Terms of Service.

These Terms of Service (the Terms) form a binding agreement between you and FlareX (we, us, or our), a service operated from Australia. They apply to your use of the FlareX website, platform, and related services (together, the Service).

By accessing or using the Service, creating an account, importing a project, purchasing a one-time offer, subscribing to a managed hosting plan, or otherwise indicating your acceptance, you agree to these Terms. If you do not agree, you must not use the Service.

Acting for an organisation. If you use the Service on behalf of a company or other organisation, you represent that you have authority to bind that organisation to these Terms, and references to you include that organisation.

Related documents. These Terms incorporate by reference our Acceptable Use Policy and our Privacy Policy. Together they describe the rules that apply to your use of the Service and how we handle personal information. Where any conflict exists, these Terms govern except as expressly stated otherwise.

To use the Service you must be at least 18 years of age, or the age of legal majority in your jurisdiction if higher, and capable of forming a binding contract. The Service is not directed to children and we do not knowingly permit anyone under 18 to create an account.

You must provide accurate information when registering and keep it current. You must not use the Service if you are barred from doing so under applicable law, including sanctions or export-control laws, or if your access has previously been suspended or terminated by us.

FlareX is a managed service that assesses and helps launch AI-built web applications. The core workflow is as follows.

• Import. You import an existing web application that you own by providing a public GitHub repository URL or by uploading a ZIP archive. FlareX fetches the imported source and stores it workspace-scoped.
• Scan. We index the imported code and run deterministic security and configuration scans against it.
• Execute. To assess your application, we execute it in an isolated, throwaway sandbox, performing an install, build, and boot. The sandbox is network-isolated and capability-dropped and cannot reach FlareX's databases or the data of other customers.
• Readiness report. We generate an AI-written production readiness report containing a score from 0 to 100 together with findings. The report is produced from a bounded extract of your imported code processed by our AI subprocessor server-side. The report is informational and best-effort only and is not a security audit, certification, guarantee, or warranty, as set out in the readiness report disclaimer below.

Paid offers

• Production Readiness Report. A one-time offer priced at US$249, delivering the assessment and AI-written readiness report described above.
• Production Setup. A one-time offer priced at US$499, providing assistance to help prepare your application for launch.

Managed hosting

After an application passes readiness, we offer managed hosting plans (Launch, Growth, and Agency) on a monthly subscription basis. Managed hosting is currently onboarded with founder assistance, and the specific scope, resources, and timelines of a hosting engagement are confirmed with you during onboarding.

Legacy builder

FlareX previously offered an AI app and Discord-bot builder. Some existing accounts continue to use these builder features, including AI chat, generated code, and deployments. These Terms and our Privacy Policy cover both the current assessment and hosting products and the legacy builder. We may modify or discontinue legacy builder features as described in the section on changes to the Service.

We may add, change, or remove features of the Service over time. Pricing shown in this document reflects our offers as published and may be updated as described below.

To use most features you must create an account. We support sign-in through third-party identity providers (Discord, Google, and GitHub). When you sign in, we receive identity details from your chosen provider, as described in our Privacy Policy.

Your responsibility. You are responsible for all activity that occurs under your account and for maintaining the confidentiality of your credentials and connected provider accounts. You must notify us promptly at [email protected] if you suspect any unauthorised access or use.

Stored secrets. If you choose to store secrets or environment variables with us, you are responsible for the accuracy and lawful use of that material. We encrypt stored secrets at rest using AES-256-GCM and decrypt them only at runtime on the runner host. You remain responsible for rotating any credentials you import or store, particularly any credentials committed within your imported source.

Your use of the Service is subject to our Acceptable Use Policy, available at /acceptable-use, which is incorporated into these Terms. You agree to comply with it at all times.

Without limiting that policy, you must not use the Service to import, scan, host, or process any application or content that you are not authorised to use; to infringe the rights of others; to introduce malware or attempt to defeat the isolation of the scan sandbox or otherwise compromise the security or integrity of the Service or other customers; to violate any law; or to interfere with the normal operation of the Service. We may investigate suspected violations and take the actions described in the section on suspension and termination.

Customer content means the source code you import, your uploaded archives, the secrets and environment variables you choose to store, your legacy builder content (including chat, generated code, and deployments), and any other material you submit to the Service.

Your authorisation and representation. By importing a repository or uploading an archive, you represent and warrant that you own it or are otherwise authorised to scan, execute, and analyse it, and that doing so does not infringe any third party's rights or violate any law or agreement. You are solely responsible for ensuring you have all necessary rights and permissions before importing any application.

Licence you grant us. You grant FlareX a non-exclusive, worldwide, royalty-free licence to fetch, store, copy, index, execute, build, boot, analyse, and otherwise process your customer content for the purpose of providing the Service to you, including generating the readiness report and providing setup and managed hosting. This licence is limited to operating and improving the Service for your benefit and exists only for as long as needed to provide it and to meet our legal obligations.

