Terms & Conditions

These Terms & Conditions (the “terms”) govern the relationship between the user and the operator of the WebSeed platform named in “Provider details” (the “Provider”) concerning the use of WebSeed. “User” means the natural person using the platform and the organisation on whose behalf that person acts. These terms apply only to this service. The “Acceptable use” and “Sharing, collaboration and invited clients” sections are particularly relevant because the user can share sitemaps with people who have no account and can bring the user's own clients into the service. Provisions that depart from standard contractual practice appear in separate boxes marked “Highlighted clause” so that the user can review them before creating an account.

1. Provider details

The WebSeed service is provided by the Provider, Galcsik Győző Korlátolt Felelősségű Társaság (registered seat: 1063 Budapest, Szív utca 16. I. em. 17. ajtó, Hungary; registered by Fővárosi Törvényszék Cégbírósága, company registration number: 01-09-389812; tax number: 27431913-2-42; chamber membership: Budapesti Kereskedelmi és Iparkamara; represented by: Galcsik Győző, managing director; email: [email protected]). The service is available at https://webseed.app and the language of the contract is Hungarian.

2. Scope of these terms and formation of the contract

WebSeed is a hosted service for planning the sitemap of a website together. The user's team edits one sitemap per project on a canvas: it arranges pages and subpages, places blocks of the planned content on them, writes notes and draws connections that mark user journeys. Team members can edit the sitemap live at the same time, discuss it in comments, restore earlier states, export the result, and show it to their clients through a read-only link or an invitation in the client role. The user can also connect AI agents with an API key; they read and edit sitemaps on the user's behalf.

These terms are the entire agreement between the user and the Provider for this service. They apply only to WebSeed; a separate contract between the user and the Provider concerning another matter is outside their scope.

The user accepts these terms when the user's account is created. When accepting an invitation, before setting a password or signing in with the user's Google or Microsoft account, the user must tick a mandatory checkbox with this text: “I have read and accept the Terms & Conditions, including the highlighted clauses on limitation of liability and changes to the terms, and I have read the Privacy Policy.” The full text of both documents can be opened with one click from the checkbox label, so the user can read them before ticking it. An account cannot be created unless the checkbox is ticked. The Provider records the time of acceptance and the version of the terms accepted against the user's account. Continued use of the service constitutes acceptance of the terms then in force, subject to the limits described in “Changes to these terms”. If the user accepts the terms for an organisation, the user confirms that the user is authorised to bind it, and the term “user” also includes that organisation.

WebSeed is intended for business users. The Provider intends the service for agencies, companies, sole traders and others acting in the course of their trade, business or profession. Whether the user is a consumer depends not on a declaration but, under Polgári Törvénykönyv 8:1. § (1) bekezdés 3. pontja, on whether the user uses the service for purposes outside the user's trade, independent profession or business. An invited client may also be an individual. If the user is a consumer, the “Consumer provisions” section below also applies to the user, and the user's rights under mandatory law remain unaffected.

How the contract is concluded: a WebSeed account is created through an invitation to a team; the Provider currently creates a team for an organisation that requests one. When accepting the invitation, the user completes the form, can review and correct the information the user entered before submitting it, and ticks the checkbox described above. The contract is concluded when the account is created, which the Provider confirms immediately in the interface. The language of the contract is Hungarian. It is not a written contract for the purposes of Hungarian law, and the Provider does not file it separately; the Provider does, however, record the time of acceptance and the version accepted against the user's account. These terms remain available at this address, can be downloaded and stored, and the Provider keeps every earlier dated version. On request, the Provider will send the user the accepted version. The Provider has not subscribed to any code of conduct.

3. Accounts, teams and roles

The service is organised into teams. A team owns projects, and every project is one sitemap. What the user can do depends on the role the user holds in a team; one person can belong to several teams, with a different role in each.

• The user must give accurate registration details and keep them current.
• The user is responsible for all activity through the user's account and for keeping login credentials confidential. The user must notify the Provider without delay if unauthorised access to the account is suspected.
• The user can sign in with a password, or with the user's Google or Microsoft account. Signing in with a provider does not create an account on its own: it only signs the user in to an account that already exists or that the user has been invited to.
• The team owner decides who belongs to the team, what each person may do, and what happens to the team's content. If the user joined a team someone else owns, that owner controls the content, not the Provider.
• Seats count owners and members. Client and agent accounts have their own separate limits under the team's plan.
• A client the team invites is a user under these terms just like a member; the inviting team is responsible for whom it invites and what it makes available to them.
• The user must be at least 16 to hold an account.

4. Introductory (alpha) period

WebSeed operates in an introductory, alpha period. The service is usable and the Provider uses it daily, but it is still under development. This section sets out what this means for the user.

