Terms of service

Company: Consent Management Inc (“Inth,” “Company,” “we,” “us”), a Delaware corporation

Notice address: 2261 Market Street STE 86311, San Francisco, CA 94114

Contact: support@inth.com · legal@inth.com

These Terms of Service (“Terms”) govern access to and use of Inth websites, Dashboard, APIs, hosted consent infrastructure, audits, agents, CLI, status and booking properties, and related services that link to these Terms (the “Service”).

By accessing or using the Service, creating an account, or clicking to accept, you agree to these Terms. If you use the Service on behalf of an organisation, you represent that you have authority to bind that organisation, and “you” includes that organisation.

Related policies: Privacy Policy (https://inth.com/legals/privacy-policy) · Cookie Notice (https://inth.com/legals/cookie-policy).

Order of precedence: Order Form → MSA → DPA → Privacy Policy → these Terms → documentation/marketing (unless a signed document says otherwise).

Inth provides consent management, compliance-oriented tooling, website and code analysis features, APIs, documentation, and related software. Features depend on your plan and configuration. We may modify, suspend, or discontinue features with reasonable notice where practicable.

Beta / experimental features may be unstable and are provided AS IS.

No uptime SLA applies under these base Terms unless an Order Form or SLA exhibit says otherwise.

• Provide accurate registration information and keep credentials confidential.
• You are responsible for activity under your accounts and for your members’ compliance.
• Admins control seats, roles, billing, and integrations.
• We may suspend accounts for security risk, non-payment, legal risk, or Terms violations.
• You must be at least 18 (or the age of majority where you live).

Authentication and enterprise identity (WorkOS)

Access to the Dashboard and related platform features is authenticated through WorkOS (and any social or enterprise identity providers connected through it).

• Standard auth: email-based and/or social login flows we enable (for example GitHub or Google), orchestrated via WorkOS.
• Enterprise: organisations may enable SSO (SAML and/or OIDC) and directory sync / SCIM so members authenticate via your identity provider and group membership maps into Inth roles as configured.
• You must ensure your IdP configuration, user provisioning, and deprovisioning are accurate. You remain responsible for workforce access decisions in your IdP.
• WorkOS’s terms apply to the WorkOS platform services; these Terms and the Privacy Policy describe how Inth uses WorkOS for the Service.
• We may require SSO or stronger authentication for certain plans or security postures.

“Customer Content” means data, code, websites, prompts, configurations, logs configuration, and materials you or your end users submit to the Service.

• You retain ownership of Customer Content.
• You grant Inth a worldwide licence to host, process, transmit, display, and create derivative works of Customer Content only as needed to provide, secure, bill, and improve the Service (including through subprocessors and model providers as described in the Privacy Policy and DPA).
• You represent you have all rights necessary to submit Customer Content and to instruct processing of end-user data for hosted consent.
• You must not submit unlawful content, malware, or content you are not authorised to process.

Feedback. You grant Inth a perpetual, irrevocable, royalty-free licence to use feedback without restriction.

If you use hosted consent / Project Gateway features:

1. You are controller of your end-user consent programme. Inth is processor of consent evidence under your instructions and the DPA (when executed).
2. You configure regions, purposes, categories, vendors, and banners. You warrant that you have a lawful basis and provide required notices to end users.
3. You must not use the Service to collect special-category data or children’s data unless a written addendum expressly allows it.
4. Defaults may include masked IP and user agent as proof fields; platform telemetry (hashed fingerprints, geo, journeys) may be processed by Inth as controller for security, abuse prevention, billing, and operations, as described in the Privacy Policy.
5. Deletion: we assist with end-user rights under the DPA when technical controls allow. We do not guarantee a fixed-day complete purge of all tenant consent rows in every architecture generation until that capability is fully available.
6. Rate limits, regional capacity, and log retention windows apply. Excessive use may be throttled or suspended.

