Terms of service

Acceptance of these terms

These Terms of Service (the "Terms") are entered into between the company operating the MaxoPerf platform ("MaxoPerf", "we", "us") and the person or organisation that accesses the Service ("Customer", "you").

You accept these Terms by any one of the following, whichever happens first:

• Signing an order. Executing an order form, quote, statement of work or purchase document that references or incorporates these Terms.
• Clicking accept. Selecting a control labelled "sign up", "create account", "continue" or similar where these Terms are identified next to that control.
• Using the Service. Accessing or using any part of the Service — including starting a demo run, opening a workspace, sending a request to the public API, or asking the AI assistant to do something — whether or not you ever create a password.

The third route is deliberate and is called out for clarity: a Guest Trial user who starts a demo from our website or from the AI assistant, supplies only an email address, and never sets a password is nonetheless bound by these Terms from the moment the demo starts. If you do not agree to these Terms, do not start a run and do not use the Service.

Authority. If you accept these Terms on behalf of an organisation, you represent that you are authorised to bind that organisation, and "you" means that organisation. If you sign up using an email address on a domain controlled by an organisation, we may treat you as acting for that organisation and may associate your account with its other accounts on the same domain. If you have no such authority, do not accept these Terms.

Effective Date. These Terms take effect on the earlier of (a) the date you first access the Service and (b) the effective date of your first order form. They continue to apply for as long as you hold an account or use the Service.

1. Definitions

In these Terms:

• "Target System" means any system, host, endpoint, application, API or network that is the subject of a Test — and, in every case, a system the Customer owns or is authorized to test. This definition carries the authorization requirement into every other clause of these Terms in which the phrase appears.
• "Test" means a configuration you create in the Service that describes what to execute against a Target System — the script or scenario, the load profile, the execution locations and the pass/fail criteria.
• "Run" means a single execution of a Test, from the moment runner capacity is requested until the run reaches a terminal state and its results are finalised.
• "Virtual User" means one simulated concurrent client generated by a Run.
• "VU-Hour" means one Virtual User sustained for one hour, and is the primary unit in which load-testing consumption is metered.
• "Browser Session" means one instrumented real-browser instance provisioned by the Service, whether for a browser Test or through a managed browser fleet endpoint.
• "Virtual Service" means a simulated dependency you define in the Service that responds to requests in place of a real upstream system.
• "Runner" means the compute instance, container or pod that generates load or drives a browser for a Run.
• "BYOC Runner" ("bring your own cloud") means a Runner that the Service creates and operates inside a Customer Cloud Account rather than in MaxoPerf's own infrastructure.
• "Customer Cloud Account" means a cloud provider account, subscription, project, Kubernetes cluster or other compute environment that the Customer owns or controls and connects to the Service.
• "Guest Trial" means an account created without a password from an email address supplied at demo start, together with any free evaluation account.
• "AI Assistant" means the MaxoPerf conversational assistant and any other Service feature that uses a large language model or similar generative model.
• "Input" means anything you submit to the AI Assistant, including prompts, pasted content, and the Service context the assistant is given in order to answer you.
• "Output" means anything the AI Assistant returns in response to an Input, including text, generated Test configurations, scripts and suggested actions.
• "Service" means the MaxoPerf platform in all of the above forms, together with the console, the public API, the documentation, the command-line and agent integrations, and any software we provide for you to run.

2. The service; licence grant

Subject to these Terms and to your plan, we grant you a revocable, non-exclusive, non-transferable, non-sublicensable licence to access and use the Service for your own internal business purposes for the duration of your subscription. The licence covers the Service as a whole — load testing, browser testing and service virtualization are one grant, not three — and extends to any Runner software, agent or connector we supply for you to install, solely as part of using the Service.

Your plan defines the scope of the licence: the entitlements, quotas, features and support level set out for that plan or in your order form. We may change, improve or discontinue features of the Service, and will not materially reduce the core functionality of a paid plan during a paid term without giving you notice under section 24.

The Service is licensed, not sold. We reserve every right not expressly granted here. You receive no ownership interest in the Service, and nothing in these Terms transfers any intellectual property right in it to you.

3. Accounts, users and workspaces

You are responsible for your account, for every workspace and project inside it, and for all activity that occurs under it — whether by a named user, an API key, a service account, a continuous-integration job or the AI Assistant acting on your instruction.

You must keep credentials, API keys and tokens confidential, must not share them between organisations, and must ensure each individual using the Service does so under their own identity where your plan supports named users. API keys carry the permissions of the identity that issued them; treat them as you would a password.

Notify us at security@maxoperf.com without undue delay if you know or suspect that any credential has been disclosed or that your account has been accessed without authorisation. We are not liable for loss arising from unauthorised use of your credentials before you notify us; after you notify us we will take reasonable steps to help you secure the account.

One free account per customer. Each organisation may hold one free or Guest Trial account at a time. Creating additional free accounts to obtain further free entitlements — using alternative email addresses, aliases, subdomains or affiliated entities — is a breach of these Terms and we may merge, suspend or close the additional accounts.

3.1 The email address you give us

An email address is the only thing we require before the Service starts working for you. A Guest Trial begins from an address alone, and that address immediately becomes an identity we hold and a mailbox we send to. Because we act on the address without any prior relationship with its holder, the representation below is the counterpart of section 4: it is what makes it legitimate for us to send anything at all.

The representation. You represent and warrant that every email address you submit to us is one that you (a) hold, or (b) are authorised by its holder to use for this purpose. This covers every route by which an address reaches us: starting a Guest Trial from our website or through the AI Assistant, creating an account or completing a registration, inviting a user to a workspace, adding a notification recipient, and changing the address on an existing account. You must not submit an address belonging to another person or organisation in order to open an account in their name, to obtain further free entitlements, or to cause us to send mail to them.

This representation is made again at each submission. Like section 4, it is not a one-time statement made at signup. Every Guest Trial you start, every invitation you send and every address you change is a fresh representation as to that address, at that moment. If your authority to use an address ends, stop using it and remove it from your account.