• Features may change, move or be withdrawn, sometimes at short notice.
• Defects may occur. If a defect causes the user to lose work, the Provider will try to correct it promptly when the user reports it, but cannot promise that this will not happen.
• There is no service level agreement and no uptime guarantee.
• The user is advised to keep a separate copy of any sitemap whose loss would be unacceptable. “Backups, version history and export” describes the available options.

While the service is in alpha and free, the Provider may amend these terms as they apply to business users with effect upon publication under paragraph a) of “Changes to these terms”. The stricter rule set out in “Data processing terms (GDPR Article 28)” applies to that section. The Provider will notify the user at least 30 days before the alpha period ends and standard commercial terms begin. Paragraph b) of “Changes to these terms” applies to consumers even during the alpha period; nothing in this section reduces the rights consumers have under mandatory law.

5. Plans and limits

The service is organised into tiered plans. A plan sets the number of active and archived sitemaps, the number of pages in one sitemap, the number of seats, agents and client accounts, storage, the number of share links live at the same time, the number of versions kept, the available export formats, and whether clients may comment and whether the team may create API keys. The limits applying to the user's team and their usage are shown in the team settings. The Provider sets the team's plan; the user cannot switch plans in the interface.

• Seats count owners and members. Agents and client accounts have separate limits.
• When the user reaches a limit the Provider blocks the action that would exceed it and says so in the interface. The Provider never deletes an existing sitemap, page, member or link in order to enforce a limit.
• If the user's team moves to a smaller plan while above its limits, existing content is kept; the user can add more only once back within the limit. The one exception is version history: at the next snapshot the system deletes the oldest snapshots beyond the plan's limit, so a state worth keeping should be exported before a plan change.

6. Fees

The service is free during the introductory period; the Provider charges no fee. WebSeed currently has no payment system: the Provider does not store card details, subscriptions do not renew automatically, and the Provider cannot collect money from the user. The Provider will publish the fees of paid plans on its website when it introduces them; these terms contain no prices.

The following terms apply from the introduction of paid plans. The Provider will notify the user at least 30 days before any of them applies to the user:

• Paid plans will be invoiced in advance for the subscription period. Prices will be quoted net of VAT, added at the statutory rate.
• Invoices will be due within 15 calendar days of issue unless agreed otherwise in writing.
• Late payment carries default interest under the Hungarian Civil Code (Polgári Törvénykönyvről szóló 2013. évi V. törvény 6:155. §), and, in a business-to-business relationship, the flat-rate debt recovery charge under 2016. évi IX. törvény on Flat-Rate Debt Recovery Costs. The Provider may suspend performance until the arrears are paid.
• A subscription will not renew automatically. The Provider will send an offer for the next period at least 30 days before the current one ends, and the subscription continues only if the user accepts it.
• If a renewal goes unpaid the Provider may suspend the account, after a reminder and 15 calendar days' grace. A suspended account's data is kept for 30 days, during which payment restores it, and the Provider will warn the user at least 15 days before deleting anything. Non-payment 30 days into suspension ends the contract, and the export window in “Suspension and termination” then starts.
• A price change will take effect only at the user's next renewal, never inside a period the user has already paid for.

The Provider never moves the user from a free plan to a paid plan without the user's prior consent.

7. The user's content and the platform's software

The user retains ownership of the user's content. Sitemaps, page names and descriptions, blocks, notes, comments, an uploaded logo and everything else the user creates in WebSeed remain the user's property. The user grants the Provider only the licence needed to host and process that content, synchronise and display it among team members and the recipients the user chooses, back it up and export it, in order to provide the service. The licence does not extend beyond that purpose or survive closure of the account.

The Provider does not use the user's content to train machine-learning models and does not pass it to any provider of artificial intelligence. If the user connects an AI agent under “API access and AI agents”, the content that agent reads goes to a provider of the user's choice; that is the user's decision and responsibility.

The WebSeed software, its source code, architecture, interface, block catalogue and drawings, and documentation, as well as the WebSeed name and logo, are the property of the Provider; the software is protected by szerzői jogról szóló 1999. évi LXXVI. törvény (Szjt., the Hungarian Copyright Act). Third-party components used in the software under licence remain the property of their respective rights holders and are subject to their own licence terms. Use of the service gives the user a non-exclusive, non-transferable and non-sublicensable right to use the hosted service for as long as the user's account is open. It grants no licence to the software itself or access to its source code. The files the user exports (JSON, CSV, images, PDF, build brief) carry the user's content, and the user may use them freely.

• The user may not copy, reverse-engineer, modify or make derivative works of the software, except where mandatory law expressly permits it.
• The user may not resell or sublicense the service, or offer it to third parties as the user's own.
• The user may not use the service to create a competing service by copying its interface, operation or data structure.
• The user may export the user's content at any time while the user's account is open.

To the best of the Provider's knowledge, the software does not infringe any third party's copyright or other intellectual property rights. If a third party brings a substantiated claim against the user in connection with the software, the Provider will cooperate with the user and replace the affected element with a lawful alternative within a reasonable time. The Provider's liability otherwise remains subject to “Limitation of liability”.

