1. Agreement, company, and scope
These Terms of Service ("Terms") govern access to and use of the website at blackbat.dev and the products, documentation, and autonomous web-application testing features made available by BlackBat AI Inc. ("BlackBat AI," "we," "us," or "our"). BlackBat AI Inc. is a corporation incorporated in Delaware, United States. Our contact mailing address is 112 St Malo Ct, Martinez, CA 94553, United States. References to the "Services" mean the features actually made available under your plan or a written order, not every feature described in marketing or a roadmap.
By using the Services or accepting these Terms through an account or order process, you agree to these Terms to the extent permitted by applicable law. If you use the Services for an organization, you represent that you have authority to bind it; "you" and "Customer" then refer to that organization and, where relevant, its authorized users. If you do not agree, do not use the Services. A signed master agreement, order form, or data processing addendum controls over a conflicting provision here for its specific subject matter.
2. Eligibility and authorized users
You must be at least 18 years old and legally able to enter into this agreement. You may not use the Services where doing so is prohibited by law or where applicable sanctions or export restrictions prohibit us from providing them. You are responsible for ensuring that people you invite into your workspace are authorized to use it and are subject to suitable confidentiality and access requirements.
Your organization is responsible for its users’ conduct, project permissions, integration choices, and instructions. Do not share individual account credentials as a substitute for permitted user accounts. An administrator can manage workspace access, and an employer or other organization may control the data within its workspace. We may request reasonable information to verify the organization, an account’s authority, or authorization to test a particular application.
3. Accounts and security
Provide accurate registration and billing information, keep it reasonably current, and protect your passwords, tokens, and other authentication methods. You are responsible for activity performed through your authorized accounts, except to the extent caused by our breach of this agreement or obligations that cannot be excluded by law. Notify hello@blackbat.dev promptly if you suspect that credentials have been exposed or an account has been compromised.
We may use reasonable measures to verify identity, prevent automated abuse, limit suspicious requests, or restore account access. Such measures do not shift all security responsibility to us. We are not required to resolve an internal ownership dispute by granting access to a person whose authority cannot be verified. Account recovery and organizational ownership changes may require evidence appropriate to the request.
4. Service access and permitted use
Subject to these Terms, your plan limits, and payment of applicable fees, we grant you a limited, non-exclusive, non-transferable right to use the Services for your internal business purposes and authorized testing during the subscription or permitted access period. Documentation, interfaces, and workflows may evolve. We may maintain the Services, correct defects, and change non-material elements without treating each change as a separate amendment.
The Services may explore a web application, interact with pages, create test instructions, generate findings, and preserve run artifacts. Available environments, collaboration features, integrations, run-history windows, and usage allowances depend on your plan or order. Unless expressly agreed in writing, the Services are not a penetration-testing engagement, security certification, accessibility certification, legal compliance review, or guarantee that an application is safe to release.
5. Authorization to test and control of environments
You must own or have clear permission to access and test every application, domain, account, environment, and dataset you submit. That permission must cover the automated browsing, form submissions, requests, screenshots, and other actions you ask the Services to perform. You are responsible for informing relevant personnel and obtaining any permissions required from a hosting provider, application owner, or other affected party.
Use a staging environment, dedicated test accounts, appropriate spending limits, and synthetic data whenever practical. Automated interactions can create records, send notifications, trigger integrations, alter application state, or reach external services. Configure the test scope, exclusions, and account privileges accordingly. Do not authorize purchases, irreversible changes, messages to real users, or other consequential production actions unless you have deliberately arranged the necessary safeguards and authorization. Pause a run if it exceeds your intended scope.
6. Acceptable use and prohibited conduct
Do not use the Services to access another party’s systems without permission; steal information; harvest credentials; evade access controls; distribute malware; facilitate fraud; send unlawful communications; or violate another person’s rights. Do not use the Services for denial-of-service activity, disruptive load generation, or testing that materially harms shared infrastructure. Do not submit content whose processing is unlawful or that you do not have a right to provide.
You may not bypass usage limits, interfere with service operation, probe our systems outside a separately authorized security program, resell access without permission, or misrepresent your identity or affiliation. Reverse engineering is restricted except where applicable law expressly permits it notwithstanding this restriction. We may investigate suspected violations and take proportionate protective action, but do not assume a duty to review every test instruction or monitor all customer activity.