What we send to that address, and why. When you submit an address we may send messages to it that are necessary to provide the Service — verification and password-setup links, security and account notices, run and billing notifications you or your workspace have configured, and service announcements. These are transactional messages: we send them because the address was given to us in order to operate the Service, not to market to anyone. Marketing email is separate, requires consent given freely and specifically for that purpose, and can be withdrawn at any time without affecting your use of the Service. Nothing in these Terms — and nothing about submitting an address to start a Guest Trial — is consent to receive marketing.

If you receive a message you did not ask for. A message inviting you to complete a registration you did not start means someone entered your address here. Do not ignore it if the address is yours: the account carries your address, it was created the moment the address was submitted, and the browser it was submitted from holds a session in it. Completing registration from that message — setting a password, or linking a social login — takes control of the account. Alternatively, write to privacy@maxoperf.com from that address and we will delete the address and the account attached to it. An account whose registration is never completed is deleted along with its data under section 7.

We do not verify the address before the first message. As with section 4, the Service cannot know whether you hold an address at the moment you type it. The account is created and usable immediately; verification is what afterwards binds it to the person who holds the address. Until registration is completed the account has no credential of its own — no password and no linked social login — and is reachable only from the session that created it. Responsibility for submitting only addresses you hold or are authorised to use is therefore yours alone.

Breach. Submitting an email address you neither hold nor are authorised to use is a material breach of these Terms. It entitles us to delete the account and the associated identity without notice, to suspend you under section 18, to terminate under section 17, and to decline further Guest Trials from you.

4. Authorized testing and target systems

This section is the most important obligation in these Terms. Generating load against a system you are not entitled to test can be unlawful, can cause real damage to third parties, and is the one thing our platform makes easy to do at scale.

The representation. You represent and warrant that, for every Target System you submit, you either (a) own it, or (b) hold documented authorization from the person or organisation that owns or operates it to run the Test you are running. Written authorization from an authorised representative of the target's owner — including a contract, a statement of work, an email confirmation or a signed testing window — satisfies (b). We say owned or authorized deliberately: a consultancy, an agency, a managed-service provider or an internal platform team testing another party's system with that party's permission is expressly permitted to use the Service, provided the permission is real and documented.

This is a continuing representation, made again at each Run. It is not a one-time statement you make at signup. Every time you start a Run — through the console, the API, a scheduled trigger, a CI pipeline or the AI Assistant — you make this representation afresh as to that Run, that Target System and that load profile. Your authorization must cover the concurrency, request rate, duration and time window you are actually running. If authorization is withdrawn, narrowed or expires, you must stop the Run.

Scope: the representation extends beyond the target host. It covers:

• Third-party APIs your script calls. A Test that authenticates against an identity provider, calls a payments API, queries a mapping or messaging service, or pulls from any other external endpoint is generating load against those systems too. Each of them needs to be covered.
• CDNs, edge networks, WAFs, load balancers, DNS providers and other upstreams in the request path. These frequently belong to someone other than the target's owner and frequently have their own limits and abuse policies.
• The hosting or cloud provider's own testing policy. Amazon Web Services, Microsoft Azure and Google Cloud each publish a policy governing load, stress and penetration testing of workloads hosted with them, and other providers do the same. You can own your application outright and still breach your provider's rules by testing it. Complying with the applicable provider policy — including any notification, scheduling or approval step it requires — is your responsibility.

We do not verify authorization. The Service does not check, and cannot check, whether you are entitled to test a Target System. We do not review your Tests for this purpose and we do not act as a gatekeeper. Sole responsibility for obtaining, documenting and maintaining authorization rests with you, and you must retain evidence of it for as long as you run Tests against that Target System and for a reasonable period afterwards.

We reserve the right to require verification. We may, at our discretion, require you to demonstrate ownership of or authorization for a Target System before permitting or continuing Runs against it, and may decline to execute Runs until you do. We may require this generally, for particular target categories, or in response to a specific complaint or risk signal. No such verification control is in operation today, and nothing in this paragraph should be read as a statement that one exists or that we have performed any check; this paragraph reserves the right, it does not describe a current feature.

Breach. Breach of this section 4 is an express material breach of these Terms. It entitles us to suspend your account, your Runs or both under section 18 — including immediate termination of a Run already in flight — to terminate this agreement under section 17 without a cure period, and to the indemnity in section 21, which is carved out of the liability cap in section 20.

5. Acceptable use and prohibited conduct

You must not, and must not permit anyone else to:

• Use the Service against a Target System in breach of section 4, or to disrupt, degrade, deny service to or gain access to any system without authorisation.
• Use the Service to distribute malware, to conduct phishing or fraud, to send unsolicited messages, or to exfiltrate data from any system.
• Submit an email address you neither hold nor are authorised to use, in breach of section 3.1 — including to open an account in someone else's name, to obtain further free entitlements, or to cause the Service to send mail to a third party.
• Upload or execute scripts designed to exploit a vulnerability, escalate privilege, or persist beyond the scope of a Test.
• Circumvent or attempt to circumvent access controls, plan entitlements, quotas, rate limits, metering or billing enforcement, including by manipulating client-side controls, tampering with Runner software or agents, or falsifying usage telemetry.
• Reverse engineer, decompile or disassemble the Service or any component of it, or attempt to derive its source code, models, architecture or algorithms, except to the extent this restriction is unenforceable under applicable law.
• Resell the Service, or operate it as a service bureau — making the Service available to third parties as a paid or unpaid offering of your own — without a separate written reseller or partner agreement with us.
• Benchmark the Service against a competing product for publication, or use the Service to build or assist a competing product, without our prior written consent.
• Load-test, stress-test, penetration-test or otherwise probe MaxoPerf's own platform or infrastructure. The console, the public API, our runner fleet, our edge and our supporting services are not permitted Target Systems. If you wish to report a security issue, contact security@maxoperf.com — we welcome good-faith reports, but a coordinated disclosure request is not authorisation to generate load.
• Interfere with other customers' use of the Service, or take any action intended to impose an unreasonable load on our shared infrastructure.
• Use the Service in violation of any applicable law, regulation or third-party right.