The Provider may identify a business user as a customer by name and logo in the Provider's own marketing and will stop on written notice from the user. The Provider uses the user's sitemaps, notes, comments or other content in the Provider's own marketing or public communications only with separate written consent.

8. Acceptable use

The user must not use WebSeed to:

• Break the law, or infringe anyone's intellectual property, privacy or other rights.
• Upload or distribute malware, or content that is unlawful, defamatory or harmful, including through a sitemap shared with a share link.
• Attack, overload or probe the service, or attempt to reach another team's data or to guess a sitemap's share link.
• Circumvent plan limits, or share a single account among people who should each hold their own.
• Record personal data in a sitemap or in comments without a lawful basis to process it, or share such content with a link.
• Harass another person through comments or mentions.

The Provider may suspend an account that breaches this section, and where the breach is serious or ongoing the Provider may do so without prior notice. The Provider may also revoke the share link of infringing content.

9. Sharing, collaboration and invited clients

What the user shares, others see. WebSeed makes a sitemap accessible to others in three ways: team membership, an invitation in the client role, and a public, read-only share link. The user decides on all three, and the user is responsible for all three.

• Share link. A user with edit rights can create a public, read-only link to the sitemap, with or without an expiry. Anyone who receives the link can view the project name and the sitemap with its notes, but not the comments, without signing in, and, if live collaboration is on for the team, follows changes live. The Provider does not know to whom the user passed the link and processes no account data about those who open it. The link can be revoked at any time; the shared page then cannot be opened. The team's plan limits the number of links live at the same time.
• Invited clients. The team can invite people in the client role to selected projects. The client creates an account and is a user under these terms: the client can view and export the sitemap and, when the team's plan includes it, write comments; the client cannot edit. The team that invites a client is responsible for the client being entitled to view the project, and for the client knowing with whom they are working on it.
• Live collaboration. While the user has a sitemap open, the other signed-in participants of the project see the user's name, avatar, cursor, selection and which element the user is editing; a guest arriving through a share link sees none of this, only the number of editors. An element another person is currently editing or moving is temporarily locked for everyone else. The user can keep editing the local copy stored in the editor's browser during a connection outage; the changes merge with the others' work when the connection returns.
• Comments. A comment is attached to a point, card, block or note on the sitemap, and every participant of the project who may comment can read it. The user can mention teammates; the mentioned person and the author of a replied-to comment are notified. The user can edit and delete the user's own comments; nobody edits other people's words. Owners and members can resolve, move and delete threads; a client can do so with the threads the client started.

The user must inform those with whom the sitemap is shared, the invited clients and the recipients of a link, that the sitemap is stored in WebSeed, on the infrastructure of the Provider's sub-processors, and that their comments are visible to the other participants of the project. If the sitemap or the comments contain personal data, the user's organisation, as controller, is responsible for the lawfulness of the sharing.

The Provider may revoke a share link, or suspend an account, where the Provider has reason to believe this section or “Acceptable use” is being breached.

10. API access and AI agents

When the team's plan includes it, the user may create API keys so that scripts and AI agents can read and edit the user's sitemaps through the Model Context Protocol (MCP) interface. A key acts either on the user's own behalf or on behalf of an identity in the agent role that the user creates and owns. The user is responsible for the agent's actions.

• A key inherits the permissions of the identity it acts as and never exceeds them. An agent's permissions are narrowed to its owner's current role and project scope: if the owner's access ends or narrows, so does the agent's.
• Everything an agent does, whether changing the sitemap, adding pages or commenting, is attributed to it and counts as the user's own act. An agent receives no notifications and cannot be mentioned in a comment.
• The key's permissions (reading, replacing the whole sitemap, adding pages) can be switched off individually by the key's owner or a team administrator. The user must keep keys secret and revoke any that are no longer needed or may have leaked.
• The Provider is not responsible for content an agent writes into WebSeed, such as a page structure or text suggested by an artificial intelligence; the user checks it. What an agent reads from WebSeed goes to the provider of the user's choice that operates the agent; that provider is not the Provider's sub-processor.
• Agents must not be used to circumvent plan limits or to place load on the service beyond ordinary use.

11. Availability and maintenance

The Provider aims to keep the service continuously available, but the Provider does not guarantee 100% availability and the Provider offers no service level agreement unless one is separately agreed in writing.

