) months from sign-up.

The Customer may cancel the Subscription at any time through the Customer's account settings (a two-click cancellation flow). The Services continue until the end of the paid-for period; no partial-month refunds are offered, save where the Company is unable to deliver the Services for reasons within its reasonable control. Upon cancellation, the Company will deliver, within fourteen (14) days, a static archive of the Customer's site sufficient for self-hosting elsewhere.

The Company reserves the right to suspend access to the Services in the event of (a) non-payment of fees fourteen (14) days past due, (b) breach of Article IV on acceptable use, or (c) suspected unauthorised account access. Suspension is communicated to the Customer at the time of action; the Customer is given a reasonable opportunity to remedy the cause before any further action is taken.

In the course of providing the Services, the Company processes the following categories of personal data:

• Account data — name, email, business name, billing address.
• Payment data — handled by the Company's payment processor; the Company does not store card numbers.
• Site content — content the Customer chooses to publish on their site, including any personal data the Customer includes (testimonials, contact details, photographs).
• Usage analytics — how our marketing pages and the studio are used. Marketing uses privacy-first, cookieless analytics (aggregate only, identifying no individual) and, with consent, Google Analytics; within the studio we use product analytics linked to the account to improve the Services.

Personal data is processed (a) to provide the Services contracted for; (b) to bill the Customer; (c) to provide support; and (d) to improve the Services through usage and product analytics. The Company does not sell personal data to any third party, nor does it engage in advertising-related profiling or targeting.

The Company engages a small number of third-party processors (“Subprocessors”) to deliver the Services — primarily for hosting infrastructure, payment processing, transactional email, and analytics. The Company maintains a list of current Subprocessors on request and notifies active Customers of any addition or change to that list within thirty (30) days. All Subprocessors are bound by data-processing agreements consistent with these articles.

Under the UK General Data Protection Regulation, the Customer has the right to (a) access their personal data, (b) request its correction, (c) request its erasure, (d) request its export in a portable format, (e) object to certain processing, and (f) lodge a complaint with the Information Commissioner's Office. Requests under this section are handled within thirty (30) days at no charge; reach the Company at privacy@themesmith.ai.

Personal data is retained for the duration of the active Subscription plus six (6) months thereafter, after which it is purged from active systems and from backups within a further ninety (90) days. Aggregate, anonymised analytics may be retained indefinitely for the purpose of product improvement; account-linked analytics are deleted in line with the periods above.

The primary processing region for personal data is the United Kingdom. Where Subprocessors operate outside the UK, transfers are made under the UK International Data Transfer Agreement or under an applicable adequacy decision. The current list of regions for each Subprocessor is available on request.

The Company sets a small number of cookies that are strictly necessary for the Services to function — for authentication, session management, and shopping-basket persistence on commerce-enabled sites. A single further cookie remembers the visitor's analytics choice (§ 3.02) so they are not asked repeatedly; being a record of a consent decision, it too is essential and exempt from consent. These cookies cannot be refused without impairing the Services.

To understand how its pages are used, the Company runs two layers of analytics — neither used for advertising, neither ever sold:

• Cookieless analytics that set no cookies and identify no individual. These run for every visitor and need no consent.
• Google Analytics, which does set cookies. In the United Kingdom and the European Economic Area it is switched off by default and runs only if the visitor consents through the on-page notice; advertising and ad-personalisation signals are disabled in every case.

Within the studio, the Company uses product analytics linked to the Customer's account to learn which features help and where customers get stuck. This respects the same analytics choice.

The Company embeds no advertising trackers, no social-media pixels, and no cross-site or ad-profiling technologies on its marketing pages or on any Customer site by default. Where a Customer wishes to embed such trackers on their own site, that is the Customer's prerogative, and the Customer assumes responsibility for the consent flow under applicable law.

Visitors in the United Kingdom and the European Economic Area are asked for their analytics choice through an on-page notice, and may change or withdraw it at any time using the Cookie preferences control shown on every page; the choice is remembered for twelve (12) months. Independently, every major browser allows cookies to be refused, deleted, or blocked — refusing strictly necessary cookies will impair the Services, while refusing analytics will not.

The Services are intended for the building, hosting, and tending of lawful business websites — promotional sites, commerce sites, journals, portfolio sites, booking-and-enquiry sites, and so on. The Customer may use the Services for any purpose consistent with applicable law and these articles.

The Customer shall not use the Services to publish, transmit, or facilitate content that is:

• illegal under United Kingdom law, or under the laws of any jurisdiction the content is targeted at;
• infringing of any third party's intellectual property rights;
• defamatory, harassing, or threatening to any natural or legal person;
• deceptive or fraudulent in nature, including phishing, scam, or impostor sites;
• used to distribute malware, mine cryptocurrency without consent, or harm the systems of others.

Reports of abuse may be sent to abuse@themesmith.ai. The Company aims to acknowledge reports within one (1) working day and to action them within five (5) working days where the alleged content is confirmed to breach this Article.

The Company endeavours to maintain Service availability of not less than 99.9% per calendar month, measured outside of scheduled maintenance windows. Where availability falls below this threshold for reasons within the Company's reasonable control, affected Customers will receive a credit equal to the Service fees attributable to the affected period, applied to the next billing cycle.

Save in respect of (a) death or personal injury caused by negligence, (b) fraud or fraudulent misrepresentation, or (c) any other liability that cannot be limited under applicable law, the Company's aggregate liability arising under or in connection with these articles shall not exceed the total fees paid by the Customer to the Company in the twelve (12) months preceding the event giving rise to the claim.

The Customer agrees to indemnify the Company against any third-party claim arising from the Customer's breach of these articles, including but not limited to claims arising from content the Customer publishes through the Services. The Company likewise indemnifies the Customeragainst third-party claims arising from the Company's gross negligence in the provision of the Services.

These articles are governed by, and construed in accordance with, the laws of England and Wales.

The parties shall first attempt to resolve any dispute arising under these articles by good-faith negotiation. Where negotiation fails to produce a resolution within thirty (30) days, the dispute shall be referred to the exclusive jurisdiction of the courts of England and Wales. Nothing in this section limits a party's right to seek injunctive relief in respect of urgent matters.