We may investigate suspected breaches of this section, and may cooperate with law-enforcement or regulatory authorities where legally required.

6. Usage limits, metering and overage

Consumption of the Service is metered. The primary billing units are VU-Hours for load testing and Browser Session time for browser testing and managed browser fleets; Virtual Services, data retention and other features are metered as described on the pricing page and in your plan or order form. Metering is based on our records of Runs, sessions and resources provisioned, which are the authoritative record absent manifest error.

Each plan carries included entitlements. When you exhaust an entitlement, the behaviour depends on your plan and on the setting you choose: consumption either hard-stops — further Runs are refused until the next period or until you add capacity — or continues and is billed as overage at the rate published for your plan. The applicable behaviour is shown in the console before you exceed a limit, and you are responsible for the overage you incur.

Included entitlements are periodic and do not roll over. Unused capacity is not refundable and has no cash value. Prepaid capacity is consumed in the period it is allocated to unless your order form says otherwise.

You must not circumvent metering or plan limits, including by splitting activity across accounts to obtain entitlements you would not otherwise have, by running Runners outside the Service's accounting, or by interfering with usage reporting.

7. Free, guest and trial accounts

This section applies to Guest Trials, free plans and any evaluation, beta, preview or proof-of-concept access we provide at no charge. Where it conflicts with another section of these Terms, this section prevails for those accounts.

• Evaluation only. Free and Guest Trial access is provided so you can evaluate the Service. It is not intended or licensed for production use, for a customer-facing workload, or for any purpose on which you place material reliance.
• No SLA, no support commitment, no indemnity. No availability, performance or response-time commitment applies. Support is provided on a best-efforts basis only, if at all. The MaxoPerf indemnity in section 21 does not apply to free or Guest Trial accounts. Your indemnity obligations under section 21 apply in full.
• Termination at will. We may change, limit, suspend or terminate free and Guest Trial access at any time, for any reason, with or without notice, and may delete the associated data on termination.
• One free account per customer. As set out in section 3. Creating multiple free or Guest Trial accounts — through alternative addresses, aliases, disposable-mail domains, subdomains or affiliated entities — to obtain additional free entitlements is a breach of these Terms.
• Data retention. Data in a Guest Trial or free account — Tests, configurations, Run results, logs and artifacts — is retained for 30 days from the date it is created, and is then deleted. If registration is never completed — no password set and no social login linked — the account and its data may be deleted sooner. Export anything you want to keep before that window expires; we are not obliged to recover deleted trial data. We state this window plainly rather than leaving it undefined, and it applies whether or not you convert to a paid plan.
• Separate liability cap. For free and Guest Trial accounts, our aggregate liability is capped as set out in section 20 at a level substantially lower than the paid cap — because you have paid us nothing.

Section 4 (authorized testing) applies to free and Guest Trial accounts in full and without modification. Free access is not a lower standard of care. Section 3.1 (the email address you give us) applies in the same way, and matters most here: a Guest Trial is opened from an address alone, so the address you type is the whole of what you are asserting.

8. BYOC runners and customer cloud accounts

If you connect a Customer Cloud Account so that the Service can operate BYOC Runners, browser fleets, Virtual Services or supporting workloads inside your own environment, this section applies. It is written to describe exactly what the Service does in your account and exactly what we do and do not promise about it.

8.1 The permission you grant

By connecting a Customer Cloud Account and providing credentials, a role, a service account or a cluster connection, you authorise MaxoPerf to access that environment and to create, configure, scale, start, stop and terminate compute instances, containers, pods, disks, network interfaces, addresses, images and related resources within it, as necessary to deliver the Service you have configured. The permission is limited to that purpose. It does not authorise us to access your other workloads or data, and we will not use it to do so.

The permission is revocable at any time. You may disconnect the account or revoke the credentials whenever you choose. Doing so is your decision alone and needs no notice to us. Revocation stops future provisioning and, in practice, will also stop us from cleaning up what is already there — see section 8.4.

8.2 Cloud costs are yours

You are solely responsible for all charges your cloud provider bills you for resources created or used under this section, including compute, storage, data transfer, addresses, load balancers, support plans and taxes. Those charges are between you and your provider; MaxoPerf does not resell them, does not receive them and does not credit them.

This expressly includes charges arising from orphaned or leaked resources — a Runner that outlives its Run, a disk or address that survives an interrupted teardown, or a workload left behind because credentials were revoked, quotas were reached, an API call failed, or the provider's control plane was unavailable. Cloud resources cost money for as long as they exist, and you are the account holder.

8.3 What we do not warrant about your environment

We disclaim all responsibility for the availability, capacity, performance, security, configuration, patching, backup, encryption, retention and data residency of anything inside a Customer Cloud Account. That environment is yours. We are also not responsible for your compliance with your cloud provider's own terms, acceptable-use policy, testing policy or quotas, nor for obtaining quota increases, reservations or capacity on your behalf. If your provider throttles, suspends or terminates your account, that is between you and them, and any resulting inability to run Tests is not a failure of the Service.

8.4 Credentials that are revoked or expire mid-run

If the credentials, role or connection for a Customer Cloud Account are revoked, rotated, expire, lose permissions or otherwise stop working while resources are provisioned, we will stop provisioning, mark the affected Runs as failed with a reason, and stop billing you for MaxoPerf capacity that we can no longer operate. We will not be able to reach the environment, and therefore will not be able to terminate resources already running in it. Those resources will continue to exist and to accrue cloud charges until you remove them. You are responsible for removing them.

8.5 Clean-up: a split obligation

Our obligation. We will use commercially reasonable efforts to release resources we created in your Customer Cloud Account once they are no longer needed — at the end of a Run, when a workload is stopped, and through automatic reconciliation processes that periodically look for resources left behind and attempt to remove them. This is an efforts-based obligation and is stated as such on purpose: our reconcilers do real work, but distributed teardown across third-party cloud APIs cannot be guaranteed, and we will not promise more than our software actually delivers.

