Terms of service

These terms are between AppstackX Ltd (“we”, “us”), a company registered in England & Wales under company number 16287309, registered office 18 Westergate Avenue, Brooklands, Milton Keynes, England, MK10 7LQ, and the firm that subscribes to DutyDesk (“you”, “the firm”).

AppstackX Ltd is not VAT registered. The prices in section 5 are the whole price: no VAT is added at checkout, your invoice will show none, and there is no VAT for your firm to reclaim. If that position changes we will tell you at least 30 days before the first invoice that carries VAT.

They apply from the moment you create an account. The person who creates the account confirms they are authorised to accept these terms on behalf of the firm. Our privacy policy and data processing agreement form part of this agreement.

DutyDesk is sold to businesses. These terms are not consumer terms, and the firm is not dealing as a consumer.

DutyDesk is a subscription software service that helps a firm record and evidence its work under the FCA's Consumer Duty. It provides a vulnerable customer register, fair value assessments, outcome monitoring, board report drafting, an audit trail across all of them, and export to PDF, Word and CSV.

We may change, add to or remove features. Where a change materially reduces the functionality you are paying for, we will tell account administrators by email before it takes effect and, if you are unwilling to continue on the changed service, you may cancel under section 8.

• You must be a firm carrying on regulated activity in the UK, or working on behalf of one. DutyDesk is built around the FCA's rules for those firms.
• Each named user must have their own account. Sharing a set of credentials defeats the audit trail, which is the point of the product, and is not permitted.
• You are responsible for your users' actions, for keeping credentials secure, and for removing access promptly when someone leaves. Administrators can add, re-role and remove users at any time from the settings area.
• DutyDesk has four roles: administrator, compliance, adviser, and read-only. The read-only role is intended for an external auditor or reviewer who needs to see records but must not change them. On Practice, Practice+ and the free trial, one read-only auditor seat comes on top of the user allowance in section 5 — giving your auditor an account does not use up one of your adviser seats. Solo is a single-user plan and carries no auditor seat.
• Multi-factor authentication is available to every user and, once a user has enrolled a factor, is required every time they sign in. We strongly recommend every user enrols one.

• Every plan starts with a 14-day free trial. No card is required to begin.
• The trial gives you the full Practice tier feature set.
• AI drafting is limited during the trial to 20 section drafts for the whole firm — fair value sections or board report sections, in any mix, by whichever user. That covers a full six-section assessment and a full nine-section report with room to redraft. After that, AI drafting asks the firm’s admin to choose a plan; everything else keeps working.
• At the end of the trial nothing is charged, and the account moves to a paid plan only when an administrator chooses one. Until then, AI drafting is paused and your records and exports stay available. We may end access to an account left on an expired trial, in which case section 8 governs your data.

There is no VAT to add. AppstackX Ltd is not VAT registered, so these prices are the amounts you pay and your invoice will show no VAT line. Paying annually in advance attracts a 20% discount: £760, £1,910 and £4,790 a year respectively.

Practice, Practice+ and the free trial also include one read-only auditor seat outside the user count, as section 3 describes.

If you run a network or a group of firms, email khuram@appstackx.co.uk and we will talk about it directly.

We may change our prices. A change will never affect a subscription period you have already paid for, and we will give you at least 30 days' notice by email before a new price applies to one of your renewals. If you do not want to continue at the new price, cancel under section 8 before the renewal date.

AI drafting is subject to per-tier and per-user limits, so that one firm's usage cannot degrade the service or the price for everyone else.

A fair value assessment is six sections and a board report nine; the figures above count section drafts. A separate per-user rate limit of 30 fair value and 15 board report section drafts per hour applies on every tier. “Not limited” means subject to a fair-use allowance equal to one quarter of the tier’s monthly price in AI cost each calendar month, which ordinary use does not approach. Reaching any limit produces a clear message in the product, not an error; everything else in DutyDesk continues to work. Each firm can see its remaining allowance, usage and cost in the settings area.

Fees are collected by card through Stripe, our payment processor, and are payable in advance for each subscription period. You start a subscription, change plan, update your card, download invoices and cancel from Settings → Billing, which opens Stripe's own checkout and billing pages. We never see or store your card details.

