Not yet reviewed by a solicitor. Consonas is in development. These terms are written to be honest and readable, and they will be reviewed by a practitioner before paid plans open. We would rather publish them now, plainly marked, than leave the page empty while people are being asked to sign up. If a review changes anything material, we will tell account holders before it takes effect rather than quietly replacing the page.

Twenty nine clauses, and the five that decide something

There are twenty nine clauses. The ones that decide something important to you are clause 5 on what your data is and is not used for, clause 9 on what you may not do, clause 14 on ending the agreement, clause 15 on what happens to your data afterwards, and clause 17 on liability. If you read five, read those.

Everything else is either machinery that has to be written down or a promise that costs us something. We have marked which is which, and we have not hidden anything that limits your rights inside a clause with a reassuring heading.

1. Who this is between

This agreement is between Consonas and the organisation whose account you create or join. If you are creating an account on behalf of an organisation, you confirm you may agree to these terms for it. If you are an individual using Consonas for yourself, references to your organisation mean you.

Where an individual creates an organisation and later transfers ownership, the agreement continues with the organisation instead of restarting. Ownership transfer is done inside the product by the current owner and is recorded in the audit trail, so a dispute about who owns an account has a documented answer.

2. The words we use

The service means Consonas as it exists and operates at the time you use it, including this website, the application, and the interfaces we publish.

Your data means everything your organisation puts into the service or generates by using it: relationships, notes, files, correspondence, tasks, records and the audit trail of your own activity.

Your organisation means the workspace created when someone signs up, together with everybody invited into it and everything held in it.

An administrator means anyone holding a role that can invite people, change roles, or export data. Owner and administrator are distinct roles in the product and the difference matters in clause 11.

3. What we provide

Access to Consonas as described on this website, on the plan you have chosen. We describe the product that exists. Where something is planned rather than built, we say so, and you should not agree to these terms in reliance on anything we have described as planned.

This is a deliberate commitment rather than a disclaimer. Every product page on this site carries a section naming what that part does not do, and the roadmap separates what is being built from what has been decided against. If you find a page on this site describing something that does not exist in the product, that is a defect and we would like to be told about it at hello@consonas.com.

4. Your account

You are responsible for who you give access to, and for keeping sign in credentials secure. Tell us promptly if you believe an account has been compromised. You must be old enough to enter a contract in your jurisdiction.

Two factor sign in is available on every plan including the free one and an owner can require it for everybody. We recommend requiring it. Where an account is compromised because a password was reused from a service that was breached and two factor was not enabled, that is a failure of account hygiene instead of a failure of the service, and clause 17 is the relevant limit.

Every sign in, every role change and every export is recorded in your audit trail, which you can read yourself. If you suspect something, look there first, then write to us with what you found and we will tell you what we can see from our side.

5. Your data stays yours

Everything you put into Consonas remains yours. We process it to provide the service and on your instructions, as set out in the data processing agreement.

Specifically, and because these are the questions people actually ask:

We do not sell your data, to anyone, in any form, aggregated or otherwise.
We do not use your data to train machine learning models, ours or anyone else's, and we do not send it to a third party who might.
We do not read your records. Access by our staff to a customer database happens only where you have asked for support that requires it, is limited to the people who need it, and is recorded.
We do not use your data to build a product for your competitors, benchmark your performance publicly, or derive statistics we publish.

You can export everything you hold at any time, on any plan, without asking us, including after you have stopped paying. Clause 15 says what that means at the end of the agreement, and the reason it is a term rather than a feature is that a portability promise you can only test after paying is not a promise.

6. Who is responsible for the personal data in your account

You are. Consonas holds information about people you deal with because you put it there, and you decide what goes in, why, and for how long. In the language of data protection law you are the controller and we are the processor, and the data processing agreement sets out the terms on which we process.

That means the lawful basis for holding a contact is yours to establish, the consent records are yours to maintain, and a request from an individual to see or delete their record comes to you rather than to us. The product carries tooling for all three on every plan, including the free one.

7. Where your data lives

You choose a region when you create an organisation. The choice is between the European Union and the United States, and it is fixed from that moment because the database is physically created in that jurisdiction and moving it later is a migration instead of a setting.

Organisations in the United Kingdom should choose the European Union. We say this on the signup screen as well as here, because it is the single decision at signup that cannot be undone later, and getting it wrong means creating a second organisation and importing an export.

8. Your plan, and what changes when it changes

Plans and their limits are published on the pricing page. Most limits are enforced by the product rather than described and ignored, which means reaching one produces a refusal with an explanation instead of a silent failure or a surprise invoice.