• The service runs on third-party cloud infrastructure: the application and the database on Railway, live collaboration and file storage on Cloudflare, email delivery on Resend. The user has no direct contractual relationship with those providers.
• If live collaboration is unavailable, the application keeps edits in the user's browser and synchronises them when the connection returns; a sitemap working without live collaboration autosaves to the Provider's database. Simultaneous editing without live collaboration can cause a conflict, which the application reports, and the later saver's change does not overwrite the earlier save.
• The Provider gives advance notice of planned maintenance where the Provider reasonably can.
• The Provider is not liable for interruptions outside the Provider's control, including failures at an infrastructure provider, denial-of-service attacks, network outages or natural disasters. The exclusion for failures at an infrastructure provider applies only to businesses; if the user is a consumer, the Provider is liable for a provider the Provider engages as if the Provider had acted itself.

12. Backups, version history and export

The Provider keeps backups of the production database as part of operating the service. They are a disaster-recovery measure for the Provider, not a file-recovery service for the user, and they do not replace the user's own copies of any sitemap the user cannot afford to lose.

Version history keeps earlier states of the sitemap: the system takes a snapshot automatically, at most every 10 minutes, and whenever the user saves manually or restores. The team's plan limits the number of snapshots kept; beyond the limit, the oldest snapshot is deleted. Version history ends with the deletion of the project, so it does not replace an export.

The user can export the sitemap at any time from the browser: as JSON (the whole document, which can also be imported back), CSV, PNG, SVG and PDF, and as a build brief for developers in JSON and Markdown. Exports are produced on the user's device; the Provider's servers take no part in them. The available formats depend on the team's plan; the JSON export is available on every plan. Regular export is advisable.

If data is lost the Provider will try to restore from the most recent valid backup, but the Provider cannot guarantee complete recovery.

13. Support

Support is by email at [email protected] during Hungarian business hours, and the Provider aims to answer within two business days. Support covers using the service and faults in it. It does not cover designing or building the user's website, content production, professional review of sitemaps, or the operation of AI agents the user has connected.

14. Data protection

How the Provider handles personal data is set out in the Provider's privacy notice. For content created in the service, the Provider acts as a processor under GDPR Article 28; the applicable provisions are in the “Data processing terms (GDPR Article 28)” section below, which forms part of these terms and constitutes a data processing agreement. The Provider does not enter into individually negotiated data processing agreements.

15. Data processing terms (GDPR Article 28)

When the Provider acts as the user's processor, the following terms apply. They form part of these terms and constitute a data processing agreement under GDPR Article 28(3). The controller is the organisation on whose behalf the team owner uses the account; if the user uses the service on the user's own behalf, the user is the controller. In this section, “the user” means that controller.

How this section may change. This section may be amended with the rest of these terms under “Changes to these terms”, subject to two exceptions that apply even during the alpha period. First, the Provider will make an amendment that reduces the level of protection of personal data promised here, particularly one affecting security measures, incident notification, rules for engaging sub-processors, the Provider's duties to assist, or the Provider's undertakings to return and delete data, only after giving at least 30 days' notice by email before it takes effect. If the user objects in writing before such an amendment takes effect, it will not apply to the user, and either party may terminate the contract on its effective date; the termination provision below then governs the data. Second, amendments that increase protection or implement changes in law or regulatory requirements take effect on publication. The Provider records the version accepted by the user against the account and sends it on request.

• Subject matter and duration: providing WebSeed, for as long as the user's account is open.
• Nature and purpose: storing and displaying the sitemaps, version history and comments the user's team creates, synchronising them in real time among team members, and sharing them at the user's initiative.
• Categories of data subjects: the user's staff, the user's clients, and any individuals whose personal data the user's team writes into the sitemap, its notes or the comments. Types of personal data: names, email addresses, avatars, comments and mentions, and any data in page names and descriptions, blocks and notes. The service is not intended to process special categories of personal data; if the user's team records such data, the user is responsible for the legal basis for processing it.
• The Provider processes personal data only on the user's documented instructions, which the user's use of the service constitutes, unless Union or Member State law requires otherwise, in which case the Provider tells the user before processing, where that law allows the Provider to.
• The Provider informs the user without undue delay if, in the Provider's view, an instruction from the user infringes the GDPR or other data protection law.
• Everyone with access is bound by confidentiality.
• The Provider applies the technical and organisational measures described in the “Data security” section of the privacy notice, proportionate to the risks and reasonably available, in accordance with GDPR Article 32. The Provider does not guarantee any particular security outcome, especially complete protection against every attack.
• The Provider engages sub-processors under the general written authorisation the user gives by accepting these terms: only the providers listed in the “Annex: sub-processors” section. The Provider notifies the user by email at least 30 days before a planned change takes effect, whether the change is the engagement of a new sub-processor, activation of a previously announced provider or replacement of an existing one, and gives the user an opportunity to object. A provider announced in the annex does not process personal data until activated. If the user objects on reasonable data protection grounds and the Provider cannot offer an alternative, the user may terminate the affected subscription; the Provider refunds prepaid fees for the unused period pro rata. Sub-processors are subject to data protection obligations at least equivalent to those undertaken here, and the Provider is responsible for their activities.
• Taking account of the nature of the processing, the Provider assists the user, at the user's reasonable and substantiated request, with data subject requests, breach notifications and impact assessments. If this requires substantial extra work beyond the normal operation of the service, the Provider may ask the user to reimburse the Provider's costs.
• The Provider notifies the user of a personal data breach without undue delay, and in any event no later than 72 hours after becoming aware of it, and provides the information available to the Provider that the user needs to meet the user's own notification obligations.
• On termination, the Provider deletes or returns the user's data at the user's choice, subject to the export window in “Suspension and termination”, unless Union or Member State law requires the Provider to store it.
• The Provider demonstrates compliance through the Provider's documentation and written responses, and makes available the information necessary to demonstrate fulfilment of the obligations laid down in GDPR Article 28. An on-site or systems audit may take place only where a supervisory authority or law requires it, or where the documentation is demonstrably insufficient: no more than once a year, on at least 30 days' prior written notice, during business hours, without undue disruption to operations, and at the requesting party's expense.
• The Provider primarily uses data centres within the European Union. The Provider transfers data to a third country only with safeguards under GDPR Chapter V, as described in the “Recipients and international transfers” section of the privacy notice and the “Annex: sub-processors” section.
• These terms are governed by the GDPR and Hungarian law, in particular the Infotv. Matters not covered here are governed by the other provisions of these Terms & Conditions; where they conflict on data protection matters, this section prevails.

