1. Parties, scope and priority
These Terms govern access to the Vidabug website, subscriptions, software discovery, testing, repair proposals, AI-supported analysis, recordings and deliverables. ‘Vidabug’, ‘we’ and ‘us’ refer to Vidabug (registration on request). ‘Customer’ means the entity accepting an order and its authorised users.
An individually signed order form, statement of work, data processing agreement and agreed service-level schedule prevail for their specific subject matter, followed by these Terms, to the extent permitted by law. A marketing demonstration is not an offer to execute unapproved engineering work.
2. Authority and source-code rights
Customer warrants that it owns or has legally sufficient permission to provide each repository, database, document, credential, application and test environment and to authorise the expressly selected activities. Customer must identify any third-party, open-source, regulated, export-controlled or confidential materials subject to additional limits.
Customer retains ownership of its pre-existing source code, data, content, trademarks and documentation. Merely connecting a repository does not transfer ownership or permission to alter the default branch.
3. Approved scope and execution boundaries
Vidabug must not start billable autonomous work without a versioned work order stating the software/repository, exact source commit, permitted test targets, excluded systems, credentials, environment, operations, budget cap and authorised reviewer. Discovering a vulnerability is not permission to exploit it.
Production changes, merges, releases, destructive database actions, external network scans, credential rotation and real-user notifications require a separately recorded approval. Customers must maintain suitable backups and safe staging environments.
4. AI, third-party agents and output quality
Workflows may use third-party AI models, sandbox operators, cloud infrastructure, payment processors and repository hosts under the Customer's selected configuration and applicable data processing terms. Vidabug may use third-party AI engineering providers; the provider used for an engagement must be visible in its processing record.
AI output can be incomplete, mistaken, insecure or unsuitable. A generated finding is a hypothesis, an agent's ‘fixed’ claim is source-reported, and only attached independent verification evidence establishes a separately verified outcome. No representation of complete bug elimination, regulatory certification, penetration-test coverage or uninterrupted operation is made.
5. Customer responsibilities
Customer must maintain accurate authorised user details, restrict workspace permissions, approve changes diligently, avoid placing live personal data in testing unless lawfully justified, and report suspected access misuse without delay.
Customer will not provide passwords or secret keys in prompts; credentials must be handled through the designated secure connection mechanism once available. Features may be paused while we strengthen their safeguards.
6. Fees, subscription renewals and spending controls
Only the price, currency, taxes, quantity, overage schedule, start/end dates, renewal terms and cancellation rules expressly shown in an accepted order apply. Illustrative landing-page prices are non-binding unless stated otherwise.
Where recurring billing is agreed, the checkout or order must clearly show billing cadence, renewal/cancellation method and any usage-based charges. Reserved amounts are not recognised as collected funds until provider verification and ledger reconciliation. Vidabug cannot silently exceed a customer-authorised spend ceiling.
7. Deliverables, reviews and intellectual property
After payment of the applicable undisputed charges and subject to third-party/open-source licences, the Customer receives the rights expressly stated in its order to accepted custom patches, reports, recordings and documentation. Vidabug retains ownership of its platform, general-purpose tools, templates, know-how and pre-existing assets.
Deliverables must identify source revision, relevant test status, known limitations, provenance and any required customer approval. A rendered video or compiled report does not itself prove that all demonstrated workflows succeeded.
8. Confidentiality and data handling
Each party will protect the other's non-public technical, commercial, security and personal data with reasonable care and disclose it only for authorised service delivery, approved subprocessors, legal requirements or an expressly agreed purpose. These duties survive termination for as long as the information remains confidential.
Source archives and outputs are subject to the Privacy Notice and applicable Data Processing Agreement. We will not intentionally use Customer Content to train general-purpose foundation models without a separately documented, informed opt-in; actual third-party configurations and retention require verification before enablement.
9. Acceptable use and suspension
Customers may not use the service to attack systems without authority, spread malware, steal credentials, bypass access controls, run unlawful surveillance, abuse infrastructure or infringe intellectual-property rights. Vidabug may suspend an unsafe job or account, with reasonable notice where feasible, while preserving relevant evidence and legally required rights.
10. Warranties and reasonable limitations
We will perform contracted services with reasonable care and skill. The service is not a substitute for the Customer's professional cybersecurity, legal, financial or compliance judgement. Except for rights that cannot lawfully be limited, no absolute guarantee of zero vulnerabilities, perfect AI accuracy, continuous availability or regulatory compliance is offered.
Any negotiated cap on ordinary contractual damages, and exclusions of indirect losses, apply only as set out in the signed order and only to the extent permitted by law. Nothing excludes liability for fraud, wilful misconduct, or any statutory obligation that cannot legally be excluded. Material risk and limitation provisions must be drawn clearly to the Customer's attention before acceptance.
11. Security incidents and dispute resolution
Suspected incidents should be reported through the security contact identified on the approved company-contact page. We will investigate, preserve appropriate records and notify affected counterparties and regulators when required by applicable law or contract.
The parties will first seek good-faith escalation through designated representatives. Governing law and dispute forum must be stated in the signed order; absent that, proposed South African law and courts are subject to legal review and mandatory consumer rights.
12. Changes, termination and contact
Material changes to fees, data uses, liability allocations or service scope must be disclosed in advance and accepted where required. Existing signed work orders are not unilaterally rewritten by website changes.
The legal operating entity, registration number, physical address, legal-service address, phone, support email and information officer details must be completed before a public launch. See the Company & Legal Notices page.