Terms of Service

Waymarq is operated by Tortoise IT Ltd, a company registered in England and Wales (company number 08009597). "We", "us" and "Waymarq" mean Tortoise IT Ltd. "You" means the person or organisation using the service.

These terms cover the Waymarq application at waymarq.co.uk, its API, command-line tool and MCP server, and the links Waymarq lets you send to your clients. By creating an account or using the service you agree to them. If you are using Waymarq on behalf of an organisation, you confirm you can bind it to these terms, and "you" includes that organisation.

Our privacy policy describes what we do with personal data as a controller. The data processing terms at the end of this page apply where we process data on your behalf.

Waymarq is in early access. That means it is complete enough to use for real work — people do — but it is still changing, and some of what you use today will look different in a month. We will tell you about changes that affect how you work, in the product or by email.

In return for using it while it is still being shaped, early-access accounts will not be charged when pricing arrives. Some modules built later may be priced separately; the account you have today stays free.

You must give accurate details when you sign up and keep them current. You are responsible for everything done under your account and the accounts of people you invite, and for keeping passwords, sign-in codes and API tokens to yourself. If you think something has been compromised, tell us and rotate the token or password straight away — both can be done from Settings.

An organisation's owner and admins can add people, set what they can see, and remove them. Someone with the viewer role can read but not change. We do not decide who in your organisation should have access; you do.

Everything you put into Waymarq — projects, tasks, clients, quotes, files, time, the lot — belongs to you or to whoever you got it from. We claim no ownership of it. You give us only the permission we need to store it, show it to the people you have given access to, back it up, and run the features you switch on.

You are responsible for having the right to upload what you upload. Much of what goes into a project tracker is about other people — a client's contact details, a supplier's phone number, whatever is inside a brief. Where that is personal data, you are its controller and we process it for you under the processing terms below.

Everything in your account is readable through the API, and you can delete your organisation, with everything in it, from Organisation settings at any time. We will never keep your data from you or make it hard to take with you.

Waymarq lets you send links that need no account to use: a read-only view of a project, a quote a client can accept, a form for reporting an issue, a set of questions to answer. Anyone with the link can use it. You decide who gets one, and you can revoke any of them from the project.

When a client accepts a quote through a link, Waymarq records the name they typed, the time, and their network address, and shows you that record. It is a record of what happened, kept so there is something to point at. It is not a qualified electronic signature, and we make no claim about its legal standing beyond that.

AI in Waymarq is optional and off by default; the product works fully without it. If you switch it on with your own API key, the data you send through it — briefs, plans, task text — goes to the provider you chose (Anthropic, OpenAI or Google) under that provider's terms, and they bill you directly. New accounts get a small trial on our own key so you can see what it does; during the trial the same data goes to the provider under our account.

AI output is a starting point, not a finished answer. Plans, estimates, summaries and suggested changes can be wrong, incomplete or confidently misleading, and we show you everything before it is applied so that you can check it. You are responsible for what you accept. Do not quote a client, or commit to a date, on an AI figure you have not looked at.

An API token acts as the person who created it, with whatever that person can do. Treat it as a password. Tokens can be scoped to read-only and revoked at any time from Organisation settings.

Webhooks deliver data from your account to a URL you choose. You are responsible for that endpoint, for verifying the signature we send, and for what happens to the data once it arrives. We may pause deliveries to an endpoint that keeps failing, and we will show you why.

Use the API reasonably. We may rate-limit or block traffic that is abusive, that harms the service for others, or that is plainly not what the API is for. If you are doing something unusual at scale, ask first — we would rather help than block.

You may not use Waymarq to:

• break the law, infringe someone's rights, or store content you have no right to store;
• send unsolicited messages through invitations, share links, support forms or clarification links;
• probe, scan, overload or interfere with the service, or try to reach data that is not yours;
• resell access to the service, or let people outside your organisation use your seats.

If we have to act on any of this we will tell you what we found and, where it is reasonable to, give you a chance to put it right.

Waymarq is free during early access. When pricing arrives it will be per seat — a seat being someone who can change things — with viewers free and client links never counting. We will publish prices and tell you before anyone is charged anything. No card is required today and nothing is billed automatically.