16. Suspension and termination

The user may request closure of the user's account at any time at the email address given in “Contact”; the Provider will fulfil the request without undue delay, no later than 15 days after receiving it, and confirm the closure to the user. The team owner may also permanently delete projects and all their contents at any time in the project settings. On a free plan, closure takes effect immediately. On a paid plan, it takes effect at the end of the paid period, and fees for the unused part are not refunded except where mandatory consumer law requires it or where the user terminates because of a materially adverse amendment or an amendment to the data processing terms to which the user has objected.

Either party may terminate immediately for material breach that the other has not remedied within 15 days of being asked to. The Provider may suspend or terminate immediately for a serious breach of “Acceptable use” or “Sharing, collaboration and invited clients”.

After termination the user may request an export of the user's data for 15 days. After that the Provider deletes it in line with the retention periods in the Provider's privacy notice. Sitemap content and comments the user created in the team's projects remain as the team's content, at the disposal of the user's organisation.

17. Warranties and disclaimers

The Provider provides the service with reasonable skill and care, and the Provider will deal with defects reported to the Provider within a reasonable time. Beyond that, and to the extent the law permits, the service is provided as-is: the Provider does not warrant that it will be uninterrupted or error-free, that exported files will look the same in every external program, or that a website built from the sitemap will be fit for any purpose.

Nothing here limits any statutory warranty that cannot be excluded, including the conformity rights a consumer has for digital services.

18. Limitation of liability

Highlighted clause: limitation of liability. If the Provider performs defectively, the user is primarily entitled to rectification: the Provider will correct a defect in the service the Provider expressly undertook to provide at the Provider's own expense and within a reasonable time. Beyond that, as against a business user and to the extent Hungarian law permits, the Provider's total liability arising out of or in connection with the service is limited to the net fees the user paid the Provider in the 12 months before the event giving rise to the claim, or EUR 100, whichever is higher. The minimum amount applies when the service is free and the user has paid no fees. This liability cap does not apply to a consumer; the consumer paragraph below and “Consumer provisions” govern the Provider's liability to consumers. The user expressly accepts this provision by ticking the checkbox when creating the user's account.

As against a business user, the Provider is not liable for:

• Content created by the user or the user's team, and its lawfulness, including content written by AI agents on the user's behalf.
• Loss caused by third-party services, including infrastructure providers, domains, and the AI agents the user has connected and their providers.
• Passing a share link or an invitation to a person who was not entitled to it, and the consequences of that.
• Defects caused by the user's or a third party's intervention, or by use of the service contrary to its intended purpose.
• Breach of contract caused by a circumstance outside the Provider's control that was unforeseeable when the contract was concluded (force majeure), if the Provider could not reasonably have been expected to avoid the circumstance or prevent the damage.
• Lost economic benefit, indirect or consequential loss, including lost profit, business interruption and loss of data, beyond what is stated above.

The liability cap and exclusion list above, including the exclusions of lost economic benefit and indirect and consequential loss, do not apply to a consumer. The Provider's liability to a consumer is governed by the Polgári Törvénykönyv: for defective performance, the consumer is primarily entitled to rectification; the Provider is released from liability if the Provider proves that the breach was caused by a circumstance outside the Provider's control that was unforeseeable when the contract was concluded and that the Provider could not reasonably have been expected to avoid or to prevent the damage (6:142. §); for loss beyond damage to the subject matter of the service, including lost economic benefit, the Provider compensates the consumer to the extent that the loss was foreseeable as a possible consequence of the breach when the contract was concluded (6:143. §); and the Provider is liable for a contributor it engages, including an infrastructure provider, as if the Provider had acted itself (6:148. §).

