Terms of Service

1. Who We Are

Frist is provided by Oshylabs Ltd, a company registered in England and Wales, company number 16883720, registered office 100 St Pier Court, 549 Green Street, London E13 9GU (we, us, our, Oshylabs). These terms form a legally binding contract between Oshylabs Ltd and the organisation that subscribes to Frist (you, your, the Customer).

2. What Frist Is

Frist is a compliance and evidence tool that helps social landlords track hazard cases against the Awaab's Law statutory deadlines, log contact and access attempts, generate AI-assisted resident written summaries, and produce an evidence pack. It is a support tool. It is not a repairs scheduler, an asset management system, or a substitute for your own compliance function.

3. Compliance Is Your Responsibility

Frist helps you track and evidence your work, but you remain solely responsible for meeting your legal duties under Awaab's Law and any other applicable law. The deadline calculations in Frist are based on published GOV.UK guidance. While we work to keep them accurate, we do not warrant that any timescale, calculation, or output produced by Frist is correct or complete for your particular situation. You must independently satisfy yourself that your actions meet your legal obligations. Nothing in Frist constitutes legal advice.

4. AI-Generated Outputs

Frist uses an artificial intelligence language model to generate written summaries of hazard cases and other outputs (AI Outputs). You acknowledge and agree that:

AI Outputs are produced by automated means and are drafts intended to assist your staff. They may contain errors, omissions, or inaccuracies, including hallucinations inherent to large language model technology.

AI Outputs must be reviewed and verified by a qualified human member of your staff before being relied upon, acted upon, or used as the basis for any decision affecting a resident or any external communication.

You must not use an AI Output as the sole basis for any decision that produces legal or similarly significant effects on a resident, including decisions about hazard categorisation, inspection timelines, access arrangements, or enforcement action. This obligation reflects your duties as controller under Article 22 UK GDPR.

Oshylabs does not warrant the accuracy, completeness, fitness for purpose, or legal sufficiency of any AI Output. The disclaimer in Clause 7 (Availability and Warranties) and the limitation in Clause 9 (Liability) apply in full to AI Outputs.

5. Accounts and Acceptable Use

You are responsible for all users you authorise to access Frist, for keeping login credentials secure, and for the accuracy and completeness of the data you enter. You must:

have a lawful basis under applicable data protection law to enter each category of resident data, including any vulnerability or health-linked information, into Frist;

act as the data controller for all resident data you enter and comply with your obligations as controller under the UK GDPR and the Data Protection Act 2018;

not attempt to access, copy, or interfere with another organisation's data on the platform;

not use Frist for any unlawful purpose or in any manner that violates these terms.

6. Subscription and Fees

Frist is made available on a subscription basis. The applicable fees, billing period, and plan limits are those displayed at the point of subscription or as separately agreed in writing between the parties.

Payments are handled through our payment provider, Stripe. Fees are exclusive of VAT unless expressly stated otherwise. Unless otherwise agreed in writing, fees paid for a part-used period are non-refundable.

We may vary the fees applicable to your subscription by giving you not less than 30 days' prior written notice. If you do not wish to accept the revised fees, you may terminate your subscription in accordance with Clause 11 (Termination) before the new fees take effect, in which case the existing fees will continue to apply until the termination date.

7. Availability and Warranties

We aim to keep Frist available and to protect your data, but we provide the service on an 'as available' basis. We target a monthly uptime of 99% (excluding scheduled maintenance). We will endeavour to schedule maintenance during off-peak hours and to provide advance notice of planned downtime where reasonably practicable.

Save as expressly provided in these terms, we exclude all warranties, conditions, and representations, whether express or implied, to the fullest extent permitted by law. In particular, we do not warrant that Frist will be uninterrupted, error-free, or free from security vulnerabilities, nor that any AI Output will be accurate, complete, or fit for any particular purpose.

Nothing in this Clause 7 affects your statutory rights or limits any liability that cannot lawfully be excluded or restricted.