Committed secrets. Imported source may contain credentials or secrets that you have committed to it. We handle imported source as described in the security section, including deleting the raw imported archive immediately after each scan completes while retaining workspace-scoped source as needed to provide the Service. You acknowledge that you are responsible for any secrets present in your imported code and should treat any such credentials as potentially exposed and rotate them.

As between you and us, you retain all ownership of your customer content. We claim no ownership over it. We do not use your customer content to train AI models.

Informational and best-effort only. The production readiness report, including its 0 to 100 score and findings, is informational and best-effort. It is not a security audit, certification, accreditation, guarantee, or warranty that your application is secure, compliant, fit for production, or free of defects.

Automated scanning and AI-generated assessment have inherent limitations. The report may miss real issues (false negatives) and may flag matters that are not actually problems (false positives). The score is an indicative summary, not a definitive measure of quality or safety.

You remain responsible. You remain solely responsible for the security, privacy, compliance, legality, and operation of your own application, including reviewing and acting on the report, fixing issues, securing credentials, and meeting any regulatory obligations that apply to you. You should not rely on the report as your sole or primary assurance of production readiness.

One-time offers. The Production Readiness Report is priced at US$249 and Production Setup at US$499. These are one-time charges payable in advance of, or as part of, delivery of the relevant offer.

Managed hosting subscriptions. Managed hosting plans (Launch, Growth, and Agency) are billed monthly in advance and renew automatically each billing period until cancelled. You may cancel a subscription at any time, and cancellation takes effect at the end of the then-current billing period unless we agree otherwise.

Payment processing. Payments are processed by Stripe. We store a Stripe customer identifier and your subscription and offer state. We never receive or store your full card numbers; payment-card data is handled by Stripe under its own terms.

Taxes. Stated prices are exclusive of taxes unless otherwise indicated. You are responsible for any sales tax, GST, VAT, or similar taxes and duties applicable to your purchase, except for taxes based on our income.

Refunds and your consumer rights. Except as required by law or as expressly stated, fees are non-refundable, including because the readiness report identifies issues or returns a low score, which is an expected outcome of the assessment. Nothing in this section limits or excludes any rights or remedies you may have under the Australian Consumer Law or other mandatory consumer protection laws that cannot lawfully be excluded. Where those laws give you a right to a remedy, that right applies despite anything else in these Terms.

We may change our prices and offers from time to time. Changes do not affect a one-time offer already purchased, and for subscriptions any price change applies from your next renewal after we give you reasonable notice.

The Service relies on third-party providers (subprocessors) to operate. These include Cloudflare (object storage via R2 for imported source and artifacts, plus CDN, DNS, WAF, and Turnstile), Anthropic (the AI that writes the readiness report from a bounded extract of your imported code, processed server-side and not used to train models), Stripe (payments), Sentry (error monitoring), Resend (transactional email), Discord, Google, and GitHub (OAuth identity), and a cloud VPS hosting provider for compute in the Singapore region.

Your use of third-party identity providers and any external services you connect is governed by those providers' own terms and policies. We are not responsible for third-party services that we do not control, and their availability may affect the Service. Our Privacy Policy describes how these subprocessors handle personal information.

Our platform. FlareX and its licensors own all rights, title, and interest in the Service, including the platform, software, scanning logic, report generation, user interfaces, documentation, trade marks, and all related intellectual property. Except for the limited rights expressly granted in these Terms, no rights are granted to you.

Your content. You retain all rights in your customer content. The licence you grant us in the customer content section is solely to enable us to provide the Service.

Reports. The readiness report we deliver to you is provided for your internal use in connection with your application. You may use and share it for that purpose, subject to these Terms.

Feedback. If you give us feedback or suggestions about the Service, you grant us a perpetual, irrevocable, royalty-free licence to use that feedback to improve our products and services without obligation to you.

Each party may have access to non-public information of the other in connection with the Service. We treat your customer content, including your imported source and stored secrets, as confidential and use it only to provide the Service, consistent with these Terms and our Privacy Policy.

A receiving party will protect the other party's confidential information using reasonable care and will not disclose it except to personnel and subprocessors who need it to perform under these Terms and who are bound by confidentiality obligations, or where disclosure is required by law. These obligations do not apply to information that is or becomes public without breach, was lawfully known before disclosure, or is independently developed.

As is. To the maximum extent permitted by law, the Service, including the readiness report, scans, sandbox execution, setup, and managed hosting, is provided on an as is and as available basis, without warranties of any kind, whether express, implied, or statutory, including any implied warranties of merchantability, fitness for a particular purpose, accuracy, or non-infringement.

We do not warrant that the Service will be uninterrupted, error-free, or secure, that defects will be corrected, or that any assessment or report is complete or accurate. The disclaimer in the readiness report section applies in full.

