Terms of Service — Master Services Agreement

Version: September 28, 2026 — MSA revision 4.

1. Your agreement

These Terms of Service are also called the Master Services Agreement (MSA); “Terms”, “MSA” and “Agreement” refer to this same document. They govern ohmyho.st, operated by Amerged B.V., KVK 42154221, Venray, Limburg, NL (we, us). The customer is the person or organisation for whom you create the account or place an order (you). You must have capacity to enter this agreement and authority to bind an organisation you represent. Use our contact form for service, billing and legal enquiries.

By signing up, you accept these Terms of Service and the Data Processing Agreement, including its processing description, TOMs, provider register and transfer annex. The DPA applies to personal data we process on your behalf. You acknowledge our Privacy notice; that acknowledgement is not consent to every processing activity, marketing or a payment.

The order or checkout you expressly accept states the purchased service, price, tax and any recurring payment terms. That order prevails for its specific commercial terms; the DPA and any applicable mandatory transfer clauses prevail for their subject matter. You can retain these documents using their Markdown versions or your browser’s print/save function.

2. Open signup and supported hosting

ohmyho.st has open signup: you can create an account without an invitation. A signup source recorded from a link is attribution, never an access code. A workspace's referral link, or a project's “Powered by ohmyho.st” flag while it shows, gives a new user's first workspace the configured referral benefit once (currently 1,000 credits and 30 days of granted Paid access). The referring workspace receives its configured reward when that workspace first pays: currently 1,000 credits. It also receives 30 days of Paid access unless an active Paid subscription or an indefinite Paid grant already covers it; its existing Stripe billing period stays unchanged. Direct signup and an invalid referral value create a Free workspace without a referral reward. Any other source adds only the benefit configured for it, if any.

While a project shows the opt-in flag, its customer-owned domain has no domain usage fee and is also available on Free; each paid Stripe billing period adds the configured flag credits. Referral and flag benefits do not create a permanent entitlement to future benefits. We may change or end these benefits at any time, subject to mandatory law. An already completed payment or recorded credit grant keeps its recorded terms. A granted or manual Paid-feature entitlement is not a paid subscription and does not authorise a charge. Such an entitlement can be withdrawn; we give reasonable notice where practicable, while urgent security or legal restrictions can take effect immediately.

The service hosts supported GitHub applications and requested database, domain, transactional-mail, file and runtime capabilities. Your agent uses the API, CLI or MCP to plan and operate them; the portal exposes supported account, project, credit and budget controls. Current documentation, returned plans and service status describe availability and limits. A roadmap vote or marketing calculator is not an order for an unimplemented feature.

Dev/Prod data is shared by default; selecting a data mode is optional. You can choose isolated data or later change which environment keeps an existing data area through an Owner-confirmed plan. We do not copy database records or files during a data change, and there is no special data-change price: ordinary resource usage remains metered. Returning to shared data keeps Prod's data and permanently removes the separate Dev data, files and deployment; resetting isolated Dev permanently removes its data, files and deployment. Reversing the mode does not restore deleted material. Review the concrete plan and retain any copies you need before confirming.

A project chooses its hosting region when it is created: US by default, or EU. That choice places the project's database, files, build sandbox and build objects in the chosen region, its application runs next to its database, and the choice cannot be changed later; transactional mail is sent from the platform's mail region regardless of it. Control databases, edge delivery and provider operations have distinct locations described in the Privacy notice and DPA; the workload setting is not a promise that every category of service data stays exclusively in that region.

3. Accounts, credentials and agents

Provide accurate account/billing details and keep them current. Protect your account, tokens, repository permissions, application secrets and export passwords. New API keys have no scheduled expiry and remain usable until revoked, subject to current membership and permissions. The full value is shown once; retain it securely and revoke a key when it is no longer needed or may have been exposed. Browser-session expiry is separate.

