Terms of Service

1. Parties

JForge Labs ("we", "processor") provides RootsX as software. The organization that creates staff accounts and stores participant files ("you", "customer", "organization") is responsible for why that information is collected and for its own staff. Participants are not parties to this agreement.

2. The service

We host the application at app.rootsx.org on DigitalOcean in Toronto. We will try to keep it available. Scheduled deploys and platform outages happen. We do not promise a specific uptime percentage in this draft. Features marked optional (SMS, AI assist) may be off in production. SMS is off in production as of the effective date.

3. Your responsibilities

• Decide the lawful basis and consent language for your programs.
• Create, disable, and review staff accounts. Do not share logins.
• Keep participant data accurate enough to deliver the program.
• Do not upload information you have no right to hold.
• Tell us promptly if you think an account or file was misused.

4. How we process personal information

We process participant and staff personal information only to run the service for you, including hosting, backups, email, and (if you enable it and the person agrees) AI drafting. We do not use participant files to train a public model, and we do not sell them.

Details, including vendors and regions, are in the Privacy Notice and the subprocessor register. Cross-border processing (email, optional AI, and SEA Microsoft sign-in in the United States) is disclosed there. You authorize those subprocessors by using the service.

We will not disclose your files except to those subprocessors, to your authorized staff, as required by law, or as needed to handle a security incident.

5. Security

We maintain the controls described in our security architecture summary and CIS Controls mapping (repo paths docs/security/security-architecture-summary.md and docs/security/cis-controls-mapping.md). Those documents list gaps as well as controls. They are not a certification.

If we confirm unauthorized access to personal information we process for you, we will notify your named contact as soon as we can, with a target of 24 hours, and we will help you meet PIPEDA. You decide, with our written facts, whether there is a real risk of significant harm and whether participants and the Privacy Commissioner must be notified, unless the law also requires us to file.

6. Insurance and waiver

As of the effective date, JForge Labs does not represent that it carries a dedicated cyber-liability policy for RootsX. You may:

1. Keep your own coverage for privacy and cyber events that affect your programs, including events that involve this service; or
2. Waive a requirement that we show such a policy as a condition of this first term. Choosing this option is not a waiver of PIPEDA, of your duty to your participants, or of claims for our willful misconduct.

Either choice should be written on the order form or in an email from your Executive Director to [email protected]. Silence is not a waiver. If a funder later requires a policy, we can reopen this clause at renewal without treating the first term as a breach.

7. Fees and term

Fees, if any, are on the invoice or order form. Either party can end the service on written notice. We will then give you a reasonable window to export your data and will delete or return the production copy on a schedule you confirm in writing.

8. Warranties and liability

The service is provided as available. We do not warrant that it is error-free or that it will meet a funder's audit on its own.

Except for death or personal injury caused by negligence, fraud, or willful misconduct, each party's total liability under these terms in a twelve-month period is limited to the fees you paid us for RootsX in that period. If you paid nothing, that cap is CAD $1,000. Neither party is liable for lost profits or indirect loss.

You will defend us against claims that arise from your content, your staff misuse, or your instructions, except to the extent we caused the claim.

9. Law

These terms are governed by the laws of Saskatchewan and the federal laws of Canada that apply there. Counsel should confirm the venue sentence before signature.