Moving up a plan takes effect immediately. Moving down takes effect at the end of the period you have paid for, and where the lower plan has a limit you are above, the product will tell you what you need to reduce before the change can complete rather than deleting anything to make it fit. Nothing is ever deleted to enforce a downgrade.

Obligations do not sit behind a plan. The audit trail, consent records, subject access tooling, two factor sign in and complete export are on every plan including the free one, permanently. An organisation that cannot afford a paid plan does not deserve worse evidence when something goes wrong.

9. What you may not do

Break the law with it, or help anyone else to.
Put personal data into it that you have no lawful basis to hold, or use it to send messages to people who have not consented where consent is required.
Attempt to reach another organisation's data, or to test our security without asking us first. Ask, and we will usually say yes, and we will tell you what is in scope and how to report what you find.
Place a load on the service designed to degrade it for others.
Resell access, or operate the service on behalf of somebody else as though it were your own product, without a written agreement with us.
Use it to store material that is unlawful to possess, or to conduct activity that would put our infrastructure providers in breach of their own terms.

This list is short on purpose. It covers harm to other people, harm to us, and harm to you through us. It does not attempt to describe every use we might disapprove of, because a term you cannot predict the application of is not a term you can comply with.

10. Sending messages from Consonas

On the plans carrying email, a reply you write and a step of a sequence leave from your own connected mailbox rather than from us, so the recipient sees the colleague they know, and our own sending service is the fallback for when that mailbox cannot be reached. Marketing campaigns are the exception and always leave through our sending service, because a campaign sent from one person's mailbox is how that mailbox stops being trusted. Being plain about what that means: there is no per organisation sending domain today, so a campaign leaves from a Consonas address rather than from one of yours, and a recipient reading the headers will see us carrying a message written by you. Every campaign message carries a signed unsubscribe link recorded against the person rather than against the campaign, and the obligations attaching to marketing messages are yours to meet.

You must not use Consonas to send unsolicited commercial messages, to send to a list you bought, or to continue sending to somebody who has asked you to stop. In the United Kingdom the rules on that are the Privacy and Electronic Communications Regulations 2003, and they are yours to meet rather than ours. The product records consent and objections against the relationship and will show you both, so a claim that you did not know is unlikely to be available to either of us.

11. Roles, and the things one person cannot do alone

Access inside your organisation is governed by roles you define and the audit trail. Where an action is expensive to get wrong, the product requires more than one person, and those requirements are part of the service rather than a setting you can quietly remove.

An owner cannot remove their own ownership without another owner existing. One person cannot approve their own contract. These are not restrictions on you so much as protections for the organisation against a single account, which might be a departing employee or might be somebody with a stolen password.

12. Availability

We aim for the service to be available at all times and we will publish incidents honestly, including ones that are our fault and including ones no one noticed. We do not offer a contractual availability guarantee on the free plan. Any guarantee attaching to a paid plan will be stated in that plan's terms when paid plans open.

We will give notice of planned maintenance that we expect to interrupt the service. In practice the architecture makes whole service outages less likely and single organisation outages more likely, because each organisation runs against its own database, which the security page sets out in full. That is a genuine trade and we would rather describe it than claim only the flattering half.

13. Payment

The free plan costs nothing and requires no card. It is not a trial, it does not expire, and it does not become a paid plan by inaction. A new organisation may begin with a thirty day period on Professional, which also requires no card: at the end of it the organisation moves to Free, never to an invoice. For paid plans, fees are as published or as agreed in writing, charged in advance, and are not refundable for part periods except where the law requires.

We will give at least thirty days' notice by email before increasing a price. If a payment fails we will tell you and try again before anything changes, and we will not delete data because an invoice is unpaid. An account in arrears may become read only after notice, and export stays available throughout, because the moment you most need your data out is the moment you have decided to leave.

14. Ending it

You may stop using Consonas at any time and close your account from within the product. Closing asks twice: the first step tells you what the organisation holds and offers the export, and the second confirms it, because closing everything on one click is the kind of convenience nobody wants afterwards. Closure begins the deletion in clause 15, and an owner can reopen the organisation at any point in the thirty days that follow.

We may suspend an account that is breaking clause 9, or that presents a security risk to others, and we will tell you why and give you a chance to put it right unless doing so would make the problem worse. We may end this agreement with thirty days' notice, and in that case we will help you export everything and will refund fees paid for any period after the end.

Free organisations nobody signs into are subject to the dormancy process described on the pricing page. That process involves repeated notice by email over months and an offer of export before anything is deleted. Nothing is deleted for dormancy without somebody having been told several times and having had the chance to take a copy.