Nothing in these terms excludes or limits liability that cannot lawfully be excluded. Under Polgári Törvénykönyv 6:152. §, the Provider does not limit liability for breach of contract caused intentionally or resulting in harm to human life, bodily integrity or health; claims that consumers have under mandatory law are likewise unaffected.

The user indemnifies the Provider against third-party claims arising from the user's content, or from the user's use of the service in breach of “Acceptable use” or “Sharing, collaboration and invited clients”. This does not apply to consumers.

19. Confidentiality

Each party keeps the other's business secrets confidential. The Provider uses the user's data, content and business information only to run the service, and discloses it to no one except the sub-processors listed in “Annex: sub-processors”, the recipients the user chooses, namely those to whom the user gives a share link, whom the user invites as clients or whom the user connects with an API key, or where the law requires. The naming right in “The user's content and the platform's software” is the only exception, and the user can switch it off. The duty of confidentiality survives termination of the contract without any time limit. It does not apply where disclosure is required by law, a court or an authority; in that case, the disclosing party notifies the other party before disclosure if the law permits.

A sitemap is private by default: only team members and the clients assigned to the project see it. Creating a share link is the user's decision to make the sitemap viewable by anyone who obtains the link. The Provider does not pass the link on to other websites and keeps the shared page out of search engines, but cannot prevent the link from being forwarded. If this is unacceptable for a project, an invitation in the client role, which is tied to an account and an access check, should be used instead of a link.

20. Consumer provisions

Most of the Provider's customers are businesses, but an invited user may also be an individual. If the user uses the service for purposes outside the user's trade, independent profession or business, the user is a consumer under Polgári Törvénykönyv 8:1. § (1) bekezdés 3. pontja, and the following provisions apply in addition to those above. In the event of a conflict, this section and mandatory consumer protection law, including the rules on unfair terms in consumer contracts in Polgári Törvénykönyv 6:104. §, prevail over the other provisions of these terms. The liability cap and exclusion list for businesses in “Limitation of liability”, including the exclusions of lost economic benefit and indirect and consequential loss, do not apply to a consumer. The Provider is liable to a consumer under the Polgári Törvénykönyv: for defective performance, the Provider first provides rectification; the Provider is released from liability only for a circumstance outside its control that was unforeseeable when the contract was concluded and could not be avoided or prevented (6:142. §); the Provider compensates loss beyond damage to the subject matter of the service and lost economic benefit to the extent foreseeable when the contract was concluded (6:143. §); the Provider is liable for a contributor it engages as if the Provider had acted itself (6:148. §); and the Provider does not limit liability for an intentional breach or a breach causing harm to human life, bodily integrity or health (6:152. §). Even during the alpha period, the Provider amends these terms as they apply to consumers only under paragraph b) of “Changes to these terms”: for the reasons listed there, with at least 15 days' prior notice by email. Neither the consumer's silence nor continued use of the service constitutes acceptance of an amendment.

• The service is currently free, so the right of withdrawal has no application at present. If the user takes out a paid subscription in the future, under 45/2014. (II. 26.) Korm. rendelet the user may withdraw from it as a distance contract without giving a reason within 14 days of concluding the contract. If the user asks the Provider to start the service within that period, the user must pay a proportionate amount for the service received before withdrawal. To withdraw, a clear statement sent to the email address in “Provider details” is sufficient.
• Defective performance: while the service is free, the Provider processes account data and technical logs solely to provide and secure the service, including compliance with the Provider's obligation under GDPR Article 32, and for no other purpose. Accordingly, the contract is outside the scope of 373/2021. (VI. 30.) Korm. rendelet on the detailed rules for contracts between consumers and businesses concerning the sale of goods and the supply of digital content and digital services (1. § (3) bekezdés), while the statutory warranty rules of the Polgári Törvénykönyv apply to contracts for consideration. The user nevertheless has the right to the defect correction the Provider undertakes in “Warranties and disclaimers”. If the user pays for the service in the future, the user will have the statutory warranty rights under the Polgári Törvénykönyv and 373/2021. (VI. 30.) Korm. rendelet: the user may request rectification; if that is impossible or the Provider does not undertake it, the user may seek a proportionate price reduction and, ultimately, withdraw from the contract.

The user may submit a complaint to [email protected]; the Provider will respond to the substance of a written complaint within 30 days. If the Provider cannot resolve it between the parties, the user may turn to a conciliation board (békéltető testület): the Budapesti Békéltető Testület competent for the Provider's registered seat (1016 Budapest, Krisztina krt. 99. I. em. 111.; mailing address: 1253 Budapest, Pf. 10.; telephone: +36 1 488 2131; [email protected]) or the board competent for the user's domicile or place of residence. The Provider is obliged to cooperate in its proceedings. The user may also initiate proceedings before the consumer protection authority (the government office competent for the user's domicile) or a court.

