Terms

What this is

nth Labs uses your product the way a stranger would and tells you what is broken. Ten agents drive a real browser against a product you point it at, file what they find with the steps and the screenshot that produced it, and turn a finding you confirm into a check that runs again. Some of that work is deterministic. The rest uses AI, which on the hosted console runs on our account and counts against your plan.

nth Labs comes two ways: a hosted console at console.nthlabs.dev, and software you run on your own machine or server. Both are in beta, and these terms cover both.

Creating an account or running the software means you agree to what is on this page. If you do not, do not use it.

Who the agreement is with

“You” is whoever creates the account or runs the software. Doing either for a company means you are agreeing on that company’s behalf, and that you are allowed to.

“We” and “us” mean the operator of nth Labs: [operating entity: to be named]. The placeholder is deliberate: the entity behind the beta is not settled yet. Whoever it turns out to be answers at hello@nthlabs.dev, and the clauses that rely on it (the licence, the cap, the indemnity, the governing law) are read against them.

Your account

You must be 13 or older to create an account, or older if the law where you live says so. Under 18, a parent or guardian has to be the one who agrees to these terms for you, and any payment or API key is theirs. The limit of 13 comes from children’s data law, not from a content rating: below that age, the law requires a parent to sign consent forms.

An account is one person. Give it an address where you can be reached, keep your password and your sign-in to yourself, and tell us if either stops being yours. What happens under your account is treated as yours, including a run somebody else started with your credentials. Working with other people is what workspaces are for, and they have their own section below.

You can sign in with an email and password, or through Google or GitHub. Those are sign-in only. We ask for your email address and the basic profile that comes with it, and for nothing else: we neither read nor write anything else in your account there.

Only test what you are authorised to test

This is the most important rule in these terms.

You may only point nth Labs at a product you own, or one whose owner has explicitly given you permission to test it. Permission means somebody who can give it has given it, for automated testing, before the run starts. A public URL is not permission. A bug bounty page is not permission unless it says browser automation is in scope.

Automated browsing of someone else’s site without authorisation may violate their terms and, depending on where you are, the law. You are responsible for every target you configure and every credential you hand it, on every run, scheduled runs included, which fire with nobody watching.

Each time a run starts you are warranting that you hold that authorisation, and that you understand what the agents do with it. They act as you: they fill in forms, press buttons, submit them, sign in with the credentials you gave them, and can create, change or delete data in the product they are pointed at. Whatever they do there is treated as done by you.

If you point it at something you were not allowed to test, whatever comes of that is yours. You agree to stand between us and any claim that your use of the tool caused, and to cover what defending it costs.

Where you can, point runs at staging or a preview deployment, and give a signed-in run a test account with limited permissions.

Acceptable use

Beyond the authorisation rule, you may not do any of the following with the service or the software.

• Use it to attack, overload or interfere with anything: ours, a stranger’s, or a product you do have permission to test.
• Work around the guard that decides where a run may point. The guard resolves a target and refuses private, loopback and link-local addresses, and it exists because a browser running inside a shared console can otherwise be aimed at that console.
• Work around plan limits, seat counts, the credit ledger, or anything else that meters what an account may spend on our key.
• Resell or sublicense access, or run the service for other people as though it were yours.
• Reverse engineer, decompile or disassemble the software, except where the law where you live says you may anyway.
• Scrape the console, or drive it with anything other than the interfaces we publish.
• Remove or obscure a copyright, licence or brand notice.
• Break the law with it, or help somebody else do so.

Benchmarking is allowed. Publish what you measure, including the parts that come out badly. Say which version you ran, and show the method.

Who pays for AI usage

On the hosted console, we pay for every AI run. The checks that use AI run on our account with third-party AI providers, and each one counts against your plan’s monthly pool. You do not bring a key and you do not get a second bill.

The checks that need no AI (page health, regression checks, the report and the others that make no model call) cost nothing to anybody and run on every plan, including Free, without limit.

The software you run on your own machine is different: there, AI runs on a key you configure, and that provider bills you directly under its own terms.

Costs shown in nth Labs are estimates built from the usage a run reports. nth Labs is not affiliated with any AI provider.

Plans, fair use and prices

A plan sets what an account may do: how many projects it may hold, how many seats a shared workspace may fill, which features it includes, and its monthly pool of validations. Seats are people: everyone in a workspace shares its plan’s one pool.

Fair use. Each paid plan covers about a stated number of validations a month (Pro about 10, Team about 25, Agency about 100), counted at list price on our side and starting again on your renewal day. We do not show a running meter. When you reach it, the console says so, and paid checks wait until the pool resets, a top-up is bought, or you move to a bigger plan. The free checks are never affected. We may ask an account whose use is far outside what a plan is for to move to one that fits, and we will say so before anything changes.

Top-ups are one-time purchases of more validations for a paid plan. They are used only after the month’s pool and never expire. An optional auto top-up buys one when you run out, is off unless you turn it on, never charges more times in a month than the limit you set, and each one is shown in the console and emailed.