You control which people and agents act for your organisation. A project ID or user ID in a prompt is context, not access authority. Review material changes, spending and destructive operations before authorising your agent. Tell us promptly through the contact form if you suspect unauthorised access. We remain responsible for our own contractual and statutory security duties.

Your application’s end-user authentication remains your responsibility. Our hosting login does not supply your application’s users or replace the auth provider you choose. Customer-selected agents, authentication services and external integrations operate under your separate agreements with them.

4. Your content and permitted use

You retain your rights in your source code, application data and content. You grant us and the providers engaged for the service only the rights needed to access authorised GitHub source, build, store, host, transmit, troubleshoot, export and delete that material according to your instructions. We do not acquire ownership of it or use application content to train a general-purpose AI model. We retain our rights in the platform, documentation and branding; applicable open-source licences govern their components.

You must have the rights and lawful basis needed for the content and processing you submit. Do not use the service for unlawful content, spam, phishing, malware, unauthorised access or attacks, infringement of rights, evasion of service limits or conduct that materially harms other customers or the infrastructure. Special-category, criminal-offence or other regulated data requiring additional safeguards needs an agreed arrangement that supports that use before submission.

You are responsible for your application code, dependencies, user notices and authorised messages. We may investigate credible abuse, restrict the affected activity and comply with binding legal obligations. We do not promise to review every application or guarantee that an agent-generated application is correct or secure.

5. Credits, measurement and budgets

Projects use their organisation’s shared credit balance. The current rate card and deployment plan describe measured charges. Prices, tax and credit consumption are different quantities. Retained database or file storage can use credits while compute is idle.

Free monthly allowance credits expire at the end of their UTC month. Paid monthly credits and that period’s powered-by bonus expire at the end of their billing period without rollover; monthly credits are spent before top-ups. Top-up and automatic-recharge credits have no time limit while the workspace keeps active Paid access; they expire when Paid access effectively ends, not when cancellation is requested, and a later upgrade does not restore them.

When an uncancelled Stripe subscription has an unpaid renewal, Paid features and usable top-ups continue for at most 14 days after the paid billing period ends. No new Paid monthly credits or Free monthly allowance are issued during that renewal grace period; new Paid monthly credits require payment. If Paid access ends when the grace period expires, remaining top-ups expire too. A subscription cancelled for the period end has no unpaid-renewal grace: its Paid access ends at that period end, unless another valid Paid entitlement covers the workspace.

Configured signup/referral bonuses and manual grants keep their recorded terms. Existing payment, grant, spending, correction and expired-credit records are retained; this revision does not restore previously expired credits. Credits are service-use units, not money, a deposit or an investment. They are not transferable between customers or redeemable for cash except where law or an expressly agreed refund requires it. Corrections, refunds and disputes can adjust associated credit entries; one payment does not earn credit twice.

Project budgets use UTC calendar months. You may select no limit or a credit limit with the supported Continue/Stop behaviour. Measurements can arrive after work starts: a budget does not erase already incurred, reserved or delayed usage. Insufficient credits or a Stop limit can restrict affected capabilities under the documented rules. Keep monitoring and a recovery plan for important workloads.

6. Purchases, subscriptions and recharge

Where purchases are enabled, Stripe processes checkout and invoices. Checkout shows the amount, currency, applicable tax and recurring terms before payment. Provide a correct billing address and a valid business tax ID if relevant. We calculate applicable taxes through Stripe Tax; any business status or tax treatment you claim must be accurate. Each completed purchase receives an invoice.

A subscription renews on its stated billing cycle until cancelled. Cancel future renewals using the Stripe management link in Billing; the subscription ends at the period end displayed there unless an applicable right requires otherwise. Contact us for assistance. A top-up does not renew a subscription. Top-ups and automatic recharge are available only while the workspace has active Paid access. Turning recharge off does not cancel a subscription.