8. Data Protection

For the resident personal data you enter into Frist, you are the data controller and we are your data processor. That processing is governed by the Data Processing Agreement (DPA) which is set out in Schedule 1 to these terms and is incorporated by reference. The DPA sets out the Article 28 UK GDPR obligations, the list of approved sub-processors, security measures, and procedures for handling data subject rights requests and personal data breaches.

For account and billing data, we act as controller in accordance with our Privacy Policy.

Each party shall comply with its respective obligations under applicable data protection law, including the UK GDPR and the Data Protection Act 2018.

Indemnity for data subject claims: Oshylabs shall indemnify you against third-party compensation claims (including claims by residents under section 168 DPA 2018) caused solely by Oshylabs's own failure to comply with its processor obligations under the DPA or applicable data protection law. You shall indemnify Oshylabs against third-party compensation claims caused by your acts or omissions as controller, including your failure to have a valid lawful basis for processing or your failure to comply with Article 22 UK GDPR. Where a claim results from the acts or omissions of both parties, liability shall be apportioned proportionately.

9. Liability

Nothing in these terms excludes or limits either party's liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; (c) any liability that cannot be excluded or limited under applicable law, including liability under the Data Protection Act 2018 to data subjects; or (d) any other liability the exclusion of which is not permitted by law (Uncapped Liabilities).

Subject to the paragraph above, our total aggregate liability to you arising under or in connection with these terms (whether in contract, tort (including negligence), breach of statutory duty, or otherwise) in any rolling twelve-month period is limited to the greater of: (i) the total fees actually paid by you to us in that twelve-month period; or (ii) £5,000.

The following categories of loss are excluded to the fullest extent permitted by law, whether or not they were foreseeable and whether or not we were advised of their possibility: indirect or consequential loss; loss of profit; loss of revenue; loss of anticipated savings; loss of business; loss of goodwill; and losses arising from your own failure to meet a legal duty (including failure to comply with Awaab's Law or other regulatory obligations).

The exclusion of consequential loss above does not apply to losses directly caused by a breach of the DPA or a personal data breach attributable to Oshylabs.

10. Intellectual Property

We own the Frist platform and all intellectual property rights in it, including all software, algorithms, AI models, and documentation. You own all data you enter into Frist. You grant us the limited, non-exclusive, royalty-free licence necessary to host, process, and transmit your data for the sole purpose of providing the service to you in accordance with these terms and the DPA.

We do not use your data, including resident data, to train our AI models or those of any third party.

11. Termination

Either party may terminate the subscription by giving written notice in accordance with the billing terms applicable to your plan. Where no specific notice period is agreed, either party may terminate on 30 days' written notice.

Either party may terminate these terms immediately on written notice if the other party: (a) materially breaches these terms and (where the breach is capable of remedy) fails to remedy it within 14 days of written notice; or (b) becomes insolvent, enters administration or liquidation, or is subject to an analogous insolvency event.

On termination we will make your data available for export for a period of 30 days from the termination date. Following that period, we will delete or return resident data in accordance with the DPA. Account and billing data will be retained for the periods required by law.

12. Dispute Resolution

If a dispute arises in connection with these terms, the parties shall attempt to resolve it in good faith through the following process before commencing formal proceedings:

Step 1, Written notice: the party raising the dispute shall send a written notice to the other setting out the nature and details of the dispute.

Step 2, Good faith negotiation: within 14 days of the notice, representatives of each party with authority to settle shall meet (in person, by telephone, or by video) and attempt to resolve the dispute in good faith.

Step 3, Mediation: if the dispute is not resolved within 28 days of the written notice (or such longer period as the parties agree), either party may refer the dispute to mediation under the Centre for Effective Dispute Resolution (CEDR) Model Mediation Procedure.

Nothing in this Clause 12 prevents either party from seeking urgent injunctive or other interim relief from a court of competent jurisdiction.

13. Force Majeure

Neither party shall be in breach of these terms or liable for any delay or failure to perform its obligations to the extent that such delay or failure results from a Force Majeure Event. A Force Majeure Event means any event beyond a party's reasonable control, including but not limited to acts of God, pandemic, war, terrorism, riots, civil commotion, fire, flood, storm, earthquake, governmental action, regulatory intervention, failure or interruption of third-party telecommunications or internet infrastructure, or failure of a third-party sub-processor or cloud infrastructure provider (including Supabase, Vercel, or Anthropic) where such failure is itself caused by an event beyond that provider's reasonable control.