Prices are quoted where a plan is offered and are exclusive of tax. The founding price, where it is offered, stays the price of that subscription for as long as it runs without a break. If we change a price, the change applies from your next renewal after we tell you, and never to a period already paid for.

Tax is yours. We do not add or collect VAT, GST or sales tax today. If tax is due where you are, accounting for it is up to you. That is a description of what the checkout does today, not advice about what you owe.

Renewal, cancellation and refunds

Payments are processed by Stripe on Stripe’s own pages: your card number goes to Stripe and never touches the console.

A plan renews automatically, monthly or yearly as you chose, until you cancel. Cancel any time from Settings, then Plan. A cancelled plan keeps working until the end of the period you paid for and then becomes Free; your projects and findings stay.

A move to a bigger plan applies at once, charged for the rest of the period. A move to a smaller plan, or from yearly to monthly, applies when the current period ends.

If a renewal payment fails, the plan keeps working for 7 days while the card is retried, and the console and an email say so. After that the account is Free until a payment goes through.

14-day money-back guarantee: if nth Labs isn’t for you, email us within 14 days of your first payment for a full refund. Applies once per customer, to your first payment (monthly or yearly). Write to support@nthlabs.dev; the refund is made to the card that paid. After those 14 days, payments are not refunded, except where the law requires it. You can cancel at any time, and the plan keeps working until the end of the period you paid for.

To leave, use Settings, then Danger zone. Leaving deletes your data, as the privacy policy describes. Cancel the plan first, or it renews.

If we ever shut the service down, account holders are told first, and the unused part of a paid period and unused top-ups are refunded without being asked.

Workspaces and seats

A workspace is how more than one person works on the same projects. A workspace has an owner, and for that workspace the owner is who we are contracting with: the plan, the top-ups and the bill are theirs.

A workspace runs on its owner’s plan. A run any member starts counts against that plan’s one monthly pool, which is worth knowing before you invite anyone.

Roles are owner, admin, member and viewer, and they can do different amounts. A viewer reads findings and cannot start a run, because a run costs somebody real money. Seats are counted including the owner, and the plan sets how many there may be.

Inviting somebody means you are satisfied they may see what is in that workspace, including the findings, the screenshots and the stored sign-in details for the products it tests. Everyone who joins agrees to these terms for themselves. The owner stays responsible for the workspace: for what its members do with it, for the authorisation rule on every target it holds, and for the bill.

Who owns what

We own the software. The code, the agents, the finding schema, the console, this site, the name and the mark are ours, and nothing here hands any of it over. The software is licensed, not sold.

You own your side. Your product, your code, your content, your findings, your verdicts, your guards and the memory a project builds up are yours. Nothing here claims a licence over your product or over the things the tool produces about it, and your findings are not training data unless you choose research use, below.

What we may do with your data, and only this. To run the service for you we need to store what you put into it, show it back to you, send what a module needs to the model provider whose key was used, and make it visible to the people you invite. On the hosted console we also keep usage statistics: the days you used it, and how many checks ran and who started them. Never page text, findings or screenshots. They are on unless you switch them off in Settings, and switching them off deletes them. And only if you tick the separate, optional box at sign-up or in Settings, we may use anonymised results from your checks for research: to measure and improve how accurate nth Labs is, with your product’s name, addresses, page text, screenshots and personal details removed. You can withdraw that at any time, and it is never sold. The privacy policy says exactly what each one holds. That is the whole licence. The licence lasts as long as you keep the account, and it exists so the product can work and get better, rather than so we can do anything else with it.

Your licence to the software. While your account is in good standing and these terms are kept, you may use the hosted console, and you may install and run the software on your own machines to test your own products and your clients’ products. You may not copy it beyond that, modify it past configuring it, distribute it, or sublicense it. The licence is personal to you, non-exclusive, non-transferable and revocable, and it ends when your right to use the service ends.

Feedback. Send us a suggestion, a bug report or an idea and we may use it, build it and ship it, owing you nothing for it. If you want to keep an idea, do not send it. This clause covers the ordinary case: people write in with good suggestions, and something we were already building should not turn into a dispute because somebody mentioned it first.

Your data

You can take a copy at any time. Reports export as one HTML file, guards export as standalone Playwright specs that run without us, and if you want the rest of it, email and you get it.

Deleting a project or an account removes it from every live path at once: the record goes, sessions end, and it stops appearing anywhere in the console. The directory behind it is moved to a recycle bin and purged thirty days later, so that a deletion made by mistake can be undone in the days afterwards. Nothing in that bin is reachable from the console, and after the window it is gone for good.

See the privacy policy for what is stored where, and who else ever sees it.

Third-party services

nth Labs is built on other people’s services. Where one of them is involved, its terms apply to that part.