We work hard to keep Waymarq up, and it is backed up. It is early access from a small company, though, and we do not promise a particular uptime, response time or support hours. If something breaks, tell us through the contact page or the feedback button in the app, and we will look at it as quickly as we can.

We may change, add or remove features. Where a change removes something you rely on, we will say so ahead of time.

You can close your account, or delete an organisation and everything in it, from Settings at any time. Deletion is permanent and immediate: it removes the projects, files, records and history in that organisation. We ask you to type its name to confirm, because there is no undo.

We may suspend or close an account that breaks these terms or puts the service or other customers at risk. Unless the situation makes it unreasonable, we will tell you first and say why. If we ever decide to stop offering Waymarq altogether, we will give at least ninety days' notice and keep your data available to export during that time.

Waymarq is provided as it is. We do not warrant that it is error-free or uninterrupted, or that any figure it produces — an estimate, a percentage complete, a delivery forecast, an AI summary — is correct. A statement of account is a record of what you have billed and been paid; it is not an invoice, a tax document or accounting advice.

To the extent the law allows, we are not liable for loss of profit, business, data or goodwill, or for indirect or consequential loss, arising from your use of the service. Where liability cannot be excluded, and while the service is free, our total liability to you is limited to £100. Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything else the law says cannot be limited.

You agree to cover us for claims from third parties arising from content you put into Waymarq or from your use of client links, the API or webhooks in breach of these terms.

We may update these terms. The date at the top is the version you are reading. If a change is material we will tell you by email or in the product before it takes effect, and continuing to use Waymarq after that is acceptance. If you do not accept a change, close your account before it takes effect.

These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute — though we would much rather talk first.

The quickest way to reach us about anything in this policy — including a request to exercise your rights — is our contact form. Choose “Data / GDPR request” as the subject so it reaches the right person and we can respond within the statutory one-month deadline.

The data controller is Tortoise IT Ltd, trading as Waymarq, a company registered in England and Wales. Our company website is sean-barton.co.uk, where our registered postal address and company details are published. We have not appointed a Data Protection Officer — we are not required to — so requests are handled directly by the company.

Subject matter

Operating the Waymarq service for you: storing, displaying and processing the records you and your team create.

Duration

For as long as you have an account, and for the deletion period below once you close it.

Nature and purpose

Hosting, backup, display to the people you have granted access, sending the notifications you have switched on, and running the features you use — including AI features, only where you have enabled them.

Types of data

Names, contact details, job titles and correspondence of your clients, prospects, suppliers and their staff; whatever appears in briefs, files, tasks, quotes, statements and time records; images and documents you upload.

Data subjects

Your clients and prospects and their staff; your suppliers and contractors; people who use a link you send them.

• Instructions. We process your data only to provide the service and as these terms and your use of the product instruct — never for our own purposes. If we believe an instruction breaks the law we will tell you.
• Confidentiality. The people who can access your data are bound to keep it confidential. In practice that is a very small number of people.
• Security. We take measures appropriate to the risk: encrypted connections, encryption of stored API keys, access controls, backups, and separation between organisations' data within the service.
• Sub-processors. We use the sub-processors listed below and you authorise them. We will update the list on the privacy policy and tell you before adding one, and you may object; if we cannot resolve an objection you may close your account.
• Helping you meet requests. If someone exercises a data-protection right against you about data held in Waymarq, we will help you respond, given the nature of the service and the information available to us.
• Breaches. If we become aware of a personal data breach affecting your data, we will tell you without undue delay, and within 72 hours, with what we know and what we are doing about it.
• Deletion. When you delete an organisation, its data is removed from the live service immediately and from backups as they rotate, within 30 days. When you close an account, the same applies.
• Showing you. We will make available the information reasonably needed to demonstrate these obligations, and will cooperate with an audit you reasonably request, at reasonable notice and no more than once a year unless a breach or a regulator requires otherwise.

The current list is in the privacy policy under "Who else processes your data", and it is short: our hosting provider, our email delivery provider, our CDN, and — only where you switch them on — your chosen AI provider, Google Analytics and the Companies House lookup. None of them may use your data for their own purposes.

Your data is stored in the United Kingdom. Where a sub-processor is outside the UK — the AI providers are in the United States — the transfer is made under the UK International Data Transfer Agreement or an adequacy decision, and only occurs because you switched that feature on.