No VAT is added at checkout, because AppstackX Ltd is not VAT registered. If a payment fails we will tell you and give you a reasonable period to fix it before suspending access under section 17; while that is running your firm keeps its plan and its records.

Two different things can happen at the end: you can cancel the subscription, or you can close the account. They are not the same, and what happens to your data differs.

• You can cancel at any time. Cancellation takes effect at the end of the current subscription period. You keep your paid plan until then, and afterwards the account stays open: every record, the audit log and every export remain available to you, on the limits of the free trial rather than your former plan.
• Monthly subscriptions — no refund is given for the period already paid for.
• Annual subscriptions — a pro-rata refund of the unused whole months, less a 15% administration fee, on request to khuram@appstackx.co.uk.
• Export your data whenever you like, while the account is open. The vulnerable customer register, board reports and the audit log export to CSV, PDF and Word from within the product, and a complete archive of everything downloads from Settings. Export is a standard feature, not something you have to ask us for.
• Closing the account ends access for everyone at the firm immediately — including any export. Take the export you need before you close. Closing also cancels any live subscription there and then, so nothing is charged afterwards.
• After closure we keep your data for 90 days, then delete it. Within those 90 days, email khuram@appstackx.co.uk and we will either reopen the account or send you a copy of your data. Closure ends access for everyone at the firm, so we handle this for you. Deletion at the end of the 90 days is permanent, so any request needs to reach us within that window.
• You can ask us to delete your data sooner. We will do so, subject to anything we are required by law to retain.

Your compliance records are your firm's records. Please make sure you have exported what you need before you close the account — the FCA's expectations about your record keeping do not end when your subscription does.

Specifically, and without limiting the above:

• AppstackX Ltd is not authorised or regulated by the Financial Conduct Authority, and does not carry on any regulated activity.
• Nothing in DutyDesk — no field, no template, no piece of helper text, no AI-generated draft — is regulated advice, legal advice, compliance advice or a recommendation. It is software for organising your own work.
• DutyDesk is not approved, endorsed, certified or accredited by the FCA or by any other regulator. No software is. The FCA regulates firms, not the tools they use.
• Using DutyDesk does not by itself make your firm compliant. Whether your firm meets the Consumer Duty depends on what your firm actually does — the decisions you take, the outcomes you deliver, and the judgement you apply. The product records that work; it does not perform it.
• You are responsible for the accuracy, completeness and lawfulness of everything you put into DutyDesk, and for deciding what to do with what comes out.
• You remain responsible for your own regulatory record-keeping obligations, including keeping records for the periods your regulator requires — which may be longer than you keep a DutyDesk subscription.
• We do not accept liability for a regulatory finding, censure, fine, redress liability or enforcement action against your firm. That risk sits with the regulated firm, as the regulatory framework intends.

DutyDesk uses a large language model to draft prose for fair value assessments and board reports from data you have already entered. Our prompts instruct the model to use only the data supplied, to cite specific figures, and to avoid vague quantifiers, and every draft is labelled in the product as AI-drafted.

Even with those safeguards, a draft is a starting point, not a finished statement: language models can produce text that reads convincingly and is still inaccurate. You must read, verify and edit every AI-drafted section before it is signed off, and the two-person sign-off in the product exists precisely so that happens. Once a person at your firm approves a section, it is your firm's statement, not ours.

We do not warrant that AI-generated content is accurate, complete or fit for any regulatory purpose, and we accept no liability for content that your firm approves and relies upon.

You agree not to:

• use DutyDesk unlawfully, or to store data you have no lawful basis to hold;
• attempt to access another firm's data, probe or circumvent our access controls, or test the security of the service without our written agreement;
• resell, sub-licence or provide the service to a third party as a bureau service, except that you may give an external auditor or reviewer a read-only account for your own firm;
• copy, reverse engineer or create a competing product from the service;
• use automated means to place load on the service beyond normal use, or to circumvent the AI limits in section 6;
• upload malicious code, or content that infringes someone else's rights.