Non-excludable consumer guarantees. Nothing in these Terms excludes, restricts, or modifies any consumer guarantee, right, or remedy conferred by the Australian Consumer Law or any other applicable law (including, for users it covers, the General Data Protection Regulation in the EU and the United Kingdom and the California Consumer Privacy Act as amended by the California Privacy Rights Act) that cannot lawfully be excluded or limited. Where our liability for breach of such a guarantee can be limited, our liability is limited, at our option and to the extent permitted, to resupplying the relevant services or paying the cost of having them resupplied.

To the maximum extent permitted by law, and subject to the non-excludable consumer guarantees described above, FlareX will not be liable for any indirect, incidental, special, consequential, or exemplary damages, or for any loss of profits, revenue, data, goodwill, or business opportunity, arising out of or relating to the Service, even if advised of the possibility of such damages.

To the maximum extent permitted by law, our total aggregate liability arising out of or relating to these Terms or the Service is limited to the greater of the total amount you paid us for the Service in the twelve months before the event giving rise to the liability, or US$100.

You acknowledge that you are responsible for the security and operation of your own application and that we are not liable for issues arising from your application, your customer content, including any secrets committed to your imported source, or your reliance on the readiness report. These limitations do not apply to liability that cannot be limited or excluded under applicable law.

To the extent permitted by law, you agree to indemnify and hold harmless FlareX and its personnel from and against any claims, liabilities, damages, losses, and reasonable costs (including legal fees) arising out of or relating to your customer content, your importation or use of any application you were not authorised to scan or host, your breach of these Terms or the Acceptable Use Policy, your violation of any law or third-party right, or your application as deployed or operated by you.

By you. You may stop using the Service and close your account at any time. Cancellation of a managed hosting subscription takes effect at the end of the current billing period as described in the fees section.

By us. We may suspend or terminate your access, in whole or in part, if you breach these Terms or the Acceptable Use Policy, if required to protect the Service or other customers, if you fail to pay fees when due, or if required by law. Where practicable and lawful, we will give you notice.

Effect of termination. On termination, your right to use the Service ends. We will handle your data in accordance with our Privacy Policy, including our retention and deletion practices. Provisions that by their nature should survive, including those on customer content representations, intellectual property, confidentiality, disclaimers, limitation of liability, indemnity, and governing law, survive termination.

We take reasonable measures to protect the Service and your data. Key handling practices include the following.

• Workspace-scoped storage. Imported source is stored workspace-scoped in Cloudflare R2.
• Raw archive deletion. The raw imported archive is deleted immediately after each scan completes, as a data-minimisation measure.
• Isolated sandbox. The scan sandbox is network-isolated and capability-dropped and cannot reach FlareX's databases or other tenants.
• Encryption of secrets. Stored secrets are encrypted at rest using AES-256-GCM and decrypted only at runtime on the runner host.

No method of storage or transmission is completely secure, and we cannot guarantee absolute security. Our Privacy Policy describes in more detail what data we handle and how, and applies alongside these Terms.

Changes to the Service. We may add, modify, suspend, or discontinue features of the Service, including legacy builder features, at any time. Where a change materially reduces core functionality you are paying for, we will act reasonably and consistently with your non-excludable consumer rights.

Changes to these Terms. We may update these Terms from time to time. When we make material changes, we will take reasonable steps to notify you, such as posting the updated Terms with a revised effective date or sending a notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated Terms. If you do not agree, you must stop using the Service.

These Terms are governed by the laws in force in Australia, without regard to conflict-of-laws principles. You and FlareX submit to the non-exclusive jurisdiction of the courts of Australia and the courts competent to hear appeals from them.

International users. FlareX is available to users worldwide. Where mandatory consumer protection or data protection laws of your jurisdiction apply, including the General Data Protection Regulation in the EU and the United Kingdom and the California Consumer Privacy Act as amended by the California Privacy Rights Act, those laws apply to the extent they grant you rights that cannot be overridden by contract, and our Privacy Policy describes the corresponding privacy rights and how to exercise them.

Resolving disputes. If a dispute arises, we encourage you to contact us first at [email protected] so we can try to resolve it informally and in good faith. If we cannot resolve a dispute within a reasonable time, either party may pursue available remedies. Nothing in this section prevents you from exercising any non-excludable statutory rights or from bringing a matter before a relevant consumer or data protection authority.

These Terms, together with the Acceptable Use Policy and Privacy Policy, are the entire agreement between you and us regarding the Service. If any provision is found unenforceable, the remaining provisions continue in effect. Our failure to enforce a provision is not a waiver. You may not assign these Terms without our consent; we may assign them in connection with a merger, acquisition, or sale of assets. We are not liable for delays or failures caused by events beyond our reasonable control.

If you have questions about these Terms or the Service, please contact us.

Terms and legal enquiries: [email protected]
Privacy and data requests: [email protected]
General support: [email protected]