21. Changes to these terms

The Provider may amend these terms where a change in law or regulatory practice warrants it; where the Provider changes, adds or withdraws a feature; where necessary for security or to prevent abuse; where the cost of providing the service changes; or where a provision needs clarification or correction. The procedure and notice period depend on whether the user is a business or a consumer and whether the service is free or paid, as set out in paragraphs a), b) and c) below. Amendments to “Data processing terms (GDPR Article 28)” are also subject in every case to the stricter rule in that section.

Highlighted clause: a) amendments for businesses during the alpha period. While the service is in alpha and free, the Provider may amend these terms as they apply to business users at any time, and an amendment takes effect when published at this address. The exception is “Data processing terms (GDPR Article 28)”: the Provider may reduce the level of protection in that section only after giving at least 30 days' prior notice as described there. The Provider will notify account holders by email or in the app where reasonably possible; the Provider publishes every version with an effective date and version number. If the user does not accept an amendment, the user may stop using the service and request closure of the user's account; continued use of the service constitutes acceptance of the amended terms. The user expressly accepts this provision by ticking the checkbox when creating the user's account.

b) Amendments for consumers at all times. As against a consumer, including during the alpha period, the Provider amends these terms only for the reasons listed above. The Provider notifies the consumer by email at least 15 days before the amendment takes effect and states what is changing. Neither the consumer's silence nor continued use of the service constitutes acceptance of the amendment. If the consumer does not accept it, the consumer may terminate the contract free of charge before it takes effect; the Provider then closes the consumer's account.

c) Amendments during paid periods. From the introduction of paid plans, the Provider amends these terms as they apply to all users only for the reasons listed above. The Provider notifies account holders by email at least 30 calendar days before an amendment takes effect and states what is changing; the consumer's notice period then increases from 15 to 30 days. An amendment does not apply retroactively to a period already paid for. If the user does not accept an amendment, the user may terminate the contract before it takes effect. Continued use afterwards by a business user constitutes acceptance; under paragraph b), continued use by a consumer does not. An amendment materially adverse to the user takes effect for the user's team only at the start of the next paid period. If the user terminates because of such an amendment, the Provider refunds the fees for the unused part of the period already paid for, pro rata.

This section does not affect a consumer's rights under mandatory law. Each version is published at this address with its effective date, in a form the user can download and store. The Provider sends a copy of the version accepted by the user on request.

22. Governing law and disputes

These terms are governed by Hungarian law, in particular the Civil Code (Polgári Törvénykönyvről szóló 2013. évi V. törvény), the Copyright Act (szerzői jogról szóló 1999. évi LXXVI. törvény) and the Act on Electronic Commerce Services (elektronikus kereskedelmi szolgáltatásokról szóló 2001. évi CVIII. törvény). In consumer relationships, the Consumer Protection Act (fogyasztóvédelemről szóló 1997. évi CLV. törvény) and 45/2014. (II. 26.) Korm. rendelet also apply. The Provider excludes the application of private international law conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods.

The parties seek to settle disputes primarily through negotiation. If negotiations do not resolve a dispute, the Hungarian court with jurisdiction and competence shall hear it.

If the user is a consumer, this does not deprive the user of the protection of mandatory provisions of the law of the user's country of residence, nor of the user's right to bring proceedings before the user's local courts.

If any provision of these terms is held invalid, the rest remains in force and the invalid provision is replaced by the lawful term closest to its intended effect.

The parties communicate primarily by email and accept statements made by email as written communications. The Provider may use contributors to provide the service, including the sub-processors named in “Annex: sub-processors”; as regards consumers, the Provider is liable for those contributors as if the Provider had acted itself, while “Limitation of liability” applies as regards businesses.

23. Contact

Questions about these terms may be sent to [email protected], or by post to the Provider at the registered seat given in “Provider details”.

24. Annex: sub-processors

This annex has two parts. The first lists the sub-processors the Provider currently engages to deliver the service. The second lists providers announced in advance that the Provider may engage in the future; they process no personal data until activated. Each entry states the purpose for which the Provider engages or would engage that provider; not every provider processes data for every account. No provider processes personal data on the Provider's behalf without a data processing agreement under GDPR Article 28. This list is current as of the date at the top of the page.