Automatic recharge is a separate opt-in. Saving a payment method, signing up, accepting these terms or moving a marketing calculator does not enable it. When you explicitly enable the current policy, you authorise 1,000 top-up credits for USD 9 plus applicable tax when available credits fall below 100, subject to your displayed gross monthly limit. The limit uses UTC calendar months and includes tax. There is at most one unresolved recharge attempt at a time. Without active Paid access no recharge starts; your consent remains until you turn recharge off.

Turn recharge off in Billing or through the supported API, CLI or MCP to prevent new attempts. An invoice or payment already initiated can still complete and is reconciled to your balance. A tax-address problem, failed payment or unresolved result can pause recharge; the status identifies the required action. We do not silently disable tax or create another charge to hide an uncertain result.

7. Cancellation, refunds and data return

You may stop using the service, cancel future subscription renewals and turn recharge off using the controls above. Delete projects through the supported client workflow, or use the contact form for account closure and assistance. Deleting an application does not itself cancel a separate subscription or payment already initiated. Charges already incurred remain payable, subject to any correction or refund owed. For business customers, purchases are otherwise non-refundable and cancelling a renewal does not refund the current period; express remedies and mandatory rights below still apply.

Use the contact form to report an incorrect charge or request a refund. Mandatory refund, withdrawal and conformity rights remain available. Where consumer law gives a distance-service withdrawal right, it is generally fourteen days from contract formation; send an unambiguous withdrawal request identifying your account and purchase through the contact form. Any lawful exception or proportionate charge for service supplied during that period applies only when its statutory conditions and required prior request or acknowledgement are met. Signup alone does not waive those rights.

We may suspend the affected service for a material breach, credible security risk, unlawful activity, payment failure or binding legal requirement. Where safe and lawful, we explain the reason and provide a reasonable opportunity to resolve it. Suspension does not itself erase credit history or mandatory rights. If we permanently discontinue a paid service for our convenience, we provide reasonable notice and an appropriate return of unused purchased service value; promotional credits do not acquire a cash value as a result.

Retrieve the data you need before deletion or closure. Supported exports are asynchronous password-encrypted ZIP archives containing portable SQL only: no source code, application files or configuration. At most one request per project is accepted per rolling 24 hours. You supply and retain the password, poll for completion and request an authorised download link valid for 24 hours. The hosted archive expires after seven days. Retain and retrieve application files separately. Downloaded copies are your responsibility; the DPA governs personal-data return/deletion assistance beyond the SQL archive.

8. Service standard, warranties and support

We provide the agreed service with reasonable care and skill. For a purchased service, our express service commitment is substantial conformity with its applicable documentation and accepted order. For business customers, the remedy for a material failure of that commitment is correction or an equivalent working service within a reasonable time after you give us sufficient details. If neither remedy is reasonably practicable, you may end the affected service and receive the unused prepaid fees for its remaining term. This remedy does not reduce mandatory rights or the exceptions in section 10.

Except for an express commitment in this MSA, an accepted order or mandatory law, the service, its features, sample applications, documentation and agent instructions are supplied as available and as is. To the extent legally permitted for business customers, we exclude implied warranties of merchantability, satisfactory quality, fitness for a particular purpose and non-infringement. We do not warrant uninterrupted or error-free operation, complete security against every threat, or that generated code, agent output or an integration meets your particular requirements.

The service includes no uptime SLA, guaranteed support response time, universal recovery deadline or guarantee that every feature will remain available. Dedicated support, maintenance of your application, legal defence and indemnification are not included unless we expressly agree to them in writing. You may still report problems through our contact form. Our express service obligations, DPA assistance and security duties, and mandatory remedies remain applicable.

You assess suitability before relying on the service for important workloads. Review and test code, migrations, agent actions and restoration procedures, retain the data and credentials you need, and arrange independent copies where appropriate. Hosting an application does not make us its developer or the operator of your relationship with its end users.