Your obligation. You remain responsible for verifying that resources have been released, for monitoring your own cloud spend and resource inventory, and for removing anything that persists. Set up your own budget alerts and inventory checks. We provide visibility in the console into the resources we believe we have created and released; that view is a convenience, not a guarantee of completeness, and it is not a substitute for your provider's own billing and inventory data.

To the maximum extent permitted by law, we are not liable for cloud charges arising from resources not released, and any liability we may have for them is subject to the cap in section 20.

9. AI assistant and AI features

The Service includes an AI Assistant. This section governs it and prevails over any other section of these Terms with which it conflicts, including section 14 (confidentiality).

9.1 Optional

Use of the AI Assistant is entirely optional. Every task it performs can be performed without it through the console or the public API. If you do not want your content processed by a third-party model provider, do not use it.

9.2 Inputs and Outputs

As between you and us, you own your Inputs and your Outputs, subject to our rights in the Service itself. We grant you whatever rights we hold in an Output so you can use it for the purpose for which the Service produced it. You are responsible for your Inputs and for your use of Outputs.

You warrant that you have the right to submit each Input and that you submit only non-production test data — no live customer records, no credentials or secrets, and none of the categories of data listed in section 12.

9.3 No accuracy warranty; human review required

Generative models are probabilistic. Outputs may be inaccurate, incomplete, misleading or wrong, may misstate how the Service behaves, and may not reflect your actual configuration or results. Outputs are provided without any warranty of accuracy, completeness or fitness for purpose, and are not professional, engineering, capacity-planning, security or legal advice.

Outputs are also not necessarily unique: the same or a similar Input from another customer may produce the same or a similar Output, and we make no representation that any Output is original or that your use of it will not infringe a third-party right.

You must independently review every Output before relying on it, and in particular before executing a generated Test, applying a generated configuration, or making an engineering or purchasing decision on the basis of one.

9.4 Training posture

We do not use your Inputs, Outputs or other customer content to train, fine-tune or otherwise improve generative models, and our contracts with the model providers we use prohibit them from doing so with content we send on your behalf. You likewise must not use Outputs, or any part of the Service, to train, fine-tune, evaluate or develop a model or product that competes with the Service, and must not use automated means to extract Outputs at scale for that purpose.

9.5 Named subprocessor and the confidentiality override

The AI Assistant is currently powered by a third-party model provider, DeepSeek, acting as our subprocessor. We may change or add model providers on notice to you under section 24; if you object to a change, your sole and exclusive remedy is to stop using the AI Assistant, which does not affect the rest of the Service or your fees.

Express override of section 14. Operating the AI Assistant necessarily means transmitting your Inputs — which may include your Confidential Information — to that provider. You expressly authorise that disclosure, and section 14 does not restrict it. The provider may retain and log Inputs and Outputs for a limited period for abuse detection, safety and service-operation purposes. This paragraph is a deliberate, negotiated exception to confidentiality; it exists so that section 9 and section 14 do not contradict each other. If that disclosure is not acceptable to you, section 9.1 is your remedy: do not use the feature.

9.6 Availability and enforcement

We may throttle, rate-limit, degrade, block, suspend or disable access to the AI Assistant, in whole or in part, for any account, at any time — for abuse, cost, safety, capacity, legal or provider reasons. The AI Assistant is not covered by any availability commitment, including on paid plans.

9.7 Actions taken by the assistant on your behalf

Where the AI Assistant can take actions in the Service — starting or stopping Runs, creating or modifying Tests, deploying Virtual Services, creating, scaling or deleting browser fleets, provisioning Runners, or calling the public API on your behalf — those actions are your actions. You remain fully responsible for them, for their consequences, and for the usage and charges they generate, exactly as if you had performed them yourself in the console.

In particular, the representation in section 4 applies identically to AI-initiated Runs. Instructing the assistant to test a Target System is you making the owned-or-authorized representation for that Run. "The assistant started it" is not a defence, and you should supervise the assistant accordingly.

10. Service virtualization and recorded traffic

The Service lets you define Virtual Services that stand in for real dependencies, and lets you build them from traffic captured from a real system — from a Run, a recording, a proxy capture or an imported specification.

Where a Virtual Service is built from captured traffic, you represent and warrant that you had the right to capture that traffic from the system it came from, and that capturing and reusing it does not breach any contract, terms of use, confidentiality obligation, intellectual-property right or law applicable to that system or its operator.

You further warrant that captured requests and responses have been scrubbed of personal data, credentials, tokens, keys and regulated data before they are stored in the Service, and that any values retained are synthetic or non-production. Capturing traffic against a live production system is capturing real user data; that is your responsibility to prevent, and section 12 applies to it in full.

A Virtual Service simulates a dependency; it does not replicate one. We make no representation that a Virtual Service reproduces the behaviour, performance, error characteristics or correctness of the system it stands in for, and results obtained against a Virtual Service are not evidence of how the real system will behave.

11. Customer data; data rights

You own your data. As between you and MaxoPerf, you retain all right, title and interest in your Tests, scripts, scenarios, configurations, uploaded files, Virtual Service definitions, workspace content and your Run results — the measurements, metrics, traces, logs, artifacts, recordings and reports produced by your Runs (together, "Customer Data"). Results are yours, not ours; you may export them and use them for any purpose.

You grant us a worldwide, non-exclusive, royalty-free licence to host, store, transmit, copy, display, process and create derived representations of Customer Data solely to provide, secure, support, maintain and improve the Service for you, and to comply with law. That licence lasts only as long as we hold the data and ends when the data is deleted. We will not sell Customer Data, will not disclose it except as these Terms permit, and will not use it to train generative models (section 9.4).