Sub-processors currently engaged. The Provider currently engages the following sub-processors to deliver the service:

• Railway Corp. (United States), the service's hosting provider under 2001. évi CVIII. törvény 4. § on electronic commerce services. Registered address: 2093 Philadelphia Pike #1330, Claymont, DE 19703, United States; email: [email protected]. Purpose: application hosting and the managed PostgreSQL database that stores accounts, teams, sitemaps, versions, comments, notifications and invitations; the application's logs. Data processed: all service data. Location: servers in the European Union (Netherlands). Safeguard: Standard Contractual Clauses forming part of Railway's data processing agreement.
• Cloudflare, Inc. (United States). Purpose: DNS, CDN and DDoS protection for the webseed.app domain; object storage (R2) for uploaded files (avatars, team logos); the live collaboration service (Workers and Durable Objects at live.webseed.app), which handles the state of sitemaps being edited together and presence data. Data processed: traffic metadata and IP addresses; uploaded files; the content of sitemaps in live collaboration, the participants' identifier, name, avatar, role and presence data. Location: EU edge processing; file storage in the European Union (Western Europe); collaboration rooms in data centres placed under the jurisdiction of the European Union. Safeguard: certification under the EU-US Data Privacy Framework and Standard Contractual Clauses.
• Resend (Plus Five Five, Inc., United States). Purpose: sending invitation, password reset and notification emails. Data processed: recipient name and email address, email content (project name, the acting person's name, a short excerpt of the comment). Location: United States. Safeguard: certification under the EU-US Data Privacy Framework; its data processing agreement also includes Standard Contractual Clauses.

Sub-processors announced in advance. The Provider does not currently engage the following providers; listing them gives advance notice under GDPR Article 28(2). A provider announced in advance does not process personal data until the Provider activates its engagement. The Provider notifies account holders of activation by email at least 30 days before engagement, through the usual channel under “Data processing terms (GDPR Article 28)”. The user has the same right to object and terminate as when a new sub-processor is engaged. Until activation, the provider is not listed among the recipients in the privacy notice.

• Hetzner Online GmbH (Germany). Purpose: cloud servers, hosting and backups. Data processed: all service data if a system or backup instance runs there. Location: data centres in the European Union. Safeguard: no transfer to a third country; EU data processing agreement.
• Vercel Inc. (United States). Purpose: hosting and edge delivery of web interfaces. Data processed: traffic metadata and IP addresses for the interface served there, and data processed by any application component running there. Location: United States, with EU edge processing. Safeguard: certification under the EU-US Data Privacy Framework (verified on 2026 September 25) and Standard Contractual Clauses.
• Twilio Inc. (SendGrid, United States). Purpose: delivery of transactional emails. Data processed: recipient name and email address, and message content. Location: United States. Safeguard: Standard Contractual Clauses.
• Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg; Amazon Web Services, Inc., United States). Purpose: cloud infrastructure and hosting. Data processed: all service data if a system or storage instance runs there. Location: the region the Provider configures, primarily in the European Union. Safeguard: Standard Contractual Clauses.
• Google Cloud Platform (Google Cloud EMEA Ltd, Ireland; Google LLC, United States). Purpose: cloud infrastructure. Data processed: data processed by any system component running there. Location: European Union and United States. Safeguard: Standard Contractual Clauses.
• OpenAI (OpenAI Ireland Ltd, Ireland, for EEA customers; OpenAI OpCo, LLC, United States). Purpose: artificial intelligence features the Provider may offer in the future, such as sitemap suggestions. Data processed: content the user submits to such a feature. Location: United States. Safeguard: Standard Contractual Clauses; OpenAI does not appear on the official EU-US Data Privacy Framework list (verified on 2026 September 8).
• Anthropic (Anthropic Ireland, Limited, Ireland, for EEA customers where applicable; Anthropic PBC, United States). Purpose: artificial intelligence features the Provider may offer in the future. Data processed: content the user submits to such a feature. Location: United States. Safeguard: Standard Contractual Clauses.

Processor for the Provider's own correspondence. Google Workspace (Google Ireland Ltd, Ireland; Google LLC, United States) hosts the [email protected] mailbox. In this capacity, Google is the Provider's processor, with the Provider acting as controller, for its own legal, privacy and customer support correspondence, including the content, sender and recipient of emails sent to and by the Provider. Google is not a sub-processor of content the user creates in the service and has no access to sitemaps, comments or files stored in the service. Location: European Union and United States. Safeguard: Standard Contractual Clauses. This processing is covered by the privacy notice.

Google and Microsoft are not sub-processors when acting as sign-in providers. If the user signs in with a Google or Microsoft account, the provider the user chose (Google LLC or Google Ireland Ltd; Microsoft Corporation or Microsoft Ireland Operations Ltd, respectively) acts as an independent controller, as described in “Accounts, teams and roles” and “Data processed, purposes, legal bases and retention periods” in the privacy notice. Nor is a provider that operates an AI agent the user has connected with an API key a sub-processor: it receives data only by the user's decision, as the user's tool, as described in “API access and AI agents” and in “Recipients and international transfers” in the privacy notice.

This list may change. Before engaging a new sub-processor, activating a provider announced in advance or replacing an existing sub-processor, the Provider notifies the user under “Data processing terms (GDPR Article 28)” by email at least 30 days in advance; the user may object. The Provider is responsible for the sub-processors' activities.