SpendGuard™ Terms of Service

1. Introduction

These Terms of Service ("Terms") govern your access to and use of the SpendGuard™ platform ("Service" or "Platform") provided by Constant Control Limited ("we", "us", "our", "Constant Control"), a company registered in New Zealand. By accessing or using the Service, you agree to be bound by these Terms. If you do not agree, you must not use the Service.

We may update these Terms at any time. Updated Terms will be posted at https://www.spendguard.co.nz/legal/terms along with a revised "Last updated" date. Material changes require re-acceptance; continued use after notification constitutes agreement to the updated Terms.

2. Definitions

"Account" means your registered account on the Service. "Organisation" means the entity you represent when using the Service. "User" means any individual authorised to access the Service under your Organisation's account. "Data" means all information, content, and materials submitted to the Service by Users. "Service Account" means a non-human identity used for programmatic API access. "API Key" means the authentication credential issued to a Service Account.

3. Licence Grant

Constant Control grants you a limited, non-exclusive, non-transferable, revocable licence to access and use the Platform in accordance with these Terms. All rights not expressly granted herein are reserved by Constant Control. We may modify, suspend, or discontinue any part of the Platform at any time with reasonable notice.

4. Account Registration and User Obligations

To use the Service, you must create an account with accurate and complete information. You are responsible for maintaining the security of your account credentials and for all activities under your account. You must promptly notify us of any unauthorised use of your account.

Each Organisation must designate at least one administrator who is authorised to manage the Organisation's account, invite and remove users, and accept these Terms on behalf of the Organisation.

You are responsible for the accuracy of data you enter, maintaining adequate backups, and complying with all applicable laws. You assume all risk and liability for your use of the Platform, including any decisions or actions taken based on Platform data.

5. Data Ownership and Privacy

You retain ownership of all Data submitted to the Service. We do not claim ownership of your Data. By using the Service, you grant us a limited licence to process your Data solely for the purpose of providing the Service.

We handle personal information in accordance with the New Zealand Privacy Act 2020 and our Privacy Policy. Your Data is stored in AWS ap-southeast-2 (Sydney, Australia). Where Data is transferred outside New Zealand, we comply with Information Privacy Principle 12 (IPP 12) and ensure equivalent or greater privacy protections are in place.

We may anonymise and aggregate usage data for analytics, product improvement, and benchmarking. Anonymised data does not identify you or your Organisation.

6. Data Security and Hosting

We implement industry-standard security measures to protect your Data, including TLS 1.2+ encryption in transit, AES-256 encryption at rest, bcrypt password hashing, row-level security for tenant data isolation, and regular independent security assessments.

While we take all reasonable steps to protect your Data, no internet-based system is completely secure. You acknowledge that you provide Data at your own risk.

7. API Access and Service Accounts

The Service provides programmatic API access via Service Accounts authenticated with API Keys. The following terms apply to all API usage:

• Rate limits: API requests are rate-limited at 100 requests per minute per key by default. Enterprise organisations may request higher limits.
• Key expiry: All API Keys have a mandatory expiry of no more than 90 days. Keys cannot be extended — a new key must be generated before the current key expires.
• IP allowlisting: Available and recommended for production integrations. Keys without IP restrictions carry additional risk acknowledged by the Organisation.
• AI agent access: Service Accounts may be used by AI agents. Your Organisation is solely responsible for the behaviour and output of any AI agent operating under your Service Account. Constant Control does not control or monitor what agents do with data after receipt.
• Cross-border transit: When an API Key is used by an integration running outside New Zealand, Data transits to the jurisdiction where the calling agent or integration is hosted. Your Organisation acknowledges and is responsible for ensuring its API integrations comply with applicable data residency requirements.
• Revocation: We may throttle or revoke API access at any time for security reasons or Terms violations, without prior notice.

Full API documentation is available at https://www.spendguard.co.nz/legal/api-docs.

8. Service Availability

We target 99.9% monthly uptime for the Service. Scheduled maintenance is performed outside business hours with at least 72 hours' notice. Detailed service level commitments, credit remedies, and exclusions are set out in our Service Level Agreement.

Support is available via support@constantcontrol.co.nz. Target response times: critical issues within 2 hours (24/7); non-critical inquiries within 2 business days.

9. Fees and Payment

Fees for the Service are as set out in your subscription agreement or as published on our website. All fees are in New Zealand Dollars (NZD) and are exclusive of GST unless stated otherwise. We may update fees with 30 days' written notice. Fees are non-refundable except where required by New Zealand law.