Aggregate telemetry. We may collect and use operational, statistical and diagnostic information about how the Service is used — such as feature usage, run volumes, failure rates, latency of our own components and resource efficiency — and may create aggregated and anonymised data sets from it, in order to operate, secure, benchmark and improve the Service and to produce industry-level insight. Such data is aggregated and anonymised so that it does not identify you, your users or your Target Systems, and we may use and retain it after termination. It never includes your scripts, your payloads or your Run results in identifiable form.

You are responsible for the accuracy, quality, legality and backup of Customer Data, and for having the right to submit it to the Service.

12. Restricted data

The Service is a testing platform and is not designed, certified or contracted to receive regulated or sensitive personal data. You must submit non-production or synthetic data only in Test payloads, scripts, uploaded files, recorded traffic, Virtual Service definitions and Inputs to the AI Assistant.

You must not submit to the Service:

• Protected health information or any data subject to HIPAA or comparable health-privacy law.
• Cardholder data, primary account numbers, or any data subject to PCI DSS.
• Financial account data subject to the Gramm-Leach-Bliley Act or comparable financial-privacy law.
• Special categories of personal data under the GDPR or comparable law — including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data used for identification, data concerning health, and data concerning a person's sex life or sexual orientation.
• Government-issued identifiers, children's personal data, or criminal-offence data.
• Classified, export-controlled or national-security information, or third-party data you are contractually barred from disclosing.
• Live credentials, private keys, or secrets for production systems.

If you submit such data anyway, you do so in breach of these Terms and at your own risk; we may delete it, and you are responsible for any consequence of its presence in the Service. If your use case genuinely requires processing regulated data, talk to us before you start — do not assume it is covered.

13. Privacy and data processing

Our collection and use of personal data in operating the Service is described in our Privacy Notice, which forms part of these Terms.

Where we process personal data contained in Customer Data on your behalf, you are the controller (or business) and we are the processor (or service provider), and we will process that data only on your documented instructions — these Terms and your use of the Service being those instructions — except where law requires otherwise.

EU and UK. Where the GDPR or UK GDPR applies, we will implement appropriate technical and organisational measures, ensure that personnel with access are bound by confidentiality, engage subprocessors under written terms no less protective than ours, assist you with data-subject requests and security-incident notification so far as is reasonable given the nature of the processing, and delete or return personal data on termination. International transfers are made under an approved transfer mechanism, including the Standard Contractual Clauses where applicable.

California. Where the CCPA/CPRA applies, we act as a service provider. We do not sell or share personal information as those terms are defined, do not retain, use or disclose it for any purpose other than performing the Service, and do not combine it with personal information from other sources except as permitted.

A data processing addendum (DPA) is available on request and, once executed, governs the processing of personal data in place of the summary in this section. Contact privacy@maxoperf.com for privacy and data-protection requests.

14. Confidentiality

"Confidential Information" means non-public information disclosed by one party (the "Discloser") to the other (the "Recipient") that is identified as confidential or that a reasonable person would understand to be confidential from its nature or the circumstances of disclosure. Customer Data is your Confidential Information. The non-public parts of the Service, our pricing and our roadmap are ours.

The obligation is mutual. The Recipient will use the Discloser's Confidential Information only to perform under these Terms, will protect it with at least the care it uses for its own confidential information (and never less than reasonable care), and will disclose it only to its personnel, affiliates, advisers and subprocessors who need it and who are bound by confidentiality obligations no less protective than these.

Confidential Information does not include information that the Recipient can show:

• was already known to it, free of any obligation of confidence, before disclosure;
• is or becomes public through no act or omission of the Recipient;
• is lawfully received from a third party without restriction; or
• was independently developed by the Recipient without use of the Confidential Information.

Compelled disclosure. The Recipient may disclose Confidential Information to the extent required by law, regulation or valid legal process, provided it gives the Discloser prompt notice where lawfully permitted so the Discloser can seek protective relief, discloses only what is required, and continues to treat the balance as confidential.

AI subprocessor carve-out — read with section 9.5. This section 14 is expressly subject to section 9.5. Where you use the AI Assistant, your Inputs — which may contain your Confidential Information — are transmitted to and may be logged by the named model subprocessor, and that disclosure is authorised by you and is not a breach of this section. This carve-out is limited to what section 9.5 describes and to the AI Assistant; it does not otherwise reduce our confidentiality obligations. If you do not want that disclosure to occur, do not use the AI Assistant.

Confidentiality obligations survive termination for three years, and indefinitely for anything that qualifies as a trade secret.

15. Intellectual property; feedback

MaxoPerf and its licensors own all right, title and interest in and to the Service — the platform, console, public API, Runner and agent software, models, documentation, designs, trademarks and all associated intellectual property — and in every improvement, modification, derivative work and enhancement of it, however arising, including any developed in the course of providing support or professional services to you. Section 2 grants a licence; it transfers nothing.

You may not remove or obscure any proprietary notice in the Service, and may use our name and marks only as we permit in writing or as ordinary fair reference to the Service.

Feedback. If you give us suggestions, ideas, feature requests, bug reports or other feedback about the Service, you grant us a perpetual, irrevocable, worldwide, royalty-free, fully paid, sublicensable licence to use, modify and exploit it for any purpose, without obligation, attribution or compensation to you. You are never obliged to give us feedback, and you should not include your Confidential Information in it.

16. Fees, payment and taxes

Fees are those set out in your order form or, for self-service plans, on the pricing page and in the console at the time you subscribe. Subscription fees are billed in advance for the subscription period; usage and overage are billed in arrears for the period in which they are incurred.

Unless your order form says otherwise, invoices are due net 30 days from the invoice date, in the currency stated. Self-service plans are charged to the payment method on file on the billing date, and you authorise us to charge it for all fees, usage and overage incurred, and to update it through your payment provider's account-updater service.

Undisputed amounts not paid when due accrue interest at 1.5% per month or the maximum rate permitted by law, whichever is lower, from the due date until paid, and we may recover reasonable costs of collection. We may suspend the Service under section 18 for non-payment after giving you notice and a reasonable opportunity to pay.