15. What happens to your data at the end

When an account closes, your data is retained for thirty days so that a mistake can be undone, and is then deleted. The same thirty days apply to a closure we begin, for dormancy or under clause 14: it is a closing rather than a deletion, and throughout it an owner of the organisation may still take the export and reopen it. Those two doors are the owner's alone. An administrator holds neither, and nobody at all may write to a closing organisation. Backups age out on their own schedule, which is at most a further thirty days. Records we must keep by law, such as billing records, are kept for as long as the law requires and no longer.

Because each organisation has a database of its own, deletion is the removal of that database instead of the marking of rows inside a shared one. That is a materially stronger form of deletion and it is a consequence of the architecture rather than a policy we could change our minds about.

If you would rather we returned your data than deleted it, ask before the thirty days run out and we will provide it in a machine readable form first.

16. Who owns what

You own your data. We own the service: the software, the interface, the documentation and the name. Neither of us gets any right in the other's property by way of this agreement beyond what is needed to make it work.

If you send us a suggestion, a bug report or a description of a problem, we may act on it without owing you anything, and we will not treat the fact you sent it as confidential unless you tell us it is. This is the ordinary position and we mention it because several things now built arrived that way and the people who suggested them deserve to know how that works.

17. Liability

Nothing here limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be limited.

Beyond that, our total liability in any twelve month period is limited to the fees you paid us in that period. On the free plan that figure is zero, which is the honest consequence of a service that costs nothing.

We would rather you drew the correct conclusion from that than the comfortable one. If the data in Consonas is critical to your organisation, keep your own export, on your own storage, on a schedule you control. Run one on your first afternoon so you know what it produces, and periodically thereafter. That advice applies to any supplier of our size, including ourselves, and it is worth more to you than a larger number in this clause would be.

Neither of us is liable to the other for loss of profit, loss of business or indirect loss, and each of us must take reasonable steps to limit any loss we are claiming for.

18. Things outside either of our control

Neither of us is in breach because of something genuinely outside our control, for as long as it lasts and no longer. If such an event stops the service for more than thirty days, either of us may end the agreement, and we will help you export.

We name our infrastructure providers on the sub processors page, so you can see exactly whose availability the service depends on instead of having to guess.

19. Confidence

Each of us will keep the other's confidential information confidential, use it only for this agreement, and protect it as carefully as our own. This survives the end of the agreement.

What we learn about your business through supporting you is confidential. What you learn about how the product works is not, and you are free to write about it, compare us with anyone, and publish what you find. We will not ask you to take a review down.

20. Using your name

We will not name you as a customer, use your logo, or describe your use of Consonas publicly without asking you first and getting an answer. Silence is not agreement. Permission given once can be withdrawn, and we will remove the reference when you ask rather than at the end of a term.

21. Support, and what to expect from it

Support is by email to hello@consonas.com on every plan including the free one. There is no separate support tier that buys you a reply. We are small, so a reply is usually from somebody who can change the product, and it is sometimes slower than a larger company would be.

We will tell you when we cannot do something instead of leaving a request open indefinitely, and we will tell you when a defect you have reported is fixed. A request that describes a problem rather than naming a feature genuinely changes what gets built next.

22. Connecting other systems

Where you connect Consonas to another system, that system's terms govern that system. We are not responsible for what it does, whether it stays available, or what it charges. A connection you authorise can be revoked from inside the product at any time, and revoking it does not remove anything already brought across.

23. Changes to these terms

If we change them materially, we will email account holders at least thirty days before the change takes effect. If you do not accept the change, you may end the agreement and take your data with you, and we will refund any period you have paid for beyond the end.

Non material changes, meaning corrections to wording that do not alter what either of us has agreed to, take effect when published and are noted by a change to the date at the top of this page.

24. When somebody other than you asks us for your data

Requests reach us occasionally from people who are not you: a court, a police force, a tax authority, a party to a dispute with you, or somebody who says they work for you. We require every one of them in writing, and we treat as binding only an order that is binding on us in the jurisdiction holding your database under clause 7.

Where we are allowed to tell you, we tell you before we produce anything. Where we are forbidden to tell you, we tell you as soon as the prohibition lifts. Where the person asking could reasonably ask you instead, we say so, because you hold this data and we operate the place it sits. What we produce is the narrowest thing that answers what was asked, and we keep a record of having produced it.

Someone claiming to be from your organisation is not an exception to any of that. We do not change roles, release exports or move ownership on the strength of an email, and clause 25 is the only route that exists. The plain consequence is that we make a poor back door into your account, including on the day you would find a back door convenient.

25. When the owner has gone and nobody can get in

An owner resigns, dies, loses access to the mailbox their account is attached to, or simply declines to hand the organisation over. From outside we cannot see which of those has happened, and all four arrive as a plausible email from someone we have never met.

