Terms of Service

1. Who we are

Eighteen Zeros Limited ("Eighteen Zeros", "we", "us") is a company registered in the United Kingdom, founded in January 2026. We operate a managed platform that provisions and runs open-source collaboration software — currently Nextcloud, with related identity, storage, and mail services — on isolated infrastructure for each customer ("the Service").

2. Closed beta status

The Service is currently in closed beta. It is provided "as is" and "as available", without any service level agreement or uptime guarantee. Features and functionality may change, be added, or be withdrawn at short notice as the platform develops; price changes follow the notice in clause 9.1. We will try to give reasonable notice of anything disruptive, but the beta period should not be relied on for production-critical use without your own backups and contingency plans.

3. Your account and responsibilities

You are responsible for the accuracy of the information you provide during signup, for keeping your account credentials secure, and for the actions taken under your organisation's account by users you invite. You must be authorised to accept these terms on behalf of your organisation.

4. Acceptable use

You agree not to use the Service to store or distribute unlawful content, to attempt to breach the isolation or security of the platform or other customers' environments, or to use the Service in a way that places unreasonable load on shared infrastructure. We may suspend access to protect the platform or other customers if these terms are breached.

5. Data and privacy

We handle two different kinds of data, and our legal role differs between them:

• Your account data — the details you give us to create and run your account (names, contact email, phone, organisation). For this we are the data controller. How we use it, the lawful bases, retention periods, and your rights are set out in full in our Privacy Notice.
• Your content — the files, messages, and other material your organisation stores in the services we run for you. For this your organisation is the controller and we are your processor: we handle that content only on your instructions, under the data-processing terms in clause 6.

UK GDPR and the Data Protection Act 2018 apply throughout. Data is stored on infrastructure located in the EU. We do not sell customer data, and we access your content only to operate, support, or secure the Service.

6. Data processing (our role as your processor)

Where we process your content on your behalf, the following terms apply and form the data-processing agreement between us for the purposes of Article 28 UK GDPR:

• We process your content only on your documented instructions — chiefly, to operate the Service — unless the law requires otherwise.
• We keep your content confidential, and anyone we allow to access it is bound by confidentiality.
• We apply appropriate technical and organisational security measures, including per-customer isolation and encryption in transit throughout. Platform data (files, databases) is held in encrypted off-site backups. Mailbox data and its backups are held by our email-hosting subprocessor on ISO/IEC 27001:2022-certified infrastructure in the EEA; we do not make an encryption-at-rest claim for mailbox data.
• We engage the subprocessors listed in clause 7 to help deliver the Service. By accepting these terms you give us general authorisation to engage them, and to replace or add subprocessors on notice as described in clause 7. We remain responsible for their compliance.
• We notify you without undue delay after becoming aware of a personal data breach affecting your content, with the information we have at the time and further detail as it becomes available, so that you can meet your own notification obligations. We do not promise a fixed hour count.
• We assist you, so far as reasonably possible, in responding to your users' data-protection requests and in meeting your own security and breach-notification obligations. For mailbox data, forensic investigation below the level of our own provisioning and access logs is carried out by our email-hosting subprocessor on our request; we do not promise mailbox-level forensics.
• At the end of the Service we return or delete your content as described in clause 8.

Deletion and object storage. When your organisation deletes content, our object storage keeps a hidden copy for a short period before permanently expiring it — up to 35 days. During that window the copy is held beyond use: it is not accessed or restored except as part of disaster recovery, it cannot be retrieved by you or your users, and it ages out automatically. This is the tail on any deletion you carry out, and it is the only respect in which deleted content lingers on our systems.

Special category data. The Service is not designed for data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data, health, sex life or sexual orientation (Article 9 UK GDPR), or for criminal-offence data (Article 10). Do not use the Service to process such data as a routine part of your activities without agreeing it with us in writing first; we may require a data-protection impact assessment to be completed before we agree.

7. Subprocessors

We rely on the following subprocessors to operate the Service, each acting under contractual data-protection obligations consistent with UK GDPR. All are based in the EU:

• Scaleway SAS (France) — cloud infrastructure and object storage
• QBoxmail S.r.l. (Italy) — email hosting
• Hetzner Online GmbH (Germany) — encrypted off-site backups
• Scaleway Transactional Email (EU) — transactional email delivery

The current list is also published in our Privacy Notice. We will give you at least 30 days' notice before adding or replacing a subprocessor that processes your content. If you have a reasonable data-protection objection you may tell us within that period; if we cannot resolve it you may terminate the affected part of the Service. Our subprocessors may in turn use their own sub-processors under equivalent obligations.

