Terms of service

Article 1

Purpose

These terms govern the use of the LibWatch service (the “Service”), published by I SEE U, a SARL (French limited liability company) with share capital of €200,000, registered under RCS Perpignan 517 980 165, whose registered office is at 3 rue Camille Desmoulins, 66000 Perpignan, France (“I SEE U”). They apply to any organization that creates an account or subscribes to a plan (the “Customer”) and to each person who uses the Service on its behalf (the “User”).

The Service is intended for professionals. By creating an account, or by using the Service, the User accepts these terms and represents that they act on behalf of the Customer and have the authority to bind it.

Article 2

Description of the Service

LibWatch monitors the software dependencies of the Customer's projects: it builds an inventory of them, compares it against public databases of vulnerabilities, end-of-life dates and licenses, and alerts the Customer's team through the channels it chooses (email, Slack, Zulip, webhook). LibWatch reports what needs to be fixed; it does not change any dependency on the Customer's behalf.

Article 3

Account and access

• — The User provides accurate information and keeps their credentials confidential. Any action taken with their account is deemed to have been taken by them.
• — Accounts with administrator rights must enable two-factor authentication.
• — The Customer manages the members of its organization, their roles and their access to projects. The number of members is limited by the seats of its plan.
• — The User notifies I SEE U without delay of any unauthorized use of their account.

Article 4

Access to code repositories

1. 4.1 To analyze a project, the Customer authorizes LibWatch to access its repository (GitHub, GitLab) using the token or authorization it provides.
2. 4.2 This access is used to read the files that describe the project's dependencies (for example Gemfile.lock, package-lock.json, build.gradle). LibWatch does not run any of the Customer's code and installs nothing in its repository or in its continuous integration.
3. 4.3 To rerun the analysis whenever the code changes, LibWatch may register a webhook on the repository. Without this permission, the analysis still works, without automatic reruns.
4. 4.4 For a WordPress site, LibWatch uses the application password provided by the Customer to read the installed plugins, themes and versions.
5. 4.5 The Customer's token is used only for the Customer's projects. It is never shared with a third party or used on behalf of another customer. It is encrypted at rest. The Customer may revoke it at any time; analyses then stop.

Article 5

License to use the integration

1. 5.1 I SEE U grants the Customer a personal, non-exclusive, non-transferable and revocable right to use the Service and its integration with GitHub and GitLab, for the term of its subscription.
2. 5.2 The Customer shall not use the integration to circumvent the usage limits of GitHub or GitLab, or in any manner contrary to their terms of use.
3. 5.3 LibWatch is an independent service: it is not published, endorsed or certified by GitHub, Inc., GitLab Inc. or the other organizations mentioned. The trademarks mentioned belong to their respective owners.

Article 6

Information sent to third-party services

1. 6.1 To look up vulnerabilities, end-of-life dates and updates, LibWatch sends public databases only the name and version of the project's dependencies and languages, never its source code.
2. 6.2 Dependencies that LibWatch identifies as private (hosted outside public registries) are not sent.
3. 6.3 Every night, without reading the repository again, LibWatch re-examines the dependencies already inventoried, in order to report vulnerabilities published since the last analysis.
4. 6.4 The list of databases used and their licenses is on the Data sources page. The service providers that process personal data are listed in the privacy policy and on the Subprocessors page.

Article 7

Plans, prices and payment

1. 7.1 The plans, their limits (seats, projects, analyses) and their prices are those shown on the website at the time of subscription. Prices are stated exclusive of taxes; applicable VAT is added.
2. 7.2 Subscriptions are monthly, payable in advance by card, and renew automatically at each renewal date. Payment is processed by Stripe; LibWatch neither sees nor stores card numbers.
3. 7.3 An organization's first subscription to a plan starts with a 14-day trial period. The card is requested and saved at the time of subscription; nothing is charged during the trial. At the end of the trial, the subscription continues and the price of the plan is charged automatically to that card, then at each renewal date; if this charge fails, Article 8 applies. A Customer who cancels from the Subscription page before the end of the trial is not charged: the plan remains accessible until the end of the trial, then the subscription ends. To continue using the Service afterwards, the Customer subscribes to a plan, without a new trial period. Only one trial period is granted per organization. It does not apply to plans based on a quote or to plans negotiated directly with I SEE U.
4. 7.4 An upgrade takes effect immediately and the difference is charged pro rata for the current period. A downgrade takes effect at the next renewal date.
5. 7.5 Additional seats and analysis packs are purchased from the Subscription page, at the price shown.
6. 7.6 A plan based on a quote (Enterprise plan) follows the terms of the accepted quote: price, commitment period and renewal. Unless the quote states otherwise, the commitment renews automatically for the same period and at the same price, unless it is terminated before it expires.
7. 7.7 A plan negotiated directly with I SEE U and shown in the Customer's account follows the specific terms written there. They prevail over these terms in the event of any conflict.
8. 7.8 A price increase for a plan does not apply to ongoing subscriptions unless the Customer has been informed of it in advance.