7. Customer data and necessary permissions
"Customer Data" includes application content, test instructions, credentials, logs, screenshots, and other information you or your users submit or authorize the Services to process. As between the parties, you retain your rights in Customer Data. You grant us the limited rights needed to host, transmit, process, reproduce, and display Customer Data to provide, secure, support, and administer the Services in accordance with your instructions and the applicable agreement.
You represent that you have the rights and lawful basis necessary for this processing, including appropriate notices or consents where required. Do not submit unnecessary sensitive or regulated information. We do not acquire ownership of your application or private data simply because the Services visit it. We do not treat these Terms as permission to publish private test content or use it for general-purpose model training; any separate optional training arrangement must be agreed appropriately.
8. Results, AI limitations, and human review
Generated tests, navigation maps, explanations, issue reports, and other outputs may be incomplete, inaccurate, non-unique, or dependent on the particular application state and test configuration. The Services may miss a defect, flag intended behavior, or fail to reach a protected or unsupported page. A successful run does not establish that your product meets every requirement, law, security standard, or business objective.
You are responsible for reviewing findings, validating reproduction steps, and deciding whether and how to change or release your software. Do not use output as the sole basis for a consequential decision. Subject to our underlying intellectual-property rights and third-party rights, you may use the output generated for your account for your business purposes. We do not promise that every output is eligible for intellectual-property protection or free of resemblance to material generated for another user.
9. Trials, free access, and beta features
Free access, trial credits, previews, and beta features are subject to the limits and duration shown when offered. We may change or discontinue a free or experimental offering on reasonable notice where practicable. Free credits have no cash value and cannot be sold or transferred unless we expressly allow it. A free plan does not become a paid subscription without the authorization required for the paid purchase.
Beta features may have reduced reliability, incomplete documentation, or different support and retention limits. Do not rely on a beta feature for critical production obligations unless you have independently evaluated the risk and safeguards. Any different beta terms presented before enrollment apply to that feature. Rights that cannot lawfully be waived remain unaffected.
10. Subscriptions, fees, and taxes
The applicable checkout, order form, or pricing offer identifies the plan, billing period, price, included usage, and any agreed renewal terms. Prices displayed on a marketing page do not by themselves authorize a charge. If you purchase a recurring subscription, you authorize the disclosed recurring charges until cancellation takes effect, subject to applicable notice and consent requirements. We will disclose material renewal terms before the purchase.
Fees are payable in the stated currency using the agreed payment method. You are responsible for applicable transaction taxes other than taxes based on our net income, unless a valid exemption applies. Keep billing details current and promptly raise a good-faith billing dispute with hello@blackbat.dev. We may suspend paid functionality for overdue undisputed fees after reasonable notice and an opportunity to resolve the issue.
11. Usage credits and limits
Some plans meter work using credits or another usage unit. The plan or interface describes the allowance, consumption rules, and any expiration, rollover, overage, or top-up conditions. A longer or more complex run may consume more usage than a short run. Review those conditions before scheduling repeated runs or enabling automation that could increase consumption.
Credits are a contractual service allowance, not currency, a deposit, a financial instrument, or stored monetary value. They may be used only for the eligible Services. We will not silently charge for an overage or automatically purchase additional credits without the authorization disclosed for that feature. If you believe a technical error caused incorrect consumption, contact support with the relevant run identifier so we can investigate and determine an appropriate adjustment.
12. Cancellation, refunds, and plan changes
You may cancel a recurring subscription through the available billing controls or by contacting hello@blackbat.dev. Cancellation generally stops future renewal and leaves access in place for the remainder of the paid period, unless the purchase terms or applicable law provide otherwise. Removing an integration or ceasing to use the product does not necessarily cancel billing; use the cancellation method and retain the confirmation.
Except as required by law, stated in an order, or expressly provided here, fees for a commenced service period and consumed usage are not refundable. This does not limit a remedy for a charge made without authorization or our failure to provide agreed services. If we terminate paid Services for convenience before the prepaid term ends, we will refund the unused prepaid portion for the affected Services. Price increases and material plan changes apply prospectively with notice and a reasonable opportunity to cancel before the new terms take effect.