You will not:

• probe, scan, or attack the Service except via authorised coordinated disclosure;
• bypass rate limits, authentication, billing, or consent/privacy controls;
• resell the Service or resell raw gateway logs / end-user datasets except as we expressly allow;
• use the Service to violate law, privacy, or third-party rights;
• submit or run scans against websites, apps, or repositories without authority to do so;
• use Code Audit on codebases you do not control or lack rights to process;
• design or operate systems whose primary purpose is to bypass, spoof, or defeat consent, GPC, or CMP signals for third parties;
• use outputs as the sole basis for legal advice or automated decisions with legal or similarly significant effects without appropriate human review where required;
• scrape the Service in a way that degrades performance or violates access rules;
• upload malware, phishing kits, or illegal tracking packs;
• use the Service in violation of export controls or sanctions (see §18).

We may remove content, throttle, or suspend features that violate this section.

Certain features use third-party AI models (including via our AI gateway).

• Outputs may be inaccurate or incomplete. You must review outputs before relying on them. Outputs are not legal advice and are not a certification of legal compliance.
• Model providers process prompts under their terms and our agreements. We maintain ZDR arrangements with SpaceXAI and Anthropic (including Claude on commercial routes) for covered routes. Organisation strict ZDR settings may further restrict routing. Other models and tools may differ; we do not warrant that every provider never uses inputs to improve their services.
• Do not submit secrets, production credentials, or regulated data in prompts unless your plan, configuration, and law allow it.
• You are responsible for ensuring your prompts and use comply with applicable model acceptable-use rules.
• You will indemnify Inth against third-party claims arising from your prompts or Customer Content submitted to models, except to the extent caused by Inth’s wilful misconduct.

Paid plans are billed as stated in the Dashboard or Order Form (billing orchestration may use Autumn; payments via Stripe). Fees are non-refundable except where required by law or expressly stated. You authorise recurring charges for subscriptions. Taxes are extra unless stated. Failed payments, chargebacks, or late amounts may accrue fees, interest, or suspension.

We do not store full payment card numbers; Stripe handles card data under Stripe’s terms.

Integrations (WorkOS, GitHub, Google, Stripe, analytics, ads, status providers, scheduling embeds on booking properties, enterprise identity providers you connect, etc.) are subject to third-party terms. We are not responsible for third-party services.

Open-source components (including c15t packages you may use independently) are licensed under their respective licences. These Terms govern the hosted Service and Inth-operated sites; OSS licences govern the packages.

You authorise Inth to use subprocessors to provide the Service. A current list is in the DPA schedule and/or trust materials.

We will provide notice of material subprocessor changes as described in the DPA (or by updating the published list and, where required, emailing the admin contact). You may object on reasonable data-protection grounds within the period stated in the DPA.

Operational note: some infrastructure providers require Inth to object within short windows (on the order of 5–15 calendar days). Customer objection windows in the DPA are set so Inth can comply. If you object and we cannot reasonably continue the Service without the subprocessor, either party may terminate the affected services as set out in the DPA/Order Form.

Each party may receive Confidential Information from the other. The recipient will protect it with reasonable care and use it only for the relationship, except information that is public, independently developed, rightfully received from a third party without duty, or required to be disclosed by law (with notice where lawful).

Inth and its licensors own the Service, branding, and documentation (excluding Customer Content and OSS you licence separately). No rights are granted except as expressly stated. No licence to use Inth trademarks except nominative fair use or written permission.

Publicity. We may identify you as a customer and use your name and logo in customer lists and marketing, unless you email legal@inth.com to opt out (reasonable wind-down of existing materials).

Processing of personal data is described in the Privacy Policy. For customer end-user data in processor mode, the DPA applies when executed (and as required by law).

Inth implements technical and organisational measures appropriate to the risk. You must safeguard API keys, tokens, webhooks, and administrator accounts, and promptly revoke compromised credentials.

Security incidents. Where Inth is processor and becomes aware of a personal-data breach affecting Customer Content, Inth will notify you without undue delay and in accordance with the DPA (and applicable law, including assisting with controller notification timelines such as GDPR’s 72-hour framework to supervisory authorities where you are controller). Details of TOMs and notification mechanics live in the DPA.