Mail metadata retained under Italian law. Because email hosting is provided from Italy, our email-hosting subprocessor is required by Italian law (art. 132 of Legislative Decree 196/2003, as amended by Law 167/2017) to retain email traffic data — sender, recipient, subject line, IP address, date, time and message identifier, but not message content — for 12 months, and for up to 72 months where an investigation concerns terrorism or organised crime. That data may be disclosed to Italian authorities on a lawful request. Where the law permits, we will tell you if we learn of a disclosure request concerning your mailboxes.

8. Termination and data return

You may stop using the Service at any time; cancellation and your final invoice are covered by clause 9.7. We may suspend or terminate access if these terms are breached, if fees are unpaid (clauses 9.5 and 9.6), if required by law, or — during the beta — if we discontinue the Service or a feature, with reasonable notice where practicable. Before or at termination you can export your data; the stack is built on open standards and we will help you retrieve it. After termination we delete your account data and content from the live Service. Residual copies in our backups and object storage are not individually edited — instead they are held beyond use and age out within our retention window (up to 35 days), after which they are permanently gone. Any restore from backup re-applies deletions already made. Termination for non-payment follows the timeline in clause 9.6; we do not delete anything automatically before it.

Dormant mailboxes. Our email-hosting subprocessor treats a mailbox that has not been accessed for 30 consecutive days as archived and charges an archive fee for it. Where a mailbox belonging to your organisation becomes dormant in that way, the archive fee is passed through to you at cost until the mailbox is used again or you ask us to remove it. We will tell you before the first such charge.

9. Fees and payment

9.1 Price. The Service costs £12 per user per month, excluding VAT. We are not currently registered for VAT; once we are, VAT is added at the applicable rate to invoices dated on or after our registration date. We will give you at least 30 days' notice of any change to the price.

9.2 Users. A user is any active user account in your organisation, plus any deactivated user whose mailbox has not yet been removed. For each month you are charged for the highest number of users your organisation held at the same time during that month.

9.3 Trial. Your first 30 days are a trial. If you cancel within the trial you pay nothing. Otherwise, when the trial ends we invoice you for those 30 days, and monthly from then on.

9.4 Invoicing and collection. We invoice monthly in arrears, on the same day of the month as your trial ended (or on the last day of a month without that day). Payment is collected by Direct Debit on or shortly after the invoice date. Payments are processed by GoCardless, an FCA-authorised UK payment institution; you set up your Direct Debit on GoCardless's secure pages. Please set it up before your trial ends.

9.5 Unpaid invoices and suspension. If an invoice goes unpaid — because a collection fails, or because no Direct Debit is in place when it is issued — you have 5 days' grace to pay before we suspend your account. If you have not set up payment by the end of the trial, the trial-end invoice is unpaid from the day it is issued, so your account is suspended on day 35. While your account is suspended, Nextcloud is unavailable to your users, mail keeps working, and you can still reach the billing page to pay. Paying the outstanding balance lifts the suspension. Each month is still invoiced while your account is suspended. A chargeback (a disputed Direct Debit payment) suspends the account immediately, until we have reviewed it.

9.6 Deletion after suspension. If your account is still suspended 30 days after suspension, we may terminate the Service and delete your account data and content as described in clause 8. Export anything you need before then.

9.7 Cancellation. You can cancel from your account settings. If you cancel after the trial, we issue a final invoice for the current month up to the cancellation date, pro-rated by days, together with any balance still owed.

9.8 Account and service emails. We use the email address your account owner gave at signup, and any billing contact you set, to contact you about your account and the Service — for example invoices, missing payment details, failed payments and suspension. These are service messages, not marketing. We only send marketing to people who have separately opted in to receive it, and never to this address on the strength of your account alone.

10. Liability

To the extent permitted by law, Eighteen Zeros' total liability arising from or in connection with the Service is limited to the total fees you have paid us for the Service up to the date of the event giving rise to the claim, and we exclude liability for indirect or consequential losses, loss of profit, and loss of data to the extent it arises from a failure of a subprocessor that we could not reasonably have prevented. Nothing in these terms limits liability that cannot lawfully be excluded, such as liability for death, personal injury, or fraud.

11. Governing law

These terms are governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute.

12. Contact

Questions about these terms can be sent to support@eighteenzeros.com.