Fees are non-refundable and prepaid amounts are non-refundable except where these Terms expressly say otherwise or where a non-waivable law requires a refund. Downgrading a plan mid-period does not produce a refund or credit for the unused portion.

You may dispute an invoice in good faith by notifying us in writing within 30 days of the invoice date, identifying the disputed amount and the reason. Undisputed amounts remain payable on time.

Taxes. All fees are exclusive of taxes. You are responsible for all sales, use, VAT, GST, withholding and similar taxes and duties arising from your purchase, other than taxes on our net income. Israeli VAT is added where applicable. If you are required to withhold any tax, you must gross up the payment so that we receive the full amount invoiced. If you are exempt, provide valid documentation before invoicing.

We may change our prices with effect from the start of your next renewal term, on notice under section 24.

17. Term, renewal and termination

These Terms begin on the Effective Date and continue until all subscriptions under them have expired or been terminated.

Renewal. Unless your order form says otherwise, each subscription term renews automatically for a further period equal to the expiring term. Either party may prevent renewal by giving written notice of non-renewal at least 30 days before the end of the current term. For self-service plans, cancelling in the console before the renewal date is sufficient notice.

Termination for convenience. You may stop using the Service and close your account at any time; doing so does not entitle you to a refund of prepaid fees, and fees for the remainder of a committed term remain payable. We may terminate a free or Guest Trial account at any time under section 7.

Termination for cause. Either party may terminate these Terms and all subscriptions on written notice if the other party materially breaches them and fails to cure the breach within 30 days of written notice describing it, or immediately if the other party becomes insolvent, enters liquidation or administration, makes an assignment for the benefit of creditors, or ceases business. We may terminate immediately and without a cure period for a breach of section 4 (authorized testing), section 5 (acceptable use) or section 12 (restricted data), and for non-payment that remains unremedied after suspension.

Effect of termination. All licences granted to you end, your access to the Service ends, in-flight Runs are stopped, and all fees accrued up to termination become immediately due. Where we terminate for your material breach, fees for the remainder of the term also become due. Where you terminate for our uncured material breach, we will refund the pro-rata portion of prepaid fees for the unused remainder of the term.

Data export. For 30 days after termination or expiry of a paid subscription, we will on request make Customer Data available to you for export in the formats the Service supports. After that window we may delete it, and after deletion we are not obliged to recover it. Guest Trial and free accounts are governed by the shorter retention window in section 7. Backups are purged on our ordinary backup cycle.

Survival. Sections 1, 6 (as to accrued fees), 11, 12, 14, 15, 16, 17, 19, 20, 21, 23 and 27 survive termination, together with any other provision that by its nature should survive.

18. Suspension

Suspension is separate from, faster than, and not a precondition to termination. We may suspend your access to the Service, to a workspace, to a feature, or to Runs specifically — immediately and without prior notice where the circumstances require it — if:

• we reasonably suspect a breach of section 4, section 5 or section 12, including a Run against a Target System you may not be authorized to test;
• we receive a credible complaint or abuse report from a target operator, a hosting or cloud provider, a network operator or a regulator relating to your activity;
• your use poses a security, integrity, availability or legal risk to us or to others;
• your account is compromised or credentials are being used without authorisation;
• payment is overdue after notice under section 16; or
• we are required to suspend by law, regulation or legal process.

Suspension of an in-flight Run. For clarity, our suspension right expressly includes immediately terminating a Run that is already executing, cancelling queued Runs, de-provisioning Runners and blocking further Runs against a specific Target System, where we suspect unauthorized targeting. We will do this without waiting for the Run to complete and without prior notice, because the harm we are preventing accrues while the Run is in progress. A Run terminated under this paragraph is still metered for the capacity consumed up to termination.

We will give notice of suspension and the reason as soon as reasonably practicable, will limit the suspension to what is necessary, and will restore access promptly once the cause is resolved. Suspension under this section does not relieve you of payment obligations and does not extend your subscription term, except that we will credit fees for the suspended period if the suspension turns out to have been our error.

19. Warranties and disclaimers

Our express warranty. We warrant that (a) the Service will perform materially in accordance with its then-current documentation, (b) we will provide the Service with reasonable skill and care in a professional manner, and (c) we will not knowingly introduce malicious code into the Service. Your exclusive remedy for breach of this warranty is that we will use reasonable efforts to correct the non-conformity, and if we cannot do so within a reasonable period you may terminate the affected subscription and receive a pro-rata refund of prepaid fees for the unused remainder of the term.

Mutual. Each party warrants that it has the legal power and authority to enter into these Terms.

Disclaimer. Except as expressly stated in these Terms, and to the maximum extent permitted by law, the Service is provided "as is" and "as available", and we disclaim all other warranties, conditions and representations, express, implied or statutory, including implied warranties of merchantability, fitness for a particular purpose, title, non-infringement, accuracy and any warranty arising from course of dealing or usage of trade. We do not warrant that the Service will be uninterrupted, error-free or secure, or that all defects will be corrected. Availability commitments, if any, exist only where a separate service-level agreement says so.

Testing-specific disclaimers. Because of what this Service does:

• We do not warrant that a Test will not affect your own Target System. Generating load is inherently disruptive. A Run may slow, degrade, exhaust, destabilise or take down a Target System, its dependencies, its upstreams or its network, may trigger autoscaling and the cloud charges that follow, may fill logs and storage, may trip rate limits or WAF rules, and may cause data to be written or mutated by the requests your script makes. Choosing what to run, against what, at what intensity, and when, is your decision, and the consequences to systems you own or are authorized to test are yours.
• We do not warrant the accuracy of results, or their fitness for capacity-planning decisions. Measurements are affected by the network path, the execution locations you choose, shared and virtualised infrastructure, the behaviour of Runners and browsers, your script, sampling and aggregation, and the state of the Target System at the time. Results are a measurement of a specific Run under specific conditions, not a prediction. Any capacity, sizing, scaling, architecture, procurement, release or go-live decision you make on the basis of results is made on your own judgement and at your own risk, and we are not liable for it.
• We do not warrant Outputs of the AI Assistant — see section 9.3 — or that a Virtual Service reproduces the system it stands in for — see section 10.