The party affected by a Force Majeure Event shall: (a) notify the other party promptly; (b) use reasonable endeavours to mitigate the effect of the event; and (c) resume performance as soon as reasonably practicable. If a Force Majeure Event continues for more than 60 consecutive days, either party may terminate these terms on written notice without liability.

14. Variation

We may vary these terms (other than fees, which are governed by Clause 6) by giving you not less than 30 days' prior written notice. We will describe the nature and effect of the change. If you do not wish to accept the revised terms, you may terminate your subscription before the change takes effect, in which case the existing terms will continue to apply until the termination date.

Continued use of Frist after the notice period constitutes acceptance of the revised terms.

15. Governing Law and Jurisdiction

These terms are governed by the laws of England and Wales. Subject to Clause 12 (Dispute Resolution), the courts of England and Wales have exclusive jurisdiction to settle any dispute arising out of or in connection with these terms.

16. General

Entire agreement: these terms (including the DPA at Schedule 1 and the Privacy Policy) constitute the entire agreement between the parties in relation to the subject matter and supersede all prior agreements, representations, and understandings.

Severance: if any provision of these terms is found to be invalid, illegal, or unenforceable, it shall be severed to the minimum extent necessary and the remaining provisions shall continue in full force.

Waiver: no failure or delay by either party in exercising any right shall constitute a waiver of that right.

No partnership or agency: nothing in these terms creates a partnership, joint venture, or agency relationship between the parties.

Third parties: these terms do not confer any rights on third parties under the Contracts (Rights of Third Parties) Act 1999.

17. Contact

Questions about these terms should be directed to arnold.oshenye@oshylabs.eu.

Schedule 1 — Data Processing Agreement

This Data Processing Agreement (DPA) forms part of and is incorporated into the Terms of Service between Oshylabs Ltd (the Processor) and the Customer (the Controller). It applies to the Processing of Resident Personal Data carried out by the Processor on behalf of the Controller through Frist. Where there is any conflict between this DPA and the body of the Terms in respect of data protection, this DPA prevails.

Roles and scope: the Controller is the landlord organisation that subscribes to Frist. The Processor is Oshylabs Ltd. The Processor processes Resident Personal Data only for the purpose of providing Frist to the Controller.

Processor obligations (Article 28 UK GDPR): the Processor processes Resident Personal Data only on the Controller's documented instructions; ensures persons authorised to process are bound by confidentiality; implements the technical and organisational measures set out below; engages only the approved sub-processors and remains fully liable for them, giving at least 30 days' notice of any change; assists the Controller with data subject rights requests and with security, breach notification, and impact assessments; notifies the Controller of a Personal Data Breach without undue delay and in any event within 48 hours; and, on termination, deletes or returns all Resident Personal Data within a 30 day export window followed by deletion.

International transfers: the Processor shall not transfer Resident Personal Data outside the United Kingdom except where appropriate safeguards are in place, namely the IDTA, or the UK Addendum to the SCCs together with the SCCs where the EU GDPR also applies. Transfer Impact Assessments for US transfers are available on request.

Controller obligations: the Controller warrants it has a valid lawful basis under Article 6, and a valid condition under Article 9 UK GDPR and Schedule 1 DPA 2018 for any Special Category Data, for all Resident Personal Data it enters into Frist, and that its instructions are lawful.

Schedule 1, Annex B — Technical and Organisational Measures (Article 32)

Tenant isolation enforced at the database level through row level security scoped to each organisation, so no landlord can access another landlord's data.

Encryption of Resident Personal Data in transit using TLS and at rest.

Role based access control on the principle of least privilege, with heightened restriction for Special Category Data.

Immutable audit logging of key actions on case data.

Data residency within the United Kingdom (London region).

Managed authentication with leaked password protection enabled.

Regular backups, restricted to authorised personnel.

Vulnerability management, monitoring, and access review.