13. Privacy and data processing
Our Privacy Policy explains our handling of personal information for which we determine the processing purposes. For Customer Data processed on your behalf, the parties’ applicable data processing terms govern their respective responsibilities. Contact privacy@blackbat.dev before submitting personal information that requires a processing addendum or specialized arrangement. A reference to a privacy law in documentation does not itself establish that every compliance requirement has been met.
You are responsible for the lawfulness of your instructions, the personal information in your test environment, and responding to requests for which you are the responsible business or controller. We will provide assistance required by the applicable agreement and law. Neither party will instruct the other to violate applicable privacy requirements. The contact address in these Terms is a business mailing address, not a representation that all data is stored in California or Delaware.
14. Confidentiality
Information that is marked confidential or that a reasonable person would understand to be confidential in the circumstances must be protected with reasonable care and used only for the purposes of the relationship. Confidential information can include non-public application content, credentials, security information, business plans, and technical materials. Access should be limited to personnel and providers who need it for an authorized purpose and are subject to appropriate obligations.
Confidentiality does not cover information that becomes public without breach, was already lawfully known, is independently developed without use of the confidential information, or is lawfully received without a duty of confidence. A party may make a legally compelled disclosure, giving notice when legally permitted and reasonably assisting with protective measures. The duty continues after termination for as long as the information remains confidential, with trade secrets protected as required by law.
15. Our intellectual property and feedback
We and our licensors retain rights in the Services, software, interfaces, documentation, underlying models, methods, and BlackBat AI branding, excluding Customer Data and rights expressly granted to you. You may not remove proprietary notices or use our marks in a way that suggests endorsement without permission. Rights not expressly granted are reserved.
If you voluntarily provide suggestions about improving the Services, you permit us to use those suggestions without an obligation to compensate you, provided that this permission does not give us rights to publish your confidential information or Customer Data. Third-party and open-source components may be subject to their own licenses. Nothing here restricts rights those licenses expressly grant or overrides mandatory statutory rights.
16. Third-party services and integrations
An integration may require you to maintain an account with a separate provider and authorize specific access. You control whether to connect it and are responsible for reviewing the permissions and the provider’s terms. An external service may change, become unavailable, or impose its own limits. We are not responsible for an independent provider’s acts merely because a link or integration is offered.
Where we engage a provider to perform our own service obligations, our responsibilities are governed by this agreement and any applicable data processing terms; this section does not eliminate those responsibilities. External sign-in, payment, and messaging features work only when the relevant provider and account configuration are enabled.
17. Availability, support, and changes
We aim to provide useful and reliable Services, but access may be affected by maintenance, application changes, provider outages, network conditions, or events beyond our reasonable control. Support channels and response commitments are those expressly included in your plan or written agreement. Unless a service-level agreement says otherwise, no specific uptime percentage, response deadline, or recovery objective is promised.
We may update features to improve the Services or address security, legal, or operational needs. For a material reduction in purchased core functionality during a prepaid period, we will provide reasonable notice where practicable and an appropriate remedy consistent with the agreement and applicable law. A roadmap, demonstration, or beta announcement does not create a binding obligation to deliver a future feature on a particular date.
18. Suspension and termination
We may restrict access when reasonably necessary to address a security risk, unlawful activity, a material breach, or unpaid undisputed fees. Where practical and appropriate, we will notify you of the reason and allow an opportunity to cure. Immediate action may be necessary where delay would expose systems, people, or other customers to harm or violate law. We will aim to limit a protective restriction to the affected account or feature where feasible.
Either party may terminate for a material breach that is not cured within a reasonable period after written notice, ordinarily 30 days where the breach can be cured. You may stop using the Services and cancel under the applicable cancellation provisions. Termination does not eliminate fees already properly due or obligations intended to survive, including confidentiality, payment, intellectual-property protections, dispute provisions, and valid liability limitations.
19. Data export and consequences of termination
Before closing an account, use available export features or contact support to discuss obtaining Customer Data that can reasonably be exported. Availability of particular artifacts depends on the plan, retention window, and whether the information has already been deleted in the ordinary course. You should keep independent copies of materials needed for your business, regulatory obligations, or incident investigations.
Following termination, access rights end and we may delete or de-identify Customer Data in accordance with the applicable processing agreement and retention practices. Information required for legal, accounting, security, or dispute purposes may be retained subject to appropriate restrictions. Termination does not permit us to use retained private data for unrelated purposes. We are not obliged to preserve an account indefinitely after the agreed retention period expires.