20. Limitation of liability

Exclusion of indirect damages. To the maximum extent permitted by law, neither party is liable for any indirect, incidental, special, consequential, exemplary or punitive damages, or for lost profits, lost revenue, lost or corrupted data, loss of goodwill, loss of anticipated savings, or cost of substitute services, however caused and on any theory of liability, even if advised of the possibility.

Cap — paid accounts. Each party's total aggregate liability arising out of or relating to these Terms or the Service will not exceed the total fees you paid or owed for the Service in the twelve months immediately preceding the first event giving rise to the claim.

Cap — free and Guest Trial accounts. Where the claim relates to a free plan, a Guest Trial, a beta or any other access provided at no charge, our total aggregate liability will not exceed one hundred United States dollars (USD 100). This lower cap is separate from and independent of the paid cap above, reflecting that no fees were paid.

Carve-outs. The caps and the exclusion above do not apply to:

• your obligation to pay fees;
• either party's breach of section 14 (confidentiality);
• your indemnity obligations under section 21, including in particular the unauthorized-target indemnity in section 21.2, which is expressly uncapped;
• either party's fraud, wilful misconduct or gross negligence;
• your breach of section 4, section 5 or section 12; and
• infringement or misappropriation of the other party's intellectual property.

Savings clause. Nothing in these Terms excludes or limits any liability that cannot lawfully be excluded or limited, including liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or any other liability that applicable law does not permit to be excluded. Where a limitation is held unenforceable, it applies to the maximum extent the law allows.

The parties agree that these allocations of risk are a fundamental basis of the bargain and are reflected in the pricing of the Service.

21. Indemnification

21.1 Our indemnity to you

We will defend you against any third-party claim alleging that your permitted use of the Service infringes that third party's patent, copyright, trademark or trade secret, and will pay the damages finally awarded against you or agreed by us in settlement of such a claim, provided you promptly notify us, give us sole control of the defence and settlement, and give reasonable cooperation at our expense.

If the Service becomes, or we believe it may become, the subject of such a claim, we may at our option and expense (a) procure the right for you to continue using it, (b) modify or replace it so that it is non-infringing while materially equivalent, or, if neither is commercially reasonable, (c) terminate the affected subscription and refund the pro-rata portion of prepaid fees for the unused remainder of the term.

Exclusions. We have no obligation under this section 21.1 to the extent the claim arises from: your Customer Data, scripts, payloads or Inputs; combination of the Service with anything not supplied by us where the claim would have been avoided without the combination; modification of the Service by anyone other than us; your use after we notified you to stop or after we supplied a non-infringing alternative; use in breach of these Terms; Outputs of the AI Assistant; or free, Guest Trial, beta or no-charge access, to which this section 21.1 does not apply at all (section 7).

This section 21.1 states our entire liability and your exclusive remedy for third-party intellectual-property claims relating to the Service.

21.2 Your indemnity to us — unauthorized targets

This is the risk that is specific to operating a load-testing platform, and it sits with the party that chooses what to test.

You will defend, indemnify and hold harmless MaxoPerf, its affiliates and their respective officers, directors, employees, contractors and agents against any and all third-party claims, demands, investigations, proceedings, damages, fines, penalties, losses, liabilities, settlements and costs (including reasonable legal fees) arising out of or relating to any Test or Run executed against a system that you did not own and were not authorized to test, or executed outside the scope of the authorization you held.

This expressly includes claims and actions brought by:

• the owner or operator of the Target System, and any of its customers or users affected by the Run;
• the Target System's hosting provider, cloud provider, CDN, network operator or other upstream, including claims for service disruption, breach of their acceptable-use or testing policy, and their own costs of investigation and remediation; and
• any regulatory, governmental or law-enforcement authority, including proceedings under the United States Computer Fraud and Abuse Act, the United Kingdom Computer Misuse Act 1990, the Israeli Computers Law 5755-1995, and equivalent computer-misuse, unauthorized-access, cybercrime, telecommunications and data-protection statutes in any jurisdiction.

It applies equally where the Run was started through the console, the public API, a schedule, a pipeline, an agent integration or the AI Assistant acting on your instruction (section 9.7), and whether the target was chosen deliberately, by misconfiguration, by a typo in a hostname, or by a script that followed a redirect or called a dependency you did not intend.

This indemnity is expressly carved out of the limitation of liability in section 20 and is not subject to any cap.

21.3 Your other indemnities

You will likewise defend, indemnify and hold us harmless against third-party claims arising from: your Customer Data, scripts, payloads, recorded traffic and Virtual Service definitions, including any allegation that they infringe a third-party right or were captured or used without the right to do so (section 10); your breach of section 12 (restricted data); your breach of section 5 (acceptable use); and your violation of applicable law or of a third party's rights.

21.4 Procedure

The indemnified party will notify the indemnifying party promptly of any claim (a delay excuses the indemnifying party only to the extent it is prejudiced), give the indemnifying party sole control of the defence and settlement, and provide reasonable cooperation at the indemnifying party's expense. The indemnifying party may not settle a claim in a way that imposes a non-indemnified obligation or an admission of fault on the indemnified party without its written consent, which will not be unreasonably withheld. The indemnified party may participate with counsel of its own choosing at its own expense.

22. Force majeure

Neither party is liable for any delay or failure to perform (other than an obligation to pay money) caused by an event beyond its reasonable control, including act of God, natural disaster, fire, flood, earthquake, epidemic or pandemic, war, armed conflict, terrorism, civil unrest, strike or labour dispute, act of government or regulator, embargo or sanction, failure or unavailability of a third-party cloud, hosting, network, DNS, certificate or payment provider, and failure of public utilities or telecommunications.