9. Customer-selected services and dependencies

You arrange the licences, permissions, notices and accounts needed for agents, authentication systems, APIs and other external services you choose. Their suppliers control their availability, pricing and changes. A recommendation, example or supported connector does not make us the supplier of that separate service or promise indefinite compatibility. We may adapt or discontinue an affected integration when an external service changes or becomes unavailable, with reasonable notice where practicable and the cancellation/refund protections in this MSA where applicable.

Responsibility for a loss is allocated according to its cause. We are not responsible to the extent a failure results from your code, instructions, compromised credentials within your control, unauthorised modifications or a separately contracted service outside our control, except to the extent our own breach contributed to it. This allocation does not remove responsibility for subcontractors we engage to perform our obligations, or their obligations under the DPA. Infrastructure used to supply an agreed managed capability is not reclassified as your separate purchase to avoid those obligations.

10. Business liability limits and preserved rights

This section's contractual exclusions and cap apply only when you use the service for business or professional purposes. They do not limit a consumer's mandatory rights.

To the extent permitted by applicable law, we exclude liability for indirect, consequential, special, exemplary or punitive damages and for lost profit, revenue, anticipated savings, goodwill or business opportunities. For business customers, we also exclude losses caused by relying on unreviewed agent output, failing to keep an export password, or failing to take reasonable steps to avoid or reduce loss, but only to the extent those acts caused the loss and the exclusions are legally permitted. An export feature is not an assurance that every backup or recovery will succeed.

Subject to the exceptions below, our total aggregate liability to a business customer arising from or connected with this MSA and the service is limited to USD 1,000. This is one combined cap for all related claims, not a separate amount per incident, project, organisation, user, defendant or legal theory; related events are treated together. The cap applies to contractual, tortious (including negligence) and other claims, whether or not the possibility of a loss was known. It does not reduce a refund expressly owed under section 7 or 8, or a correction of an incorrectly collected payment. A court finding one particular exclusion inapplicable does not by itself disapply an otherwise lawful cap.

Nothing in this MSA excludes or limits liability for fraud, intentional misconduct, gross negligence or deliberate recklessness, death or personal injury where exclusion is prohibited, or any other liability that cannot lawfully be excluded or limited. Mandatory data-protection duties, data-subject compensation and statutory recourse rights, applicable transfer clauses, and non-excludable consumer remedies remain unaffected. We do not rely on these terms to make an unlawful exclusion effective. You retain the right to contest whether a limitation is enforceable.

For business customers, these limitations allocate the risks of an agent-operated, metered service and are reflected in its price; purchasing credits does not buy unlimited loss coverage or an unstated service guarantee.

11. Business customer indemnity

If you use the service for business, you will defend us and reimburse reasonable defence costs and amounts finally awarded or agreed in a settlement for a third-party claim that results from your unlawful customer content, infringement by your application or materials, or your material breach of the permitted-use obligations. This indemnity applies only to the extent the claim is attributable to you; it does not cover our breach, negligence or misconduct, or a modification or use by us outside your instructions that caused the claim. It does not apply to consumers.

We will notify you promptly, provide reasonable cooperation at your expense and let you control the defence with suitably qualified counsel, subject to conflicts of interest and applicable law. A delay in notice reduces your obligation only to the extent it materially prejudices the defence. You may not admit fault for us, impose a non-monetary obligation on us or settle without releasing us from the relevant claim unless we consent in writing; consent will not be unreasonably withheld. We may participate at our own expense. Neither party may recover the same loss twice.

12. Confidentiality, intellectual property and feedback

Each party will protect non-public information received from the other that is marked confidential or would reasonably be understood as confidential, including private source code, credentials, security details and commercial information. Use is limited to performing this agreement or another authorised purpose. Disclosure is limited to people who need it and are subject to appropriate confidentiality duties, or to legally required disclosure. Where lawful, the receiving party will give notice of required disclosure and limit it to what is required.

This obligation does not cover information the recipient can show was already lawfully known, independently developed, lawfully obtained without restriction, or made public without a breach. Personal data remains subject to the DPA and Privacy notice regardless of whether it is confidential. Confidentiality continues for as long as the information warrants protection; return, deletion and legally required retention follow the DPA and section 7.