EXCEPT AS EXPRESSLY STATED IN A SIGNED AGREEMENT, THE SERVICE IS PROVIDED “AS IS” AND “AS AVAILABLE.” TO THE MAXIMUM EXTENT PERMITTED BY LAW, INTH DISCLAIMS ALL WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED OR ERROR-FREE, THAT AUDITS OR AGENTS WILL FIND ALL ISSUES, OR THAT CONSENT CONFIGURATIONS YOU CHOOSE ARE LAWFUL FOR YOUR USE CASE.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, INTH WILL NOT BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR LOST PROFITS, REVENUE, OR DATA.

INTH’S TOTAL LIABILITY UNDER THESE TERMS WILL NOT EXCEED THE AMOUNTS PAID BY YOU TO INTH FOR THE SERVICE IN THE TWELVE (12) MONTHS BEFORE THE CLAIM (OR USD $100 if you have paid nothing).

Some jurisdictions do not allow certain limitations; those limitations apply to the fullest extent permitted. Nothing limits liability that cannot be limited under applicable law (including non-waivable consumer rights and, where applicable, liability for death or personal injury caused by negligence, or fraud).

You will defend and indemnify Inth against claims arising from Customer Content, your end users, your instructions as controller, your misuse of the Service, your scans or repository access, or your breach of these Terms, except to the extent caused by Inth’s wilful misconduct.

These Terms apply while you use the Service. You may stop using the Service and close your account.

We may suspend or terminate for cause, including non-payment, AUP breach, security risk, third-party IP claims, regulator demand, or material legal risk. Suspension of hosted consent may cause banners or collection to stop — that risk is yours as controller.

Upon termination, your licence ends; surviving sections survive. Data export is available through product tools as offered. Deletion follows the Privacy Policy and DPA, including known technical limits on consent-row purge until fixed.

You represent you are not prohibited from receiving the Service under US or other applicable export or sanctions laws. You will not use the Service for prohibited end uses.

The Service is not designed for life-critical medical devices, weapons targeting, or sole basis for automated decisions that produce legal or similarly significant effects without human involvement where law requires it.

Primary markets: United States (including California), the United Kingdom, and Europe.

• Business customers are typically subject to the governing law and dispute terms below, subject to any signed MSA/Order Form.
• Consumers may have mandatory UK or EU protections that cannot be waived by choosing Delaware law or arbitration. Nothing in these Terms limits non-waivable statutory rights.

Governing law. These Terms are governed by the laws of the State of Delaware, USA, excluding conflict-of-law rules, except that: (a) mandatory UK or EU consumer protections remain available where they cannot be waived; (b) applicable US state privacy laws (including California) apply by their own terms to covered individuals; and (c) if you are a business and a signed Order Form/MSA specifies otherwise, that choice controls as permitted.

Informal resolution. Before filing a claim, email legal@inth.com and seek good-faith resolution for 30 days.

Binding arbitration — US and business users. To the fullest extent permitted by law, any dispute arising out of or relating to these Terms or the Service will be resolved by binding individual arbitration administered by the American Arbitration Association (AAA) under its applicable rules, in English. Arbitration may be by telephone, video, written submissions, or in person at a mutually agreed location. Class actions and class arbitrations are waived to the fullest extent permitted by law. Judgment on the award may be entered in any court with jurisdiction.

Opt out. You may opt out of arbitration within 30 days of first accepting these Terms by written notice to legal@inth.com. If you opt out, informal resolution and governing law still apply; venue for court actions (where arbitration does not apply) is the state or federal courts located in Delaware, unless mandatory consumer law requires otherwise.

EU/UK consumers. If you are a consumer in the UK or EEA, this arbitration agreement does not deprive you of the right to bring proceedings in your country of residence or before competent local authorities where mandatory law so provides. EU/UK consumer ADR/ODR mechanisms may also apply.

• We may update Terms by posting a new version; material changes for paid customers may include additional notice. Continued use after the effective date is acceptance where permitted.
• If a provision is unenforceable, the rest remains in effect.
• You may not assign without our consent; we may assign to an affiliate or successor.
• Entire agreement (plus Order Forms, MSA, DPA).
• Notices to you: account email. Notices to us: legal@inth.com or the notice address above.
• Primitive is not part of the production Service.

Consent Management Inc (Delaware corporation)

Notice address: 2261 Market Street STE 86311, San Francisco, CA 94114

support@inth.com · legal@inth.com · privacy@inth.com