Terms of service

1. Acceptance

By using crownstone.io or lens.crownstone.io, or by creating or using a Lens portal account, you agree to these terms and to our Privacy Policy. If you use the portal on behalf of an organization, you confirm that you are authorized to accept these terms for that organization, and "you" includes the organization. If you do not agree, do not use the website or the portal.

2. Who we are and key terms

"Crownstone", "we" and "us" mean Crownstone Strategy Group LLC, a Texas limited liability company. "Website" means crownstone.io. "Portal" means the Lens platform at lens.crownstone.io, including the client portal, agreement signing and invoice pages. "Client" means an organization that has engaged Crownstone. "Client Agreement" means a Client's Master Services Agreement (MSA), each Statement of Work (SOW) under it, and any data processing terms agreed with that Client. "Client Content" means files, information and other material that a Client or its users provide to Crownstone or upload to the portal.

3. Who may use the portal

The portal is for Clients and prospective Clients that Crownstone has invited. Access is by invitation only. You may use the portal only:

• if you received an invitation from Crownstone or from an authorized administrator at your organization;
• for your organization's business purposes, acting on its behalf; and
• if you are at least 18 years old.

Your organization is responsible for deciding who should have access, for asking us to remove people who no longer need it, and for the actions of its users. Crownstone staff also use the platform to deliver engagements; their use is governed by our internal policies.

4. Accounts and credentials

• Give accurate information when you create your account, and keep it current.
• Keep your password confidential and do not share your account. Each person needs their own account.
• Use a strong password that you do not use anywhere else.
• Sign out on shared devices.
• Tell us at once at contact@crownstone.io if you suspect someone else has used your account or knows your password.

You are responsible for activity under your account until you tell us it may be compromised. We may require you to reset your password, end your sessions, or verify your identity to protect your organization's information.

5. Acceptable use

Never type or upload passwords, keys, health records (PHI) or controlled government information (CUI). The portal is not designed to hold them. In particular, do not submit:

• passwords, passphrases, API keys, private keys, tokens, recovery codes or other credentials;
• protected health information as defined under HIPAA;
• Controlled Unclassified Information, classified information, or export-controlled technical data;
• payment card numbers, bank account credentials or government identification numbers;
• personal information that is not needed for the engagement.

If you send any of these by mistake, tell us promptly so we can delete it. Crownstone is not responsible for information submitted in breach of this section, to the extent the law allows.

You also agree not to:

• access information or accounts you are not authorized to access, or try to;
• probe, scan or test the security of the website or portal without our written permission (see "Reporting security issues" below);
• interfere with or disrupt the website or portal, or place an unreasonable load on them;
• upload malware or any file you know or suspect to be harmful, except where a Client Agreement expressly provides for the analysis of such material and we have agreed how it will be handled;
• copy, scrape, reverse engineer or build a competing product from the portal, except as the law expressly allows;
• use the website or portal in violation of any law or anyone else's rights;
• upload material you do not have the right to share.

Reporting security issues. If you believe you have found a vulnerability in our website or portal, email contact@crownstone.io. Act in good faith, do not access or change other people's data, and give us a reasonable time to fix the issue before telling anyone else.

6. Client content and confidentiality

Your content stays yours. As between you and Crownstone, Clients own their Client Content. You give Crownstone permission to host, copy, process, analyze and display Client Content only as needed to provide the services and the portal, to keep them secure, and as the Client Agreement allows. This includes processing by the sub-processors listed in our Privacy Policy.

No AI training. Crownstone does not use Client Content to train AI models, and does not allow its AI provider to do so.

Confidentiality. We treat Client Content as confidential and use it only to serve the Client. Engagement work, including confidentiality, data handling, deliverables, fees and liability, is governed by the Client Agreement. If these terms conflict with a Client Agreement, the Client Agreement prevails.

Your responsibilities. You confirm that you have the rights and any notices or consents needed to share Client Content with us, including any personal information it contains.

Retention. Client files in the portal are kept until the engagement closes and for 12 months afterwards, then deleted, unless the Client Agreement says otherwise. You may download your files before then. Some records, such as signed agreements, invoices and audit records, are kept longer, as described in our Privacy Policy.

7. Intellectual property

The website, the portal and their content, including the Cybersecurist Lens methodology, software, text, designs, logos and the Crownstone name, belong to Crownstone or its licensors and are protected by intellectual property laws. We give you a limited, non-exclusive, non-transferable, revocable right to use the portal for your organization's internal business purposes while you are authorized to do so.

Ownership of, and rights to use, deliverables created during an engagement are set by the Client Agreement.

Cybersecurist Lens™ is a trademark of Crownstone Strategy Group. You may not use our names or logos without our written permission.

If you send us suggestions or feedback, we may use them without obligation to you.