10. Intellectual Property

All intellectual property rights, including copyrights, trademarks, trade secrets, and patents in the Platform, documentation, and all related materials, are and will remain the exclusive property of Constant Control or its licensors. These Terms do not grant you any rights to our intellectual property except the limited licence to use the Service as described herein.

11. Acceptable Use

You agree to use the Service only for lawful purposes and in accordance with our Acceptable Use Policy. You must not reverse-engineer, modify, or circumvent security measures; transmit harmful or malicious code; attempt to gain unauthorised access to other accounts or systems; interfere with Platform integrity or performance; or use the Service to store or transmit material that infringes intellectual property rights.

12. Third-Party Services and Integrations

The Service supports integrations with third-party platforms including Microsoft Teams, ticketing systems (Jira, ServiceNow), and AI providers. We are not responsible for the availability, accuracy, or performance of any third-party system. Your use of third-party integrations is subject to those providers' terms and privacy policies.

13. Confidentiality

Each party agrees to maintain the confidentiality of the other party's non-public information received in connection with the Service. This obligation does not apply to information that is publicly available, independently developed, or disclosed without breach of a confidentiality obligation.

14. Disclaimers and Limitation of Liability

The Platform is provided "as is" and "as available". To the maximum extent permitted by law, we disclaim all warranties, express or implied, including implied warranties of merchantability, fitness for a particular purpose, and non-infringement.

If you are acquiring the Service for business purposes, you agree that the Consumer Guarantees Act 1993 does not apply.

To the maximum extent permitted by New Zealand law, our total aggregate liability for any claim arising from or relating to the Service is limited to the fees you have paid in the 12 months preceding the claim, or NZD 1,000 if no fees were paid.

Neither party is liable for indirect, incidental, special, consequential, or punitive damages, including loss of profits, revenue, data, or business opportunities.

15. Indemnification

You agree to indemnify and hold Constant Control harmless from any claims, damages, or expenses arising from your use of the Service, your breach of these Terms, or your violation of any third-party rights or applicable laws.

16. Termination and Suspension

Either party may terminate these Terms with 30 days' written notice. We may suspend or terminate your access immediately without notice if you materially breach these Terms or pose a security or operational risk.

Upon termination, you may request an export of your Data within 30 days. After this period, all customer Data is permanently deleted in accordance with our Data Retention Policy. Audit logs are retained for the remainder of the 7-year retention period.

17. Force Majeure

Neither party is liable for failures or delays due to circumstances beyond reasonable control, including acts of God, war, terrorism, strikes, civil unrest, government action, cybersecurity attacks, pandemics, or natural disasters.

18. Government Procurement

Where the Service is procured by a New Zealand government agency, these Terms are subject to any applicable Government Model Contract terms and the Government Rules of Sourcing. In the event of any conflict, the government procurement terms prevail.

19. Export Controls and Sanctions

You agree to comply with all applicable export control laws and economic sanctions regulations. Access to the Platform by any person or entity in violation of such laws, or in sanctioned jurisdictions, is strictly prohibited.

20. Beta Features

We may offer beta or preview features within the Platform. Beta features are provided "as is", without warranty, and may change, degrade, or be withdrawn at any time without notice. Beta features are excluded from the SLA.

21. Feedback

By submitting feedback, suggestions, or ideas regarding the Platform, you grant Constant Control a perpetual, irrevocable, worldwide, royalty-free, sublicensable, transferable licence to use, modify, reproduce, distribute, and commercialise such feedback without obligation to you.

22. Dispute Resolution

In the event of a dispute, the parties agree to first attempt resolution through good-faith mediation in Wellington, New Zealand (or locally if you are based offshore). If the dispute is not resolved within 30 days of mediation commencing, either party may pursue legal remedies.

Any breach of intellectual property rights or confidentiality obligations may cause irreparable harm to Constant Control, entitling us to seek injunctive relief without the requirement to post bond.

23. Governing Law

These Terms are governed by the laws of New Zealand. The courts of Wellington, New Zealand have non-exclusive jurisdiction. If you are based offshore, your local mandatory consumer protection laws apply to the extent they cannot be excluded.

These Terms constitute the entire agreement between you and Constant Control regarding the Platform and supersede all prior agreements. You may not assign your rights under these Terms; Constant Control may freely assign its rights.

24. Amendments and Notices

We may update these Terms with at least 30 days' written notice. Material changes require re-acceptance. Notices via email or website posting are effective 24 hours after transmission.

25. Contact

For questions about these Terms, contact us at:

Constant Control Limited
Email: legal@constantcontrol.co.nz
Web: constantcontrol.co.nz

Constant Control Limited — Licensed for business in New Zealand. Servicing a global market for our clients.