• AI providers: we use third-party AI providers, such as OpenAI, to read the pages and screenshots a run collects. What a run sends goes to them under their terms and is not used by us for training.
• Stripe, for payments. Card details go to Stripe and never to us.
• Railway, where the hosted console runs, and Vercel, where this site is served.
• Google and GitHub, if you sign in through one of them.

We are not affiliated with any of them and we do not control them. If one has an outage, changes its prices, changes its terms or stops serving us, we are not liable for what that costs you, though we will say what happened and what we are doing about it.

Availability

There is no service level agreement, and during the beta there is not going to be one. Nothing here promises uptime, a response time or a support window. The console fires scheduled runs and needs maintenance, so it will be unavailable sometimes with notice and sometimes without.

We may change the product: add modules, retire them, change how one works, change a limit, or stop offering something. Where a change takes away something you were relying on we will tell account holders before it happens if we can. We may discontinue the service entirely, in which case the refund position above applies, and applies without you having to ask.

A copy you run yourself keeps running. Nothing in it contacts us to check whether it still may.

Warranty and liability

This is beta software provided as it is, without warranty of any kind: no warranty of merchantability, fitness for a particular purpose, title, non-infringement, accuracy, or uninterrupted or error-free operation. Findings are evidence-backed but not guarantees: a clean run is not a promise that your product has no defects, and it is not a substitute for your own judgement before you ship. Agents miss things, and a model can be confidently wrong.

To the maximum extent permitted by law, liability is limited to the amount you have paid us in the twelve months before the claim. If you have paid nothing, the limit is zero. Neither of us is liable to the other for indirect, incidental, special or consequential loss, or for lost profits, lost revenue, lost data, or the cost of buying a substitute, including damage done to a product a run was pointed at, which is the case the authorisation rule exists for.

Some places do not allow parts of that to be excluded. Where that is so, this applies as far as it lawfully can and no further, and nothing here excludes liability for fraud, for death or personal injury caused by negligence, or for anything else that cannot be signed away.

Indemnity

You agree to defend us against, and to cover, any claim, loss or cost arising from a target you were not authorised to test, your breach of these terms, your use of the service, anything done under your account or in a workspace you own, and your own product or content.

How that works in practice: we tell you about a claim promptly, you run the defence with counsel we can reasonably accept, we cooperate at your cost, and neither of us settles in a way that admits fault for the other or binds them without their agreement. We may join the defence with our own counsel at our own expense.

Suspension and termination

You can stop at any time: Settings, then Danger zone, or stop using it. A copy you run yourself is yours to delete.

We can suspend an account straight away where a run is doing harm, where a target looks unauthorised, where a payment fails or is disputed, or where the law requires it. For anything fixable, we say what is wrong and give you a fair chance to fix it before going further. Either of us may end this for convenience with thirty days’ notice, by email to the address on the account.

If we end it for convenience, we refund the unused part of a paid period and unused top-ups. Ending for the authorisation rule or another serious breach does not: payments tied to the abuse are not refunded. Either way you get thirty days from the notice to export your data before it is removed, unless the law or the harm being done makes waiting impossible.

Some of these terms continue after the account ends. The authorisation warranty and the indemnity for what you did while you had one, the limits on liability, who owns what, the feedback licence, the governing law and the dispute clauses, and anything else that plainly needs to, all survive.

Governing law and disputes

These terms, and any dispute about them or about the service, are governed by the law of the Province of Ontario and the federal laws of Canada that apply in it, without regard to conflict-of-law rules, and the courts of Ontario have exclusive jurisdiction over them. That is where nth Labs is operated from today. If it is later incorporated elsewhere, this section changes and the change is announced the way any other material change is.

Before either of us files anything, write. Send it to hello@nthlabs.dev and give us thirty days to answer. Most of what gets this far is a misunderstanding about a charge or about what a run did.

You keep the right to bring a qualifying claim in a small-claims court where you live. Nothing here removes a right the law where you live gives you and does not let you sign away: if you are a consumer, your local consumer protection still applies, whatever this section says.

There is no arbitration clause here, and no class-action waiver. If we ever add one it will arrive with the notice these terms require, and it will not reach back over anything that already happened.

Changes to these terms

These terms will change as the beta matures, including when the blank above is filled in. Material changes are announced to account holders before they take effect, by email to the address on the account, and the date at the top of this page moves. Smaller ones (a clearer sentence, a corrected link) go in when they are written.

If a change does not suit you, stop using the service before it takes effect and ask for your unused top-ups and the unused part of a paid period back. Continuing to use the service afterwards means you accept it.

General

If a clause turns out to be unenforceable, it is cut back to what is enforceable or dropped, and the rest of this stands.

These terms and the privacy policy are the whole agreement between us about the service, and they replace anything said before them in an email, a demo or a page on this site. A marketing sentence does not override a clause here.

We may transfer this agreement to whoever takes the business on: a sale, a merger, or the new entity when the blank above is filled. You may not transfer yours without our written agreement.

Not enforcing something once does not mean we have given it up. Nothing here makes either of us the other’s partner, agent or employer.