For the avoidance of doubt, denial-of-service and distributed denial-of-service attacks against either party or its providers, and other malicious third-party attacks on infrastructure, are force majeure events under this section.

The affected party will give notice as soon as reasonably practicable and will use reasonable efforts to resume performance. If a force majeure event prevents performance for more than 60 consecutive days, either party may terminate the affected subscription on written notice, and we will refund the pro-rata portion of prepaid fees for the unused remainder of the term.

23. Governing law; disputes; venue

These Terms, and any dispute, claim or non-contractual obligation arising out of or in connection with them or with the Service, are governed by the laws of the State of Israel, without regard to its conflict-of-law rules.

The parties submit to the exclusive jurisdiction of the competent courts of Tel Aviv-Yafo, Israel, and waive any objection to that venue on grounds of inconvenient forum.

The United Nations Convention on Contracts for the International Sale of Goods (CISG) does not apply to these Terms and is expressly excluded, as is the Uniform Computer Information Transactions Act wherever enacted.

Good-faith negotiation first. Before commencing proceedings, the party raising a dispute will give the other written notice describing it, and the parties will attempt in good faith to resolve it through discussion between representatives with authority to settle, for a period of 30 days from that notice.

Injunctive relief carve-out. Nothing above prevents either party from seeking injunctive or other equitable relief in any court of competent jurisdiction, at any time and without first negotiating, to protect its intellectual property or Confidential Information, or to restrain a breach of section 4.

24. Changes to these terms

We may update these Terms from time to time — to reflect changes in the Service, in our subprocessors, or in law. Each version carries a version identifier and an effective date, shown at the top and bottom of this page, and we record the version in effect when you accepted these Terms.

Material changes. We will give at least 30 days' notice of a material change — by email to your account contacts, by notice in the console, or both. A change is material if it meaningfully reduces your rights or increases your obligations. Non-material changes (clarifications, corrections, restructuring, contact details) may take effect on publication.

When a change takes effect. For paid customers, a material change takes effect at the start of your next renewal term; if you do not accept it, you may prevent renewal under section 17 and the current version continues to govern until your term ends. For free and Guest Trial accounts, a material change takes effect on the stated effective date, and continued use of the Service after that date is acceptance — consistent with the by-use acceptance route in the preamble. If you do not accept it, stop using the Service.

We will not apply a change retroactively to a dispute that arose before its effective date.

25. Export control and sanctions

The Service, and any software or technology we provide, may be subject to export-control and sanctions laws, including those of Israel, the United States, the United Kingdom and the European Union. You must comply with all of them.

You represent and warrant that you are not located in, organised under the laws of, or ordinarily resident in a country or territory subject to comprehensive sanctions; that you are not a person or entity designated on any applicable restricted-party, denied-party or sanctions list, and are not owned or controlled by such a person; and that you will not access, use, export, re-export or transfer the Service in breach of those laws or to any such person, country or territory.

You must not use the Service for any purpose prohibited by export-control law, including nuclear, chemical or biological weapons or missile-technology end uses. We may suspend or terminate access immediately if we reasonably believe this section is breached.

26. Assignment; subcontracting; third-party components

You may not assign or transfer these Terms, or any right or obligation under them, without our prior written consent, and any attempt to do so without consent is void. We may assign these Terms freely.

Merger and asset-sale carve-out. Either party may assign these Terms in their entirety, without the other's consent, to a successor in connection with a merger, acquisition, corporate reorganisation or sale of all or substantially all of its assets or of the business to which these Terms relate, on written notice to the other party — except that you may not assign to a direct competitor of MaxoPerf without our consent.

Subcontracting. We may engage affiliates and subcontractors, including cloud, hosting, telemetry, payment, email and AI model providers, to help deliver the Service. We remain responsible for their performance of our obligations under these Terms, and engage them under written terms consistent with our obligations, including section 13 and section 14.

Third-party and open-source components. The Service includes third-party and open-source components, and Runner images bundle open-source testing tools. Those components are licensed under their own terms, which govern your use of them and which prevail over these Terms to the extent of a conflict as to that component. We provide no warranty and accept no liability for third-party or open-source components beyond what these Terms provide for the Service as a whole. Applicable notices and licences are available on request.

27. General

Notices. Notices to you may be given by email to the addresses associated with your account, or by notice in the console, and are deemed received when sent (email) or displayed (console). Notices to us must be in writing to legal@maxoperf.com, and are deemed received on the next business day. You must keep your account contact details current.

Severability. If any provision of these Terms is held invalid, illegal or unenforceable, it will be modified to the minimum extent necessary to make it enforceable while preserving its intent, or if that is not possible, severed; the remaining provisions continue in full force.

Waiver. No failure or delay in exercising a right is a waiver of it, and no single or partial exercise prevents any further exercise. A waiver is effective only if in writing and signed by the waiving party.

Entire agreement. These Terms, together with the Privacy Notice, any order form, and any addendum the parties execute, are the entire agreement between the parties about the Service and supersede all prior or contemporaneous proposals, communications and understandings. Any pre-printed or additional terms in a purchase order or vendor portal are rejected and have no effect. In case of conflict, an executed order form or addendum prevails over these Terms, and these Terms prevail over the documentation.

Order of precedence for AI features. Section 9 prevails over section 14 to the extent set out in section 9.5, and section 7 prevails over other sections for free and Guest Trial accounts.

Survival. As set out in section 17.

Independent contractors. The parties are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency, fiduciary or employment relationship. Neither party may bind the other.

No third-party beneficiaries. These Terms confer no right on any person who is not a party to them, except that our affiliates, officers, directors, employees and agents may enforce section 20 and section 21.

Headings and interpretation. Headings are for convenience only. "Including" means "including without limitation". References to a section are to a section of these Terms.

Language. These Terms are drafted in English, and the English version governs any translation.

Version 2026-07-27 · Effective 2026-07-27

Questions about these Terms: legal@maxoperf.com. Security reports: security@maxoperf.com. Privacy requests: privacy@maxoperf.com.