Article 8

Failed payment

If a payment fails, the Customer has 7 days to update its payment method. After this period, the subscription is terminated and the paid features are no longer accessible. The Customer's data is kept and the Customer may subscribe again at any time.

Article 9

Term, cancellation and deletion

1. 9.1 Except for a commitment provided for in a quote, the Customer may cancel its subscription at any time from the Subscription page. Cancellation takes effect at the end of the period already paid, which is not refunded: the plan remains accessible until that date, after which nothing more is charged and the organization keeps limited access to the Service, within the limits shown on the Subscription page; its data is kept. Until that date has passed, the Customer may resume its subscription from the same page.
2. 9.2 Each User can export their personal data and delete their account from their profile.
3. 9.3 I SEE U may suspend or close an account that breaches these terms, after a formal notice that has remained without effect for 15 days, or without notice in the event of a threat to the security of the Service or of third parties.

Article 10

Results provided without warranty

1. 10.1 Information about vulnerabilities, versions and licenses comes from third-party public sources. I SEE U cannot guarantee that it is accurate, complete or up to date.
2. 10.2 Some information is estimated (for example the indirect dependencies of a project without a lock file). It is flagged as such.
3. 10.3 The absence of a reported vulnerability does not mean that there is no vulnerability. The Customer remains solely responsible for deciding which fixes to make to its code and for putting them into production.
4. 10.4 Mentioning these sources does not imply any endorsement of LibWatch by the organizations concerned (including the NVD, CISA, MITRE, FIRST, GitHub, Google).

Article 11

Fair use

1. 11.1 The Customer undertakes not to extract in bulk the security data or metadata displayed by LibWatch, nor to redistribute it as a database.
2. 11.2 The Customer shall not attempt to access other customers' data, disrupt the Service or circumvent its technical or commercial limits.
3. 11.3 I SEE U may space out or limit the analyses of a project in order to comply with the usage limits of third-party services.

Article 12

Availability and support

I SEE U uses reasonable efforts to provide continuous access to the Service, without guaranteeing permanent availability. The Service may be interrupted for maintenance, where possible outside business hours. Support is provided by email at bonjour@isee-u.fr, on business days.

Article 13

Liability

I SEE U is bound by an obligation of means (a best-efforts obligation). It may be held liable only for direct damage proven by the Customer, and its liability is limited, for all damages combined, to the amounts paid by the Customer for the Service during the twelve months preceding the event giving rise to the claim. I SEE U is not liable for indirect damage, including loss of revenue, data or reputation, nor for the consequences of a vulnerability that no public source reported.

Article 14

Intellectual property

The Customer remains the owner of its code and data. I SEE U remains the owner of the Service, its software and its content; no rights are transferred to the Customer other than the license to use set out in Article 5.

Article 15

Personal data

I SEE U processes the personal data of Users in accordance with its privacy policy. For the personal data that the Customer entrusts to it (members of its team, alert recipients), I SEE U acts as the Customer's processor within the meaning of Article 28 of the GDPR.

Article 16

Changes to these terms

I SEE U may change these terms. Any material change is notified by email to the administrators of organizations at least 30 days before it takes effect. A Customer who does not accept it may cancel its subscription before that date.

Article 17

Governing law and disputes

These terms are governed by French law. Failing an amicable settlement, any dispute relating to their interpretation or performance falls within the exclusive jurisdiction of the Commercial Court (tribunal de commerce) of Perpignan.