For the records you enter about your own customers, your firm is the data controller and we are your processor. The terms required by Article 28 of the UK GDPR are set out in our data processing agreement, which is incorporated into this agreement. That document also lists our sub-processors.

Please read it before you enter your first vulnerable customer record. A vulnerable customer register will usually contain special category data under Article 9, and identifying your lawful basis and Article 9 condition is your responsibility as controller.

We own DutyDesk — the software, its design, and the prompt and template content we supply. You get a non-exclusive, non-transferable right to use it for your own firm for as long as your subscription lasts.

You own your data. Everything your firm enters, and everything generated from it in your account — assessments, board reports, exports — is yours. We claim no ownership of it and will not use it to train any model or to develop our product beyond providing the service to you.

If you send us feedback or a feature suggestion, we may act on it without owing you anything for it.

DutyDesk is provided without a contractual uptime guarantee or service credits.

How the service is run:

• DutyDesk runs on two platforms — Vercel, which hosts the application, and Supabase, which holds the database. Each publishes its own availability and status page, and DutyDesk's availability depends on theirs.
• We address faults on a best-efforts basis. We will tell you when we know something is wrong, and we will notify planned maintenance in advance where we reasonably can.
• Nothing in this section entitles you to a refund, a credit or a reduction in fees for time the service was unavailable.
• Your records export from DutyDesk in CSV, PDF and Word, or as a complete archive, whenever you want them (see section 8), and a copy you have taken stays readable on your own systems.

Support is by email to khuram@appstackx.co.uk. We aim to reply within 48 hours on Solo, 24 hours on Practice and 8 hours on Practice+. Those are targets we work to, not contractual commitments — missing one is not a breach of this agreement and carries no remedy.

We warrant that we will provide the service with reasonable care and skill. Beyond that, and to the extent the law allows, the service is provided as it is, and we exclude all implied warranties — including any implied warranty of fitness for a particular purpose, satisfactory quality, or that the service will be error free.

We do not warrant that DutyDesk will make your firm compliant with the Consumer Duty or with anything else. See section 9.

Nothing in this agreement limits or excludes either party's liability for:

• death or personal injury caused by negligence;
• fraud or fraudulent misrepresentation;
• anything else that cannot lawfully be limited or excluded.

Subject to that, and to the extent the law allows:

• neither party is liable for loss of profit, loss of business, loss of anticipated savings, loss of goodwill, or any indirect or consequential loss;
• we are not liable for any regulatory fine, censure, redress liability or enforcement action against your firm, nor for any loss arising from your reliance on AI-generated content that your firm has approved;
• our total liability arising out of or in connection with this agreement, in any twelve month period, is capped at the total fees you paid us in that period.

You are responsible for keeping your own copies of your records. We back up the database daily to protect the service against loss on our side: backups are encrypted, held in the EU alongside the database and kept for seven days, as section 11 of our privacy policy describes. You can export all of your records at any time, as a standard feature rather than a request you have to make, to keep the copies your firm's own record-keeping and business continuity arrangements require.

We may suspend or terminate access if you materially breach these terms — including non-payment or a breach of section 11 — and, where the breach can be put right, we have asked you to put it right and given you a reasonable period to do so. Where there is an immediate risk to the service or to another firm's data, we may suspend first and tell you immediately afterwards.

Either party may terminate for convenience at the end of a subscription period. On termination, section 8 governs what happens to your data.

We may change these terms. The date at the top will change, and we will give account administrators at least 30 days' notice by email of any material change before it takes effect. If you do not accept a material change, you may cancel under section 8 before it applies to you.

• Entire agreement. These terms, the privacy policy and the data processing agreement are the whole agreement between us on this subject, and replace anything said or written beforehand.
• Assignment. You may not transfer this agreement without our written consent. We may transfer it as part of a sale or reorganisation of our business, and will tell you if we do.
• Third parties. Nobody other than you and us has any right to enforce these terms.
• Severability. If a provision is found unenforceable, the rest continues to apply.
• Notices. We give notice to the email address of your account administrators. You give notice to khuram@appstackx.co.uk.
• Force majeure. Neither party is liable for a failure caused by something genuinely outside its reasonable control.

This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute arising from it.