You may operate your applications for your own users and customers within the agreed service limits. You do not receive ownership of our platform or a right to sell access to our accounts, copy protected platform components, remove ownership notices or bypass access controls. Mandatory interoperability rights, applicable open-source licences and authorised security research are not restricted by this paragraph. Your application's source and data remain yours; we obtain no right to take ownership of an application because you stop maintaining it.

You may voluntarily offer ideas and suggestions about the service. You allow us to use those ideas to improve our products without paying a fee or having to implement them. This permission does not transfer ownership of your application, license unrelated private code or authorise disclosure of confidential information or personal data. We will seek your permission before using your name or logo as a public customer endorsement.

13. Changes, events outside control and general terms

Material service or commercial changes apply prospectively after appropriate notice and any consent required by law. You may end an affected service before a material change takes effect under section 7. Urgent legal or security changes may take effect sooner, with an explanation where permitted. A later website edit does not rewrite an invoice, an accepted order or a historical signup record, and silence does not authorise a new recurring charge.

A party is excused from a delay only to the extent caused by an event beyond its reasonable control that it could not reasonably prevent or overcome, such as a natural disaster, war, binding government restriction or widespread network disruption. The affected party must take reasonable steps to mitigate the impact and inform the other where practicable. This does not excuse already incurred payment obligations, an ordinary preventable fault, or mandatory security and data-protection duties. If a substantial interruption continues for more than thirty days, either party may end the affected service; unused prepaid service value is handled under section 7.

No implied waiver. Not enforcing a right immediately, allowing extra time or overlooking one breach does not surrender that right for another occasion. A waiver must be clearly given by the party entitled to the right and applies only to its stated scope. Nothing here prevents a waiver, agreement or remedy that mandatory law recognises.

This MSA, its incorporated DPA and annexes, and your accepted order form the agreement on the service; their precedence is set out in section 1. Purchase-order boilerplate does not amend it without our express agreement. The parties are independent contractors: neither can bind the other, and no employment, partnership or agency relationship is created. An agent you choose acts under your authority, not as our employee or representative.

You may not transfer this agreement without our written consent, except through a transfer expressly supported by the service or permitted by mandatory law. We may transfer it as part of a business reorganisation or sale only with its obligations, without reducing your contractual or statutory protection; applicable notices and data-protection requirements still apply. No unrelated third party acquires contractual enforcement rights, while rights expressly given by the DPA, applicable transfer clauses or mandatory law are preserved.

If a provision cannot be enforced, the rest continues so far as legally possible; no replacement may remove mandatory rights. Payment obligations already incurred, ownership, confidentiality, lawful liability limitations and provisions needed to resolve existing disputes survive termination, together with applicable data-return, deletion and retention obligations. The English version is the controlling version to the extent permitted by mandatory law.

14. Law, disputes and notices

Dutch law governs this MSA. For business customers, the competent courts of Limburg, Netherlands have exclusive jurisdiction, subject to mandatory jurisdiction rules and rights to seek urgent interim relief. Consumers retain applicable mandatory protection and competent forums, including protection under their habitual-residence law and applicable US state law. This MSA imposes no mandatory arbitration or class-action waiver. The UN Convention on Contracts for the International Sale of Goods does not apply to the extent its exclusion is legally effective.

Comply with applicable export controls and sanctions when using or making the service available. We may restrict access where legally required; no statement here changes applicable law or authorises prohibited use.

Send service complaints, billing disputes and legal notices through our contact form, identifying the relevant account and matter, or by another legally effective written method. Keep the confirmation of receipt. We may send notices through the service or to your registered contact address; keep that address current. These arrangements do not replace mandatory rules for court documents, regulatory complaints, withdrawal or other statutory notices.

Contact · Privacy · Cookies · DPA and annexes · Documentation