So the route is deliberately slow. We ask for a written request from an address at your organisation's own domain, evidence that the person asking has authority to run the organisation, notice to the recorded owner at the address we hold for them, and a waiting period before anything moves. We will decline where the evidence is thin. If that reads as obstructive, it is the same obstruction standing between your organisation and somebody who wants to take it away from you.

It is also avoidable. A second owner, added while the first is still answering their email, removes this clause from your life entirely, and a second owner is available on every plan including the free one. Note as well that an unreachable owner on a free plan still receives the dormancy notices described in clause 14, and no one reading them is not the same thing as nobody having been told.

26. If your organisation is bought, split or renamed

This agreement follows the organisation instead of the name above the door or the person who signed up. Renaming changes nothing in it. If you are acquired, your new parent inherits this agreement exactly as it stands, including the region fixed under clause 7, which an acquisition does not unfreeze.

Dividing one organisation in two, or absorbing one into another, is not something that happens inside a single database. The mechanism is an export and a second organisation, and the one that closes is then governed by clause 15. Take the export before the closure rather than after it, because after it there is nothing left to take.

On our side, clause 28 allows us to transfer this agreement to a company acquiring our business. If that happens we will tell you, you may leave, and the acquirer takes these terms as written: changing them materially still costs the thirty days' notice in clause 23. We hold no source code escrow and we are not going to imply that one is coming, which is the second reason clause 17 asks you to keep a copy of your own.

27. Before either of us involves a court

If you think we have got something wrong, write to legal@consonas.com saying what happened, what you want, and by when. We will reply in writing and name the person dealing with it. If thirty days pass without a resolution, either of us may go to court under clause 29.

That step is a courtesy instead of a bar. Neither of us is required to arbitrate, neither of us gives up the right to bring or join a group claim, and nothing here delays an urgent application to a court where one is genuinely needed. Your card issuer's own dispute process is yours and this agreement does not take it away. A complaint to a data protection authority goes straight to them: we neither can nor would require you to come to us first.

Raising a dispute is not itself a ground for suspension. The grounds are in clause 14 and disagreeing with us is not among them. Nor will we make a refund or a credit conditional on your silence. Clause 19 already says you may publish what you find, and the middle of a complaint is not the moment we would want to start qualifying that.

28. The rest

This agreement, together with the documents it refers to, is the whole of what we have agreed, and it replaces anything said before it. If a court finds one part unenforceable, the rest continues. If either of us does not enforce something immediately, that does not mean it has been given up. Neither of us may transfer this agreement without the other's consent, except that we may transfer it to a company acquiring our business, in which case we will tell you and you may leave.

Notices to you go to the email address of your organisation's owner. Notices to us go to legal@consonas.com. Nobody who is not a party to this agreement may enforce it, which disapplies the Contracts (Rights of Third Parties) Act 1999 and is the ordinary position rather than a hidden one.

29. Law

These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction. If you are a consumer rather than a business, this does not remove the protection of the law of the country you live in.

What this contract deliberately does not contain

A contract is also the sum of what someone chose to leave out, and an absence you have to notice for yourself is not much of a commitment. These are the standard clauses we considered and rejected, with the reason in each case.

No indemnity running from you to us. The usual version obliges the customer to defend and pay for claims brought against the supplier. On a product costing what this one costs, that is unbounded risk moved onto you in exchange for a small monthly fee. We would rather carry it.

No compulsory arbitration, and no waiver of group claims. Both are ways of making a small complaint expensive to bring. Clause 27 asks you to write to us first, then gets out of the way.

No power for us to change these terms without telling you. Clause 23 is the whole of our right to amend, and exercising it costs us thirty days and gives you the right to leave.

No acceptable use policy kept somewhere else. Clause 9 is short, it sits inside the contract, and we cannot widen it by quietly editing a page you never agreed to.

No licence over your content beyond running the service. There is no perpetual, worldwide, transferable grant hiding inside clause 16. What we may do with your data is what the data processing agreement says, and nothing besides.

No conversion of the free plan into a paid one by inaction. Clause 13. Doing nothing costs nothing here, which is unusual enough in this industry to be worth saying twice.

No clause forbidding you to criticise us. Clause 19 says the opposite, and says it in the clause where a restriction would ordinarily be hidden.

These absences have a price, and it is ours as much as yours. With no indemnity and no arbitration, a serious dispute between us ends up in front of a court, slowly and at cost to both sides. What protects us instead is the cap in clause 17, set at what you have paid. That is the whole trade, stated in one place rather than assembled by a reader from six.

Asking about a clause before you agree to it

Write to legal@consonas.com. A question about a clause is a reasonable thing to ask before agreeing to it, and we would rather answer it than have you agree to something you were unsure about.

Terms of service