8. Electronic signatures and records

The portal lets authorized people review and sign agreements, such as an MSA or SOW, electronically. By signing in the portal you agree that:

• you consent to do business electronically and to receive agreements, notices and records electronically, under the federal Electronic Signatures in Global and National Commerce Act (ESIGN) and the Uniform Electronic Transactions Act as adopted in Texas and other states;
• your typed name, together with your confirmation, is your electronic signature and has the same effect as a handwritten signature;
• you are authorized to sign on behalf of the organization named in the agreement.

When you sign, we record your name, email address, the date and time, your IP address and browser information, the consent wording you accepted, and a cryptographic fingerprint of the exact document you viewed and signed. These details are kept with the signed agreement as evidence of signature and of the document's integrity.

You can download a copy of each signed document from the portal. To view and keep records you need a current web browser and the ability to open PDF files. You may ask for a paper copy at no charge, or withdraw your consent to electronic signature for future agreements, by emailing contact@crownstone.io. Withdrawing consent does not affect agreements already signed. Please keep your email address current so that signing requests and notices reach you.

9. Third-party services

The website and portal rely on, or link to, services run by others, such as Calendly for booking, Stripe for invoices and payment, and Google for analytics and hosting. Your use of those services may be subject to their own terms and privacy policies. We are not responsible for third-party websites or services we do not control. Payments made through Stripe are also subject to Stripe's terms.

10. Website content

Articles, guides, sample reports, self-assessments and other material on the website are general information. They are not professional advice for your situation and do not create a client relationship. Sample reports use fictional or composite organizations. Self-assessment results are indicative only. An engagement begins only when we sign a Client Agreement with your organization.

11. Disclaimers

Except as expressly stated in a Client Agreement, the website and portal are provided "as is" and "as available". To the fullest extent the law allows, Crownstone disclaims all warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, title and non-infringement, and any warranty that the website or portal will be uninterrupted, error-free or free of harmful components.

Security assessments and advice reduce risk; they do not eliminate it. No assessment can find every weakness, and Crownstone does not guarantee that any system, organization or person will be secure or will avoid any incident. Your organization remains responsible for its own security decisions and their implementation.

12. Limitation of liability

For Clients, the limitation of liability in the Client Agreement applies instead of this section.

For everyone else, and to the fullest extent the law allows:

• Crownstone will not be liable for any indirect, incidental, special, consequential, exemplary or punitive damages, or for any loss of profits, revenue, data, goodwill or business opportunity, arising from or related to the website or portal, even if advised of the possibility;
• Crownstone's total liability arising from or related to the website or portal will not exceed one hundred US dollars (US$100).

Some jurisdictions do not allow certain exclusions or limits, so some of the above may not apply to you. Nothing in these terms limits liability that cannot be limited by law, such as liability for fraud or for gross negligence or wilful misconduct where the law does not permit it to be limited.

13. Indemnity

To the extent the law allows, and unless a Client Agreement provides otherwise, you will defend and indemnify Crownstone against third-party claims, and related losses and reasonable costs, arising from your breach of these terms or your misuse of the website or portal.

14. Suspension and termination

We may suspend or end access to the portal, for one user or an organization, if we reasonably believe it is needed to protect the security of the portal or other users, if these terms are breached, if required by law, or when the related engagement or Client Agreement ends. Where it is reasonable and lawful, we will tell the affected Client first and work with it to resolve the issue. Your organization may ask us to remove any of its users at any time.

When access ends, your right to use the portal ends. Client Content is then handled as described in section 6 and the Client Agreement. Sections that by their nature should survive, including those on intellectual property, electronic records, disclaimers, limitation of liability, indemnity and governing law, survive.

15. Governing law and disputes

These terms are governed by the laws of the State of Texas and applicable US federal law, without regard to conflict of law rules. Except where a Client Agreement provides a different method of resolving disputes, the state and federal courts located in Collin County, Texas have exclusive jurisdiction, and you and Crownstone consent to their jurisdiction. Before starting formal proceedings, each side agrees to try in good faith to resolve the dispute informally for at least 30 days after written notice.

16. Changes to these terms

We may update these terms from time to time. We will post the new version on this page with a new effective date and version number, and for material changes we will tell portal users in advance by email or in the portal. Continuing to use the website or portal after a change takes effect means you accept the updated terms. Changes do not alter a signed Client Agreement.

17. General

• Entire agreement. These terms, the Privacy Policy and, for Clients, the Client Agreement are the entire agreement about the website and portal.
• Severability. If any part of these terms is found unenforceable, the rest remains in effect.
• No waiver. Not enforcing a right is not a waiver of it.
• Assignment. You may not transfer these terms without our written consent. We may transfer them in connection with a merger, acquisition or sale of our business.
• Force majeure. Neither side is liable for delay or failure caused by events beyond its reasonable control.
• Notices. We may send notices by email to the address on your account or by posting them in the portal. Send notices to us at the address below.
• Export and sanctions. You may not use the website or portal where US law prohibits it.

18. Contact us

Crownstone Strategy Group LLC
2831 Sunfish St, Prosper, TX 75078
contact@crownstone.io

See also our Privacy Policy.