Terms of service

1. Terms of Service

These terms are between Kerova Ltd (company no. 17503897, registered office 128 City Road, London, EC1V 2NX, "Kerova", "we") and the business that signs up ("you"). Effective date: 10 October 2026.

1.1 The service

1. Kerova provides web-based software for UK fire and security companies to complete, sign, store and share compliance certificates, manage sites, systems, remedials and scheduling, give clients portal access, and send invoice data to Xero (the "Service").
2. The Service is a tool. Your engineers remain responsible for the inspections, tests, results, verdicts and signatures they record. Kerova does not inspect, certify or approve any system.
3. Calculators, checkers, guides and verdict suggestions are aids only. You must check results against the relevant standard and the manufacturer's data.

1.2 Accounts and users

1. You are responsible for who you give access to, for keeping logins secure, and for everything done under your account.
2. Tell us straight away at admin@kerova.co.uk if you think an account has been misused.
3. You must remove access for staff, subcontractors and clients who should no longer have it.

1.3 Pilot terms

1. Pilot customers get the first month free from the day logins are issued.
2. Before the free month ends, we will agree the monthly price with you in writing. If you don't wish to continue, your access ends at the end of the free month with no charge.
3. During the pilot, features may change and there may be occasional bugs or downtime. We will tell you about planned changes that affect how you work.
4. You can stop at any time during the free month with no charge.

1.4 Fees and payment

1. The standard price is a flat monthly fee based on the number of engineers, as quoted to you in writing.
2. Fees are invoiced monthly in advance and payable within 14 days. Prices exclude VAT, which will be added if Kerova becomes VAT registered.
3. We may change prices with at least 30 days' written notice.
4. If an invoice is more than 30 days overdue we may suspend access after giving you 7 days' notice.

1.5 Your data

1. You own the data you and your users put into the Service ("Customer Data"), including certificates, sites, systems, photos and your clients' details.
2. We only use Customer Data to provide and support the Service, as set out in the Data Processing Agreement below, which forms part of these terms.
3. You can export your data at any time while your account is active. After cancellation, we keep it for 30 days so you can export it, then delete it, apart from anything we must keep by law.
4. You confirm you have the right to give us your clients' and staff's details for this purpose.

1.6 Signed certificates

1. Once a certificate is signed it is locked and cannot be edited. Any correction will be made as a new version with an audit trail, when versioning is available.
2. Each signed certificate gets a QR code and a verification page so anyone holding it can check it is the genuine signed version. The verification page does not show your clients' personal contact details.

1.7 Acceptable use

You must not use the Service to record false inspections or certificates, try to access other customers' data, reverse-engineer, overload or attack the Service, or resell it without our written agreement.

1.8 Availability and support

1. We aim to keep the Service available at all times but do not guarantee it will be uninterrupted or error-free. Engineers can complete certificates offline and sync later.
2. Support is by email at admin@kerova.co.uk. We aim to reply within one working day.

1.9 Liability

1. Nothing in these terms limits liability for death or personal injury caused by negligence, fraud, or anything else that cannot be limited by law.
2. We are not liable for loss of profit, revenue, business, goodwill or data you could have exported, or for any indirect loss.
3. We are not liable for the content of any certificate, inspection or decision made using the Service.
4. Otherwise, our total liability in any 12 months is limited to the fees you paid us in that period, or £1,000 if greater.

1.10 Ending the agreement

1. You can cancel at any time by email, effective at the end of the current paid month.
2. We can end the agreement with 30 days' notice, or immediately if you seriously breach these terms.
3. On ending, sections 1.5, 1.9 and 1.11 continue to apply.

1.11 General

1. We may update these terms with 30 days' notice by email. Continuing to use the Service after that means you accept the change.
2. These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
3. Contact: Kerova Ltd, admin@kerova.co.uk.

2. Data Processing Agreement

This agreement forms part of the Terms of Service. You are the controller of the personal data you put into Kerova, and Kerova Ltd is your processor under Article 28 of the UK GDPR and the Data Protection Act 2018. Effective date: 10 October 2026.

2.1 What we process

2.2 Our obligations

1. We only process the data on your documented instructions, which are these Terms and how you use the Service, unless the law requires otherwise, in which case we will tell you first if we can.
2. Everyone at Kerova with access to the data is bound by confidentiality.
3. We keep appropriate technical and organisational security measures in place (section 2.4).
4. We help you respond to requests from people exercising their data rights, and with security, breach notification and data protection impact assessments, as far as reasonably possible.
5. We tell you without undue delay, and within 48 hours of becoming aware, of any personal data breach affecting your data.
6. At the end of the Service we delete your data after the 30-day export period, unless the law requires us to keep it.
7. We give you the information you reasonably need to show compliance, and allow a reasonable audit on 30 days' notice, no more than once a year, at your cost.

2.3 Sub-processors

You give general authorisation for the sub-processors below. We will give you 30 days' notice by email before adding or replacing one, and you can object. Each is bound by data protection terms at least as protective as these.

2.4 Security measures

1. Data is hosted in the UK, in Google's London region, encrypted in transit and at rest.
2. Each company's data is separated by access rules that are tested to stop one company seeing another's data.
3. Access is role-based (admin, engineer, client portal user) and needs a login.
4. Signed certificates are locked against editing, with an integrity check behind the QR verification.
5. Daily and weekly backups with point-in-time recovery, kept for 90 days.
6. Rate limiting on public pages and no personal data written to logs.

2.5 International transfers

Your data is stored in the UK. Some sub-processors (Resend, Anthropic, Mapbox, and parts of Google's sign-in and push services) process data in the USA. For each, we rely on an approved safeguard: the UK Extension to the EU-US Data Privacy Framework where the vendor is certified, or the UK International Data Transfer Addendum.

2.6 Liability

Liability under this agreement is subject to the limits in section 1.9 of the Terms, except where the law does not allow it to be limited.