20. Warranties and disclaimers
Each party represents that it has authority to enter into this agreement. To the maximum extent permitted by law and except for an express written warranty, the Services and generated outputs are provided on an "as is" and "as available" basis. We disclaim implied warranties of merchantability, fitness for a particular purpose, and non-infringement to the extent those disclaimers are lawful.
We do not warrant uninterrupted or error-free operation, complete test coverage, discovery of every vulnerability or defect, or that any particular business outcome will result. These limitations do not excuse fraud, intentional misconduct, or obligations that applicable law does not allow us to exclude. If you are entitled to mandatory consumer warranties or remedies, those rights take priority over an inconsistent disclaimer.
21. Limits of liability
To the maximum extent permitted by applicable law, neither party is liable under this agreement for indirect, incidental, special, consequential, exemplary, or punitive damages, or lost profits, lost business opportunities, or loss of goodwill, even if advised of the possibility. This exclusion does not turn an otherwise recoverable direct loss into an excluded loss merely because it involves data or service interruption.
Except for liabilities that cannot be limited by law, each party’s aggregate liability arising from the Services or these Terms is limited to the greater of US$100 and the amounts paid or payable by you for the affected Services during the 12 months preceding the event giving rise to the claim. Your obligation to pay properly due fees is not reduced by this cap. Nothing excludes liability for fraud, willful misconduct, or other liability that applicable law prohibits limiting. A separately signed agreement may allocate risk differently.
22. Third-party claims and cooperation
To the extent permitted by law, you will defend and indemnify BlackBat AI against a third-party claim arising from your unlawful Customer Data, your unauthorized testing of another party’s systems, or your material violation of the acceptable-use restrictions. This obligation applies only to the extent the claim results from your conduct and not to the extent caused by our own breach, negligence, or misconduct.
We must give prompt notice of the claim, provide reasonable cooperation at your expense, and allow you to control the defense with competent counsel. You may not settle a claim in a way that admits fault on our behalf, imposes a non-monetary obligation on us, or fails to release us without our written consent, not to be unreasonably withheld. This provision does not create an obligation for a consumer that applicable law prohibits.
23. Delaware law and resolving disputes
These Terms are governed by the laws of the State of Delaware, without applying conflict-of-law rules that would require another jurisdiction’s law, except that mandatory protections applicable to you remain in effect. Before bringing a formal claim, the parties will try in good faith to resolve the dispute by sending a written description to the other party’s designated contact and allowing 30 days for a response, unless urgent relief or a filing deadline requires earlier action.
Subject to mandatory jurisdiction rules, disputes will be brought in the state courts located in Delaware or the United States District Court for the District of Delaware, and the parties consent to those courts’ jurisdiction. Nothing prevents seeking appropriate urgent injunctive relief or bringing a permitted small-claims case. These Terms do not impose a mandatory arbitration agreement or waive non-waivable consumer rights. Incorporation in Delaware does not eliminate privacy or other legal obligations arising elsewhere.
24. Updates, general provisions, and notices
We may update these Terms prospectively and will revise the date at the top. We will provide additional notice of material changes when required or appropriate, using the website, account notifications, or email. Changes will not be applied retroactively to resolve an existing dispute. Where affirmative agreement is legally required, we will request it. If you reject a material change, stop using the affected Services and cancel before the change takes effect, subject to your existing rights and the applicable order.
These Terms and incorporated agreements form the agreement for their subject matter. If a provision is unenforceable, the remaining provisions continue to the extent lawful. A failure to enforce a provision is not a waiver. Neither party may assign the agreement without consent except as part of a legitimate merger, restructuring, or sale of substantially all related assets, provided the successor assumes the obligations and the transfer does not unlawfully reduce protections. Neither party is responsible for delay caused by events beyond reasonable control, but must take reasonable mitigation steps; prepaid fees for services permanently not provided remain subject to applicable remedies.
Send contractual notices to legal@blackbat.dev or BlackBat AI Inc., 112 St Malo Ct, Martinez, CA 94553, United States. Privacy requests go to privacy@blackbat.dev and general support to hello@blackbat.dev. We may send notices to the account contact you provide, subject to any more specific contractual or legal delivery requirement. These Terms were last updated in November 2026.